Privacy Policy

This Privacy Policy explains how MatchFund (“we”, “us”) collects, uses, and protects your personal data when you use our service. We act as the data controller for the personal data described below.

This is a template intended for review by qualified legal/privacy counsel before public launch.

1. Data we collect

• Account data — your email address, name, and authentication method (magic-link or Google sign-in).
• Business profile — the optional details you enter to get matches (stage, cheque size, sector, geography, one-line description).
• Usage data — searches, pages viewed, bookmarks, and similar product interactions.
• Billing data — subscription status and the customer/subscription identifiers needed to manage your plan. Card details are handled by Stripe and are not stored on our servers.
• Waitlist data — if you join the waitlist, your email address and the source/referral information.
• Attribution data — how you arrived at MatchFund (campaign tags in the link you followed, the referring website, and the landing page), captured only after you accept analytics cookies, plus your answer to “How did you hear about us?” at signup. We use this only to understand which channels introduce founders to us. It is held in a first-party cookie for up to 90 days and copied to your account at signup.
• Technical data — IP address and request metadata used for rate limiting and abuse prevention.

2. How we use your data

• to provide the service — authenticate you, run searches, and generate investor matches;
• to operate paid subscriptions, including billing and tax;
• to send transactional email (sign-in links, receipts, payment notices, invites);
• to protect the service through rate limiting and bot detection;
• to understand and improve the product through privacy-conscious analytics.

3. Legal bases (UK/EU GDPR)

We process your data to perform our contract with you (providing the service and billing), in our legitimate interests (security, abuse prevention, product improvement), to comply with legal obligations (tax and accounting), and — where required, such as for non-essential analytics cookies — on the basis of your consent.

4. Service providers (sub-processors)

We share data with the following providers strictly to operate the service. Each processes data on our behalf under appropriate agreements:

• Supabase (managed PostgreSQL hosting, United States) — stores account, profile, billing-state, and usage data.
• Vercel (United States) — application hosting and edge delivery, and cookieless web analytics (aggregate page views and traffic sources); the analytics are loaded only with your consent.
• Resend — transactional email delivery (sign-in links, receipts, invites).
• Google — optional Google sign-in (OAuth) and reCAPTCHA bot protection on sign-up forms.
• Stripe — subscription payments, customer portal, and tax calculation. Stripe handles your card details directly.
• Upstash (Redis) — rate-limit counters keyed to your account or IP.
• PostHog (United States) — product analytics; loaded only with your consent.

5. Cookies and analytics

We use a session cookie to keep you signed in (essential, always on). We use PostHog for product analytics and Vercel Web Analytics for aggregate traffic measurement. Vercel Web Analytics is cookieless and sets no identifier on your device; we still load it only after you consent, so that accepting or rejecting analytics applies to every analytics provider we use. You can change your choice at any time.

If you accept analytics, we also set a first-party attribution cookie (“mf_attribution”, up to 90 days) that records how you arrived (campaign tags and referring site) so we can measure which channels work. It contains no advertising identifiers and is never set before you consent.

6. Data retention

We keep account and profile data for as long as your account is active. Billing records are retained as required by tax and accounting law. Waitlist entries are kept until you ask us to remove them or they are no longer needed. When data is no longer required, we delete or anonymise it.

7. International transfers

MatchFund is operated by a United States company, and our infrastructure is hosted in the United States. Our primary database (Supabase) and application hosting (Vercel) are located in the US, as are Stripe (payments) and PostHog (analytics). If you are in the UK or EEA, this means your personal data is transferred to the United States. We rely on appropriate safeguards for those transfers — the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum — together with additional technical and organisational measures such as encryption in transit and at rest.

8. Your rights

Subject to applicable law, you have the right to access, correct, delete, restrict, or object to the processing of your personal data, to data portability, and to withdraw consent where processing is based on consent. To request deletion of your data, use our data-deletion request form; for any other request, email us at the address below. You also have the right to complain to your data-protection authority.

9. California privacy rights (CCPA/CPRA)

If you are a California resident, you have the right to know what personal information we collect and how we use it, to request access to or deletion of your personal information, and to correct inaccurate information. We do not sell your personal information, and we do not share it for cross-context behavioural advertising. You will not be discriminated against for exercising these rights. To make a request, email us at the address below.

10. Children

The Service is not directed at children, and we do not knowingly collect personal data from anyone under 16. If you believe a child has provided us personal data, contact us and we will delete it.

11. Security

We use industry-standard measures to protect your data, including encryption in transit, access controls, and tier-gated access to investor contact details. No method of transmission or storage is completely secure, but we work to protect your information.

12. Changes and contact

We may update this policy from time to time; material changes will be communicated through the service or by email. For any privacy question or to exercise your rights, email [email protected].