Privacy Policy

When you create an account, we collect your name, email address, and optional startup profile information (company name, stage, industry, location, target raise). If you enable Signal, we access email metadata (sender addresses, recipient addresses, and timestamps) through the Gmail API. **We never read, store, or process the content or subject lines of your emails.** Metadata is processed in real-time to map connection paths and is not retained after processing. We also collect standard usage data: pages visited, features used, browser type, and device information through cookies and similar technologies.

We use your information to: - Provide, maintain, and improve AngelSearch - Generate AI-powered investor recommendations based on your startup profile - Map warm introduction paths via email metadata (Signal feature) - Send transactional emails (account verification, billing receipts) - Communicate product updates and changes (you can opt out anytime) - Monitor for abuse and maintain platform security We do not sell your personal information to third parties. We do not share your search history, pipeline data, or deck uploads with investors or any other users.

Signal is an opt-in feature that connects to your Gmail account via OAuth. When enabled: - We request read-only access to email metadata (headers only) - We process sender/recipient addresses and timestamps to identify mutual connections with investors - Processing happens in real-time; raw metadata is not stored persistently - Connection strength scores are computed and stored without retaining the underlying email data - You can disconnect Signal at any time from Settings, which immediately revokes our access Our use of Gmail API data complies with the Google API Services User Data Policy, including the Limited Use requirements.

Your data is stored in encrypted databases hosted in the United States. We use industry-standard security measures including: - TLS encryption for all data in transit - AES-256 encryption for data at rest - SOC 2-aligned access controls - Regular security audits and dependency monitoring Pitch decks you upload are stored in isolated, encrypted object storage and are only accessible to you and anyone you explicitly share a link with.

We use the following third-party services to operate AngelSearch: - **Stripe** for payment processing (we never store your full card number) - **Google OAuth** for authentication and Signal email access - **Vercel** for application hosting - **PostgreSQL** (managed) for data storage Each third-party service is subject to its own privacy policy. We only share the minimum data necessary for each service to function.

You have the right to: - **Access** your personal data at any time through your account Settings - **Export** your data (pipeline, saved investors, profile) via CSV export - **Delete** your account and all associated data by contacting support@angelsearch.io - **Opt out** of marketing communications via the unsubscribe link in any email - **Revoke** Signal access at any time from Settings If you are located in the EU/EEA, you have additional rights under GDPR including data portability and the right to lodge a complaint with a supervisory authority. California residents have additional rights under CCPA.

We retain your account data for as long as your account is active. If you delete your account, we remove your personal data within 30 days, except where retention is required by law (e.g., billing records for tax purposes). Anonymous, aggregated data (e.g., total searches per day) may be retained indefinitely for analytics.

We may update this policy from time to time. If we make material changes, we will notify you by email or by posting a notice on the site at least 30 days before the changes take effect.

If you have questions about this Privacy Policy, contact us at privacy@angelsearch.io.