Privacy Policy
v1.0 · 2026
1. Controller
The controller of your personal data is Fundacja "Konstelacja.org", ul. Morska 30B/5, 84-240 Reda, Polska, KRS 0000974966, NIP 5882481701, REGON 522216641, e-mail: ada@ada-margo.com. Contact for all data-protection matters: ada@ada-margo.com or by post to the registered address. The Foundation has not appointed a Data Protection Officer, as it is not required to under Art. 37 GDPR.
2. Data we process
Account data (name, email, company, role); investor verification details; signed agreements (full name, typed signature, IP address, timestamp, user agent, agreement version, PDF copy); payment and subscription status (card data is processed only by Stripe); deck view logs (page, duration, time, watermark data); feedback, call requests and messages; technical data (necessary cookies, security logs).
3. Purposes and legal bases
a) Account and service delivery, NDA conclusion, paid access — Art. 6(1)(b) GDPR (contract). b) Accounting and tax obligations — Art. 6(1)(c). c) Protection of confidential information, leak tracing, fraud prevention, establishing and defending claims — Art. 6(1)(f) (legitimate interest). d) Investor verification — Art. 6(1)(b) and (f). e) Optional analytics and newsletters — Art. 6(1)(a) (consent, withdrawable at any time).
4. AI matching
When a verified investor uses AI matching, only their written criteria and teaser-level project data are sent to an AI model provider. No deck content and no Stealth identities are shared. No decisions with legal effect are made automatically (Art. 22 GDPR).
5. Recipients
Processors acting on our instructions under Art. 28 GDPR: cloud hosting and database (Lovable / Supabase, Cloudflare), payments (Stripe Payments Europe Ltd.), AI model providers via Lovable AI Gateway. Founders see which verified investors viewed their deck and time per page. Authorities where required by law. We never sell personal data.
6. Transfers outside the EEA
Some processors may process data outside the EEA (e.g. the USA). Transfers rely on the EU–US Data Privacy Framework or Standard Contractual Clauses (Art. 46 GDPR).
7. Retention
Account data — while the account is active, then up to 6 years for claims. Signed NDAs and access logs — term of the agreement plus the limitation period (generally 6 years). Accounting records — 5 years from the end of the tax year. Consent-based data — until consent is withdrawn.
8. Your rights
Access, rectification, erasure, restriction, portability, objection (Art. 15–21 GDPR), withdrawal of consent at any time without affecting prior processing, and the right to lodge a complaint with the President of the Personal Data Protection Office (PUODO), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl.
9. Voluntary provision
Providing data is voluntary but required to create an account, sign an NDA and purchase access.
10. Security
Decks are stored privately and shown only through 60-second signed page links with dynamic watermarks; access is enforced by row-level security; transport is encrypted (TLS).
11. Changes
We will announce material changes in the service. Version 2.0, effective 4 October 2026.