1. Data Controller
RaiseAxis Ltd ("we", "us"), registered in England and Wales, is the data controller for personal data processed through this platform. We are committed to protecting your data in compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
2. Data We Collect
Account Data
Email address, name, company name, sector, funding stage, and role, collected during registration and onboarding.
Usage Data
Pages visited, features used, timestamps, IP addresses, and browser user agent strings, collected automatically to improve the Service.
Investor Contact Data
Names, email addresses, phone numbers, firm details, and notes about investors that you add to the platform.
Documents
Files you upload to data rooms, including metadata such as file name, size, and MIME type.
Activity Logs
Records of document views, downloads, share link usage, and investor update engagement, to provide you with analytics.
3. Lawful Basis for Processing
We process your data under the following lawful bases:
- Contract performance (Article 6(1)(b) UK GDPR), to provide the Service you have subscribed to
- Legitimate interests (Article 6(1)(f)), for analytics, security monitoring, and service improvement, where these do not override your rights
- Consent (Article 6(1)(a)), for optional marketing communications, which you may withdraw at any time
- Legal obligation (Article 6(1)(c)), to comply with applicable UK laws and regulations
4. How We Use Your Data
- To provide, maintain, and improve the platform
- To authenticate your identity and secure your account
- To send transactional emails (password resets, verification, investor updates you initiate)
- To generate analytics about data room and update engagement
- To respond to support requests
- To comply with legal obligations
5. Data Sharing and Processors
We do not sell your personal data. We share data only with the processors below, each governed by appropriate data processing agreements:
- Supabase — cloud hosting, database, and authentication services (EU region, Standard Contractual Clauses in place)
- Resend — transactional and marketing email delivery (Data Processing Agreement accepted)
- Stripe — subscription billing and payment processing (covered under Stripe's standard terms)
- Lovable AI Gateway / Gemini 2.5 Pro — AI-powered document review and materials analysis. Documents are processed for audit and feedback generation only; we do not use your data to train third-party models. Data is handled under the Lovable AI Gateway terms and Google's Gemini API terms.
- Google Analytics 4 — anonymised website and platform usage analytics. Data is processed under Google's privacy policy.
- Meta (Facebook Pixel) — conversion tracking for advertising campaigns. Data is processed under Meta's privacy policy.
- Recipients you choose: when you share data room links or send investor updates, recipient email addresses and engagement data are processed as directed by you
6. International Transfers
Where data is transferred outside the UK, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the ICO, or transfers to countries with adequacy decisions.
7. Data Retention
We retain your data for as long as your account is active. Upon account deletion:
- Account and company data: deleted within 30 days
- Documents in data rooms: deleted within 30 days
- Activity logs: anonymised or deleted within 90 days
- Billing records: retained for 7 years as required by UK tax law
8. Your Rights (UK GDPR)
You have the right to:
- Access: request a copy of your personal data
- Rectification: correct inaccurate data
- Erasure: request deletion of your data ("right to be forgotten")
- Restriction: restrict processing in certain circumstances
- Portability: receive your data in a structured, machine-readable format
- Object: object to processing based on legitimate interests
- Withdraw consent: where processing is based on consent
To exercise any of these rights, contact us at privacy@raiseaxis.com. We will respond within one month, as required by UK GDPR.
9. Security Measures
We implement appropriate technical and organisational measures, including:
- Encryption in transit (TLS 1.3) and at rest (AES-256)
- Row-level security on all database tables
- Per-document access controls and watermarking
- Password hashing using bcrypt
- Regular security audits
10. Cookies
We use essential cookies for authentication and session management. With your consent, we also use analytics cookies (Google Analytics 4) and marketing cookies (Meta Pixel) to improve the platform and measure advertising effectiveness. For a full list of cookies, purposes, and duration, see our Cookie Policy.
11. Children's Privacy
The Service is not directed to individuals under 18. We do not knowingly collect personal data from children.
12. Supervisory Authority
You have the right to lodge a complaint with the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint.
13. Changes to This Policy
We may update this policy from time to time. Material changes will be communicated via email at least 30 days before taking effect.
14. Contact Us
Data Protection queries: privacy@raiseaxis.com
RaiseAxis Ltd · England and Wales