Privacy notice
What is recorded when you open a document shared through PitchVault, or receive an email a founder sent with it.
What we record
- The email address you enter, when the sender requires one.
- Your IP address, browser user agent and the referring page.
- Which page of the document is on screen and for how long, while the tab is visible and you are active.
What we do not record
No keystrokes, no mouse tracking, no screen recording, and no advertising or cross-site cookies. Nothing is shared with a third-party analytics provider.
Cookies and your choice
A consent banner appears on your first visit. It covers two categories, and you can reopen it at any time from the cookie icon in the corner of the page.
- Essential — keeps a sender signed in, and identifies the browser that was granted access to a document so we can deliver it. These cannot be switched off, and expire after 12 hours for viewers.
- Read analytics — measures how long you spend on each page. This is off unless you turn it on. If you decline, the document still opens normally and no page timings are recorded.
Your choice is stored in a first-party cookie named pitchvault_gdpr. If you allow analytics, that cookie also holds a random identifier generated in your browser, used only to tell one reading session apart from another. It is not linked to any profile and is not shared with anyone.
Who sees it
Only the person who shared the link with you. It is used to understand which parts of the document were useful.
How long it is kept
View sessions, including the IP address, are deleted 90 days after the view. Aggregated page timings may be retained without identifiers.
If a founder emailed you
Founders can write to investors from their own mailbox through PitchVault. Those emails come from the founder, not from us. For each one, the founder can see:
- Whether it was opened, through a small image in the email. Many mail apps load it automatically, so this is a rough guide at best.
- Which links in it were clicked, and when.
- If you open their deck from the email, the same page timings described above, under your email address.
Every email has an unsubscribe link. Using it stops all further emails from that founder to your address, and it stays stopped even if they re-import their list.
Your rights
Under the GDPR you may ask the sender for a copy of the data recorded against your email address, ask for it to be corrected, or ask for it to be deleted. Contact the person who sent you the link; they can remove the record from their dashboard.