Valantai Privacy Policy

VALANTAI PRIVACY POLICY
Version 4, 2 November 2026.

1. WHO WE ARE
Valantai Ltd, a company registered in England and Wales with company number 17283056.
Registered office: Apartment 1102, Kitemaker House, 3 New Acres Lane, London SW18 1WB.
Registered with the Information Commissioner's Office, registration number ZC239852.
Privacy contact: thomas@valantai.com. We have not appointed a Data Protection Officer because the law does not require one for our business.
This policy explains how we handle personal data in VLT Gold, including its data rooms, investor rooms, investor portal, AI tools and investor research database.

2. OUR TWO ROLES
Where we decide why and how personal data is used, we are the controller. That covers accounts and sign-in, platform security, records of who accepted which terms, our legal and compliance records, support, feedback, and our investor research database.
Where a client company uses VLT Gold, the company is the controller of the personal data in its documents and records: its data room, its investor contacts, its shareholder register and KYC documents, and the record of what investors do in its rooms. We process that data on the company's instructions, under the Data Processing Schedule in our Terms of Service. If your question is about that data, you can contact the company directly, or contact us and we will pass it on and help.
Where we also act as a company's adviser under a separate engagement, that engagement sets out our role for the advisory work.

3. THE PERSONAL DATA WE HANDLE
- Account information: name, business email, company, role, permissions and sign-in records.
- Platform records: IP address, browser and device information, sign-in and security events, and records of which terms you accepted and when.
- Client content: documents and records a client company uploads or creates, which may name founders, staff, shareholders, investors, advisers and others.
- Investor room activity: which documents an investor opens, how long they spend reading each one, what they download, which folders they open, and that they used the Find, FAQ or report tools. We record that a search happened but never the words searched for. The words are sent to an AI provider to suggest other ways of phrasing the search, and are not stored by us.
- Investor portal information: shareholder details, holdings, transactions, beneficial ownership records and identity documents, with passport numbers encrypted.
- Investor research information: names, firms, job titles, links to professional profiles where a firm's own website gives them, professional background and the firm's stated investment focus.
- Support and feedback: name, email, messages, and any screenshot you choose to attach to Tell Valantai.

4. WHY WE USE IT, AND OUR LAWFUL BASIS
Where we are the controller:
- Accounts and sign-in: to create accounts, identify authorised users and manage access. Legitimate interests in running a secure business service.
- Security and preventing misuse: to detect unauthorised access, investigate incidents and protect confidential information. Legitimate interests, and legal obligation where a specific legal duty applies.
- Terms and legal records: to record acceptance of our terms and of data room terms, and to establish or defend legal claims. Legitimate interests, or legal obligation where one applies.
- Support and feedback: to answer questions, fix faults and improve VLT Gold. Legitimate interests.
- Investor research and matching: to compile, check and keep up to date professional information about investment firms and the people at them, and to match firms to a client's raise. Legitimate interests in providing investor research to companies raising capital (see section 5).
- Meeting our legal obligations. Legal obligation.
Where a client company is the controller, it decides the lawful basis for its own data, and we process that data only on its instructions.

5. THE INVESTOR RESEARCH DATABASE
If you work at an investment firm, we may hold your name, firm, job title, a link to your professional profile, your professional background and your firm's stated investment focus. We collect this automatically from investment firms' own websites, published information about firms' investments, and web searches, using AI tools to extract it. Where a firm's own website links to a person's professional profile (for example on LinkedIn), we keep that link. We do not collect information from LinkedIn itself, and we have not bought or licensed any list of investors. We use it so companies raising capital can find investors whose stated focus fits their raise. Being in the database does not mean you or your firm want to be approached, or would invest in any company.
We recheck the firms we match against at least once every 12 months and update or remove details that are out of date.
A short notice for people in the database is at capital.valantai.com/investor-research-notice. You can ask what we hold about you, ask us to correct it, object to it, or ask us to remove it, by emailing thomas@valantai.com. If you object, we will stop using your details unless we have compelling legitimate grounds that override your interests, or need them for legal claims. In practice, we will normally remove them.

6. AI
VLT Gold uses AI services from Anthropic and OpenAI to draft, check, extract and analyse information in material that client companies provide, to suggest other wordings for searches, and to help compile the investor research database. Our agreements with these providers do not allow them to train their models on this data. AI scores, matches, drafts and analysis can be wrong, and are there to help people decide, not to decide for them. We do not make decisions about anyone based solely on automated processing that have legal or similarly significant effects on them.

7. WHO RECEIVES PERSONAL DATA
Our providers, under written data protection terms: Supabase (database, sign-in and storage), Vercel (hosting), Anthropic and OpenAI (AI processing), and Resend (email). Where each processes data is listed at valantai.com/subprocessors.
A client company sees what it is entitled to see in its own account, including the activity of investors in its rooms.
We may share personal data with our professional advisers, and with courts, regulators and public authorities where the law requires or allows it.
We do not sell personal data.

8. TRANSFERS OUTSIDE THE UK
Some providers, including Anthropic and OpenAI, process data in the United States. Where UK law restricts a transfer, we rely on UK adequacy regulations (including the UK extension to the EU-US Data Privacy Framework where the provider is certified), the UK International Data Transfer Agreement, or the UK Addendum to the EU standard contractual clauses. You can ask us for details of the safeguards for a particular transfer.

9. HOW LONG WE KEEP IT
- Account information: for the life of the account, then up to six years where needed for legal claims.
- Records of which terms were accepted: up to six years after the relationship or access ends.
- Security and sign-in logs: 12 months.
- Support and feedback, including screenshots: 12 months.
- Investor research information: rechecked at least every 12 months, and removed on request or when out of date.
- Client content and investor room activity: as the client company instructs. When a data room is deleted, its contents and activity records are permanently removed 30 days later.
- Identity documents: as the client company that controls them instructs.
- Backups: deleted in our backup cycle, within 35 days.

10. SECURITY
We use access controls, separation of each client's environment, encryption in transit, encryption of identity documents and passport numbers, access logging and backups. No system is completely secure.

11. COOKIES
We use only the cookies needed to sign you in, keep a data room session open and keep the service secure. We do not use advertising or analytics cookies.

12. YOUR RIGHTS
Depending on the circumstances, you can ask for a copy of your personal data, ask us to correct it, delete it or restrict its use, object to our use of it where we rely on legitimate interests, and ask for it in a portable form where the law allows. Where we rely on consent, you can withdraw it at any time. Email thomas@valantai.com. Where a client company controls the data, we will pass your request to it and help it respond.
You can complain to the Information Commissioner's Office at ico.org.uk. Other countries' laws may give you further rights.

13. WHAT YOU MUST GIVE US
To have an account we need your name, business email and sign-in details. Without them we cannot give you access. Anything else is optional, or required by the company whose data room or portal you are using.

14. CHANGES
If we change this policy materially, we will publish the new version and tell you.

Contact: thomas@valantai.com


15. PAYMENTS
If you pay for something in VLT Gold, such as a Research report, Stripe takes the payment on its own payment page. Stripe handles your card details. We never see or store card numbers.
What we keep: your name, your billing email, what you bought, the amount, the date, and Stripe's references for the payment. Stripe also collects a billing address for the invoice, which we can see in our Stripe account.
Why: to give you what you paid for, to deal with refunds and questions, and to keep the accounting records the law requires. Lawful basis: performance of a contract (or our legitimate interests, where the buyer is a company and you act for it), and legal obligation for the accounting records.
How long: six years from the end of the financial year in which you paid, as UK accounting records. We keep these records even if the report or the account is deleted.
Stripe is listed on our subprocessors page at capital.valantai.com/subprocessors. Stripe is also an independent controller for its own legal obligations, such as preventing fraud and meeting financial regulations, and its own privacy policy applies to that.