Privacy Policy
In short
- We collect what an investor gives us about a company, what a founder submits, and what public and official sources return.
- Founders are checked only after they consent, and they can see and comment on their own report.
- We never collect ID images, selfies or biometric data, and we never sell or share your data.
- Your rights depend on where you live — see "Where you live" below — and you can act on many of them directly from your report page.
1. Who we are
Evifound operates evifound.com and the evifound platform. Privacy contact: info@evifound.com (or info@evifound.com).
For personal data about founders processed on a subscriber's instruction, the subscribing investor is the controller and we act as processor under the Data Processing Addendum. For our own accounts, website, security and billing we are the controller.
2. What we collect
From subscribers (investors) Name, work email, organisation, role, account credentials, billing details, support correspondence, and usage and device data.
From founders and company officers Legal name and other names or variants, date of birth, nationality, citizenship country, country/region of residence, contact email, company legal name and incorporation details, LinkedIn/X links, an optional résumé, optional supporting documents, referees (name, role, company, email, relationship), prior-fundraising information, and comments made on a report. We do not request identity-document details or a residential address.
We do not collect ID images, selfies, or any biometric identifier, ever.
Screening data The results of sanctions, watchlist, PEP, adverse-media, criminal-record, regulatory-fitness and insolvency screening, where lawful in the relevant jurisdiction.
From public and official sources Company registry entries, officer and directorship records (including UK Companies House, GLEIF, and registers in Canada, Ireland, Spain and Australia), adverse media, patents, trademarks and assignment records, academic publications, press coverage and public social profiles. Coverage varies by country and source. This data is retrieved from independent third-party data providers, official registers, and public sources; Evifound does not generate or originate any of it.
Automatically IP address, browser and device information, pages viewed, and error and performance diagnostics. Cookies are described in the Cookie Notice.
3. Why we use it, and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Providing the platform and accounts to subscribers | Contract |
| Running verification checks about a founder | The founder's explicit, versioned consent, and the investor's legitimate interest in diligence |
| Screening for criminal, insolvency, PEP, sanctions and adverse-media records | Explicit consent and, where applicable, substantial public interest / legal obligation, and only where lawful in the relevant jurisdiction |
| Producing the Evidence Ledger and report exports | Contract and legitimate interests |
| Billing, fraud prevention and security | Contract, legal obligation and legitimate interests |
| Service emails and support | Contract |
| Marketing emails to business contacts | Consent or legitimate interests, with opt-out in every message |
| Improving reliability and diagnosing faults | Legitimate interests |
4. What we do not do
- We do not sell or share personal data for cross-context behavioural advertising, and we do not share it with data brokers.
- We do not use founder data to train general-purpose AI models.
- We do not run verification about a founder who has not consented.
- We do not collect ID images, selfies, or biometric data of any kind.
- We do not use the service for consumer-eligibility decisions; see Not a Consumer Report.
We do not see, use, or share your private data.
This means we do not access, use, or disclose personal data for any purpose beyond running the verification you requested — no secondary use, no data broking, no marketing to founders, no training of general-purpose AI models, no sharing with third parties except the sub-processors needed to deliver the service and authorities where law requires it.
5. Who we share with
- The requesting investor, who receives the report and may share it internally and with advisers and co-investors on the same opportunity, under confidentiality.
- Recipients of a share link, which the investor controls, which expires after 30 days (extendable or revocable), and every view of which is recorded in an access log.
- Sub-processors by category, as listed on the Sub-processors page.
- Authorities, where required by law or to establish or defend legal claims.
- A successor, in a merger or acquisition, subject to this policy.
6. Data locations and international transfers
We and our sub-processors process personal data in the EU, the United Kingdom and North America; public and official sources are queried globally to run checks. Where data leaves its country of origin, we use an appropriate transfer mechanism, including the EU Standard Contractual Clauses, the UK International Data Transfer Agreement / Addendum, and adequacy decisions where available, together with supplementary technical measures such as encryption.
7. Public-sources notice
Some of the data in a report — for example company registry entries, court and insolvency records, sanctions and watchlist entries, patents, publications, press coverage and public social profiles — is obtained from publicly available or official sources rather than directly from the founder. Where applicable law (including Article 14 GDPR/UK GDPR) requires it, this section serves as that notice: we use this data to run the checks described in the Verification Methodology and Source Notice, we keep it for the periods in section 9 below, and the rights in section 10 apply to it in the same way as to data you gave us directly.
8. Sensitive and special-category data
Screening for criminal-record, insolvency, PEP, sanctions and adverse-media matches involves special-category or criminal-offence data. We process this only with the founder's explicit consent, given as part of the versioned consent set described in the Verification Methodology and Source Notice, and only where lawful in the relevant jurisdiction. Where a jurisdiction prohibits a private party from running a category of check, we do not run it, and the line is reported as Unavailable. We hold no biometric identifiers of any kind.
9. How long we keep it — retention
Deletion also runs earlier where a founder withdraws consent, declines, or exercises a deletion request, subject to any legal retention obligation.
| Data | Retention |
|---|---|
| Subscriber account and billing records | For the account term, then up to 7 years where tax or accounting law requires |
| Raw provider payloads (screening and registry lookups) | Deleted by a nightly retention job 12 months after they are received |
| Access logs (report views, shared links, exports) | Deleted by a nightly retention job 12 months after creation |
| Verification records and reports | Deleted or anonymised 24 months after consent withdrawal or decline, or after the subscription ends, whichever applies |
| Support correspondence | Up to 3 years |
10. Your rights and how to use them
Depending on where you live, you can request access, correction, deletion, restriction or portability, object to processing based on legitimate interests, and withdraw consent at any time. A founder can do most of this directly from their private report page:
- Download my data — a full JSON export of everything held about you.
- Withdraw consent — stops further checks; any pending check becomes Unavailable, and the investor is notified.
- Request correction or deletion — opens a tracked request with a 30-day response clock; the investor and evifound are both notified.
You can also exercise any of these rights, and complain to your data-protection authority, by emailing info@evifound.com. We respond within one month (or the period required by local law) and may ask for proof of identity. Founders can also raise corrections through the Accuracy, Correction and Dispute Policy.
11. Where you live
Your rights, and the rules that apply to us, vary by location. This section summarises the position; it does not limit the general rights above.
Canada
We comply with PIPEDA and, where applicable, Quebec's Law 25. You have the right to access and request correction of your personal information, to withdraw consent, and to know when your information crosses a provincial or national border for processing (see section 6). Where automated processing is used to produce a line in your report, you are entitled to be informed of that fact and, on request, of the personal information used and the main factors that led to the result — see the AI and Automated Processing Notice.
United States
Evifound is not a consumer reporting agency and reports are not "consumer reports" under the Fair Credit Reporting Act (FCRA) — see Not a Consumer Report. Depending on your state (including California's CCPA/CPRA, and comparable Texas and Washington laws), you may have the right to know, access, correct, delete and, where applicable, limit use of your sensitive personal information. We do not sell or share personal data for cross-context behavioural advertising, so there is no "Do Not Sell or Share My Personal Information" opt-out to exercise — we do not do it. Under Illinois BIPA and similar biometric-privacy laws: we hold no biometric identifiers or biometric information, because we never collect an ID image, selfie or any biometric data.
European Union / EEA
We process personal data under the GDPR. Our lawful bases are set out in section 3 (Art. 6) and section 8 (Art. 9 and Art. 10, for special-category and criminal-offence data — explicit consent, and only where national law permits the processing). Where data is obtained from public sources, the Art. 14 notice in section 7 applies. Automated processing is described in the AI and Automated Processing Notice; we do not make decisions with legal or similarly significant effect by automated means alone (Art. 22). We maintain a data protection impact assessment (DPIA) for the verification processing. If evifound does not have an establishment in the EU, an EU representative will be appointed under Article 27 GDPR; details will be published here once appointed.
United Kingdom
The UK GDPR and the Data Protection Act 2018 apply, including Schedule 1 conditions for processing criminal-offence data, which we meet through explicit consent and the safeguards in this policy. If evifound does not have a UK establishment, a UK representative will be appointed; details will be published here once appointed.
EU AI Act
See the AI and Automated Processing Notice: automated processing is used to assist extraction, matching and summarisation, with a human reviewing every report; it is not used to take decisions with legal or similarly significant effect.
Australia
We handle personal information in line with the Australian Privacy Principles, including collecting only what is reasonably necessary (APP 3), using or disclosing it only for the purpose collected or a related purpose you would expect (APP 6), and applying safeguards to any cross-border disclosure (APP 8), consistent with section 6 above.
Singapore
We comply with the Personal Data Protection Act 2012 (PDPA), including obtaining consent for collection, use and disclosure, and providing access and correction rights on request.
India
We comply with the Digital Personal Data Protection Act 2023 (DPDP Act), including processing on the basis of consent or another permitted ground, and providing rights of access, correction and grievance redress via info@evifound.com.
Bangladesh
Where applicable data-protection law in Bangladesh applies to our processing of your information, we process it lawfully and fairly and will honour a request made under that law.
Brazil
We comply with the Lei Geral de Proteção de Dados (LGPD), including a lawful basis for each processing purpose and the rights of access, correction, deletion, portability and information about sharing.
Japan
We comply with the Act on the Protection of Personal Information (APPI), including purpose limitation, security controls, and rights of disclosure, correction and suspension of use.
Switzerland
We comply with the Federal Act on Data Protection (FADP), including the transparency and rights obligations it sets out; the transfer safeguards in section 6 apply to transfers out of Switzerland.
South Africa
We comply with the Protection of Personal Information Act (POPIA), including a lawful basis for processing and the rights of access and correction.
Everywhere else
Where you are in a jurisdiction not listed above, we still apply the general protections in this policy. Where local law prohibits a particular check for a private party, we do not run it and the line is marked Unavailable — see the Verification Methodology and Source Notice.
12. Do Not Sell or Share
Evifound does not sell personal data, and does not share personal data for cross-context behavioural advertising. There is nothing to opt out of.
13. Automated processing
Automated processing assists with claim extraction, matching and summarising. It does not make decisions with legal or similarly significant effects on its own. See the AI and Automated Processing Notice.
14. Security
Encryption in transit and at rest, role-based access control, tenant isolation, expiring and revocable share links (30 days) and founder invite links (30 days, re-sendable), an access log recording every view of a report, ledger, shared link or PDF export, rate limiting on public links, signature-verified provider webhooks, an enforced Content-Security-Policy, secret management, dependency scanning and backups. No system is perfectly secure; tell us immediately if you suspect a problem.
15. Children
The service is for business users. We do not knowingly process data about anyone under 18.
16. Changes
We will post any update here and change the effective date. Material changes are notified to subscribers.