Data processing & security overview

Your organization is the controller for the content it uploads. Ocean Capital ApS, CVR 34608601, Denmark, is the processor and handles that content only to provide the service and on your instructions. For our own account and billing data we are controller — see the Privacy Policy.

Venture records, uploaded documents and the text read from them, claims and evidence, snapshots, strategy, review notes and optional recordings, and the names and email addresses of people invited into the organization.

• Every record belongs to one organization, and access is enforced inside the database with row-level security, not just in the interface.
• Uploaded documents are kept in private storage that cannot be reached by a public link; access is granted through short-lived signed links to members of the organization.
• All traffic to the site and between our services is encrypted in transit (HTTPS/TLS).
• Organization roles and platform staff roles are stored separately; staff tools check the staff role on the server.
• Paid features and AI usage limits are checked on the server before any change is made.
• AI output never changes your venture on its own — each proposal records its source and waits for a person to approve it.
• Strategic changes, approvals and administrative actions are written to an audit log.
• Passwords are handled by the sign-in provider and stored only as secure hashes; card details go directly to Stripe.

We do not use your content to train AI models. When you request analysis, the relevant content is sent to the AI provider only to produce that output, and the result is stored in your workspace as a proposal.

• Lovable — Application hosting and the managed backend: database, sign-in, private file storage and account emails.
• Cloudflare — Edge network that serves the published website and runs server code.
• Google (Gemini models, reached through the Lovable AI gateway) — Reads your uploaded material and venture data to produce the analysis you request (claims, snapshots, strategy proposals, review minutes).
• Stripe — Payment processing, subscriptions and invoices for paid plans.

Where these providers process data outside the EU/EEA, transfers rely on the EU–US Data Privacy Framework or standard contractual clauses.

Members can download their data from account settings. Deleting an account removes every organization where that person is the only member, with all its content and stored files. Organizations can ask us to delete a whole workspace through the contact form.

Customers who need a signed data processing agreement can request one through the contact form.