Privacy Policy

The data controller is Ocean Capital ApS, CVR 34608601, Denmark, which operates Venture Builder OS. You can reach us through the contact form.

For venture material that an organization uploads to its workspace, the organization decides what is uploaded and why, and we process it on its behalf. See the data processing overview.

• Account data: name, email address, password (stored only as a secure hash by our sign-in provider), optional job title, and the organizations you belong to and your role in them.
• Venture content: ventures, uploaded documents and the text read from them, claims, snapshots, strategy, reviews and, if you use review recording, audio and transcripts.
• Usage data: product events such as page visits and actions taken, a random anonymous visitor identifier kept in your browser, and monthly AI usage counts per organization.
• Investor sharing: recipient labels, link creation and expiry dates, and view timestamps with a one-way visitor hash derived from the internet connection and browser. Raw IP addresses are not stored. The same visitor is counted once per link per hour. Founders can revoke links at any time.
• Billing data: plan and subscription status. Card details are entered directly with Stripe and never reach our servers.
• Messages: what you send through the contact form, plus your browser's user agent and a one-way hash of your IP address used only to prevent abuse.
• Newsletter: your email address if you subscribe.

• Providing the service you signed up for, including AI analysis you request — performance of a contract (GDPR art. 6(1)(b)).
• Billing and bookkeeping — legal obligation (art. 6(1)(c)) under Danish bookkeeping rules.
• Security, abuse prevention and improving the product with first-party usage data — our legitimate interest (art. 6(1)(f)).
• Newsletter — your consent (art. 6(1)(a)), which you can withdraw at any time.
• Answering contact messages — our legitimate interest in replying to you, or steps before a contract.

We do not use your content to train AI models. When you ask the product to analyse material, the relevant content is sent to the AI provider listed below only to produce that output. Every AI result arrives as a proposal that a person must approve before it changes your venture.

We do not use third-party advertising or analytics trackers. The site stores a small number of items in your browser: your sign-in session, a random anonymous visitor identifier, and simple preferences such as which onboarding step you are on. Product events are recorded in our own database and are not shared with analytics companies. Test accounts are excluded from usage statistics.

• Lovable — Application hosting and the managed backend: database, sign-in, private file storage and account emails.
• Cloudflare — Edge network that serves the published website and runs server code.
• Google (Gemini models, reached through the Lovable AI gateway) — Reads your uploaded material and venture data to produce the analysis you request (claims, snapshots, strategy proposals, review minutes).
• Stripe — Payment processing, subscriptions and invoices for paid plans.

Some of these providers are based in, or may process data in, the United States. Where personal data leaves the EU/EEA, the transfer relies on the EU–US Data Privacy Framework where the provider is certified, or on the European Commission's standard contractual clauses.

• Account data and venture content: for as long as your account exists.
• When you delete your account, your profile and every organization where you are the only member — with its ventures, documents, claims, snapshots and reviews — are deleted immediately. Organizations shared with others remain, without your membership.
• Review recordings can be set to be discarded after the minutes are approved.
• Billing records: as long as Danish bookkeeping law requires (currently five years).
• Contact messages: as long as needed to handle your request, and no longer than 24 months.

Under the GDPR you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected (rectification);
• have your data erased;
• restrict processing;
• receive your data in a portable format — use "Download my data" in account settings;
• object to processing based on our legitimate interest;
• withdraw consent at any time, where processing relies on consent.

Send requests through the contact form with the topic "Privacy request". You can also complain to the Danish Data Protection Agency (Datatilsynet, datatilsynet.dk).

The measures we use are described in the data processing & security overview.