VLT Gold Terms of Service

While VLT Gold is in beta, the Beta Terms also apply. If you pay to unlock a Research report, the Research purchase terms apply to that purchase.

VLT GOLD TERMS OF SERVICE
Version 2.1, 31 October 2026. Between Valantai Ltd, a company registered in England and Wales with company number 17283056 ("Valantai", "we"), and the company that opens the account ("you"). By accepting these terms when the account is opened, or when asked to accept them in VLT Gold, you agree to them.

A1. What VLT Gold is. VLT Gold is software that helps a company prepare and run a capital raise: a data room, tools that draft and check documents, analysis, investor research and matching, investor rooms through which you share documents with investors you choose, and an investor portal. It is information and drafting assistance. It is not investment, legal, tax or accounting advice, it does not assess whether any investment is suitable for anyone, it is not an offer of securities, and it does not promise any fundraising outcome. Investor matching identifies investors whose stated criteria appear to fit yours; it does not mean they will be interested, and Valantai does not introduce, negotiate or act for you or any investor. The investor portal keeps a working record of the holdings and transactions entered in it; your statutory registers remain the legal record, and you remain responsible for their accuracy.

A2. Who you are. You are the legal entity identified when the account was opened, including its registered number (once it has one) and its country of registration. The person who opens the account confirms that they are authorised to accept these terms for it. VLT Gold is for business use only: you confirm that you use it wholly for the purposes of your trade or business and not as an individual consumer.

A3. Your account. You are responsible for keeping sign-in details secure and for what is done under your account. Your account owner decides who on your team has access and may withdraw it. You must give accurate information and keep it up to date.

A4. Your content. Documents, data and other material you upload ("Your Content") remain yours. You give Valantai a licence to store, copy, process, display and analyse Your Content only to provide, secure and support VLT Gold for you and to comply with law, including processing by the providers listed in Schedule C. We do not use Your Content to train AI models. You are responsible for Your Content: that it is accurate, that it is lawful, and that you have every right and permission needed to upload it and have it processed. For personal data you submit or collect through VLT Gold, you are responsible for having a lawful basis, for giving the people concerned the privacy information the law requires, and for making sure your instructions to Valantai comply with data protection law. Valantai remains responsible for its own obligations as your processor and as an independent controller.

A5. What VLT Gold produces. Drafts, documents, scores, matches and analysis that VLT Gold produces for you ("Outputs") are yours to use, and to the extent any rights exist in them we assign those rights to you. VLT Gold itself, its templates, methods and the investor database remain Valantai's. Outputs are produced automatically, may contain errors, are not verified by Valantai, and other clients may receive similar Outputs. You must check every Output against your own information, and take professional advice where it matters, before you rely on it, adopt it or share it.

A6. Using VLT Gold properly. You must not:
(a) use VLT Gold unlawfully, or upload material you have no right to share, that infringes anyone's rights, or that is malicious;
(b) use VLT Gold to make an offer of securities to the public, or to communicate a financial promotion, unless it has been reviewed by appropriately qualified advisers and is lawful where it is received;
(c) try to access another client's environment, get round access controls, or share sign-in details;
(d) copy, scrape, export in bulk or republish the investor database, or use it except within VLT Gold for your own raise;
(e) impersonate an investor or any other person;
(f) use VLT Gold in breach of any sanctions or export control law, or for the benefit of a sanctioned person;
(g) upload special category personal data (for example health data) unless it is necessary and you are permitted to.
If we reasonably believe material in your account is unlawful, we may ask you to remove it or stop sharing it, and you will do so.

A7. Feedback. If you send us feedback or suggestions, including through Tell Valantai, we may use them to improve our products without paying you. This does not cover your confidential information. We handle personal data in feedback for support, fixing faults and improving our products, as described in our Privacy Policy. If feedback contains personal data we process for you, Schedule C also applies to it.

A8. Confidentiality. Each party will keep the other's confidential information confidential and use it only for the purposes of these terms. For Valantai, your confidential information includes Your Content, and we will use it only to provide, secure and support VLT Gold and to comply with law. Either party may disclose confidential information to its staff, advisers and providers who need it and are bound by confidentiality, or where the law requires. This continues for five years after the account ends, and for as long as the information remains a trade secret.

A9. What we promise. We will provide VLT Gold with reasonable care and skill. Beyond that, and to the extent the law allows, we do not promise that VLT Gold will be uninterrupted, error free, or suitable for any particular raise or transaction.

A10. Liability.
10.1 Nothing in these terms limits or excludes liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or any other liability that cannot lawfully be limited or excluded.
10.2 Neither party is liable for indirect or consequential loss, or for loss of profit, revenue, business opportunity or goodwill, whether direct or indirect.
10.3 Clause 10.2 does not exclude your reasonable direct costs of restoring your data from our most recent available backup where we caused its loss.
10.4 Subject to 10.1, Valantai's total liability to you, however it arises (in contract, negligence or otherwise, and including for breach of clause A8 (confidentiality), of Schedule C (data processing), or for infringement of a third party's intellectual property caused by VLT Gold), for all events in a Contract Year is limited to the greater of: (a) the fees paid or payable for VLT Gold in that Contract Year; and (b) £2,500.
10.5 VLT Gold runs on third-party hosting, database, email and AI providers. Valantai is not liable for loss caused by the failure, outage or error of any such provider where Valantai chose and used that provider with reasonable care and could not reasonably have prevented or limited the loss. This does not reduce Valantai's obligations under Schedule C (data processing) or any liability that cannot lawfully be excluded. Where Valantai recovers money from a provider for a loss you suffered, it will pass a fair share to you.
10.6 "Contract Year" means each period of twelve months starting on the day the account was opened. Events from the same cause are treated as one event, occurring when the first of them occurred.

A11. Your responsibility for claims about your content. You will reimburse Valantai for reasonable losses and costs from a claim by a third party that Your Content, or anything you communicated to investors or anyone else using VLT Gold, infringes their rights, breaches data protection law or is an unlawful financial promotion or offer, except to the extent caused by Valantai's own negligence or by Valantai changing Your Content without your instruction. Valantai will tell you promptly about any such claim, let you take part in its defence, and take reasonable steps to limit the loss.

A12. Suspension and ending.
12.1 We may suspend access at once if we reasonably believe there is an urgent security risk, unlawful use, or a serious breach of clause A6. Where it is practical, we will tell you why and give you a chance to put it right first.
12.2 Either party may end the account by giving 14 days' notice. We may end it at once for a serious breach you have not put right within 14 days of our notice.
12.3 You may export your documents and records at any time while you have access, and for 30 days after access ends, unless the law or a real security risk prevents it. After that, we will delete Your Content as set out in Schedule C.
12.4 Clauses A4 (licence, for as long as we still hold Your Content), A5, A8, A10, A11, A12.3 and Schedule C continue after the account ends.

A13. Fees. Where fees apply, they are agreed in writing with you before you are charged. Providing VLT Gold without charge now does not waive future fees.

A14. Providers. We use the providers listed in Schedule C to provide VLT Gold. We remain responsible to you for what they do in providing it.

A15. Events outside our control. Neither party is responsible for delay or failure caused by events outside its reasonable control, provided it tells the other and takes reasonable steps to limit the effect. If such an event stops VLT Gold for more than 30 days, either party may end the account. This does not excuse our security obligations.

A16. Changes. We may change these terms. We will show you a material change and ask you to accept it before you carry on. Changes apply from acceptance, not before. If you do not accept, your access ends and clause A12.3 applies.

A17. The whole agreement. These terms, the Beta Terms while VLT Gold is in beta, and Schedule C are the whole agreement about VLT Gold. Each party confirms it has not relied on any statement not set out in them. Nothing here limits liability for fraud or fraudulent misrepresentation. You acknowledge the Privacy Policy, which explains how we handle personal data.

A18. General. You may not transfer this agreement without our consent; we may transfer it to a company that takes over VLT Gold, provided your data is protected to at least the same standard. Notices may be given by email to the account owner or in VLT Gold. Only you and Valantai have rights under this agreement. If a part of it is found unenforceable, the rest continues. A delay in enforcing a right is not a waiver of it.

A19. Law. These terms are governed by the law of England and Wales. The courts of England and Wales have exclusive jurisdiction, except that either party may seek urgent protective relief in any competent court.

Contact: thomas@valantai.com

SCHEDULE C. DATA PROCESSING
Part of the Terms of Service. These are the terms UK GDPR Article 28 requires for personal data Valantai processes on your behalf.

C1. Roles. For personal data in documents and records you upload to VLT Gold, or that you collect, create or manage through your data rooms, investor rooms and investor portal ("Client Personal Data"), you are the controller and Valantai is your processor. This includes personal data in team biographies, cap tables, investor contact records, shareholder and beneficial ownership records, KYC documents, and documents processed by VLT Gold's AI functions.
Valantai is also your processor when it records, and shows you, what investors do in rooms you control: which documents they open, how long they spend reading them, what they download, which folders they open, and that they used the Find, FAQ or report tools (but never what they typed).
Valantai is an independent controller for its own account administration, sign-in, platform security, records of who accepted which terms, legal and compliance records, support and feedback, and its investor research database. Where one event produces both a record for you and a security or contractual record for Valantai, each party is responsible for the processing it carries out for its own purposes.
This Schedule applies only where Valantai is your processor. Valantai's own processing is explained in its Privacy Policy. Where Valantai also acts as your adviser under a separate engagement, that engagement sets out its role for the advisory work.

C2. What is processed.
- Subject matter: personal data processed through VLT Gold on your behalf.
- Nature: collection, storage, organisation, retrieval, access control, analysis, automated drafting, disclosure to people you authorise, recording of investor activity in your rooms, updating, export and deletion.
- Purpose: providing the data room, drafting and analysis tools, investor rooms, investor portal, shareholder and beneficial ownership records, KYC document storage and related services, on your instructions.
- Data subjects: your directors, staff, founders, shareholders, beneficial owners, investors and prospective investors, advisers, customers, counterparties and anyone else whose personal data you submit or collect through VLT Gold.
- Personal data: names, contact details, professional information, biographies, financial and shareholding information, transactions, signatures, identity documents and passport details (held encrypted), investor activity in your rooms as described in C1, and any other personal data you submit. This may include special category or criminal offence data only where you are permitted to submit it (clause A6(g)).
- Duration: while we provide the service, then the return and deletion period in C9, unless the law requires otherwise.

C3. Your instructions. We process Client Personal Data only on your documented instructions, including about transfers outside the UK, unless the law requires otherwise, in which case we will tell you first unless the law prevents it. These terms, this Schedule, how you set up VLT Gold and what your authorised users do in it are your instructions. You may give further lawful written instructions that fit the service. If we think an instruction breaks data protection law, we will tell you promptly and may pause the processing concerned until it is resolved. We will not use Client Personal Data for our investor research database, for profiling investors for our own purposes, for advertising, or to train or improve general AI models.

C4. Confidentiality. Everyone at Valantai who can access Client Personal Data is bound by confidentiality.

C5. Security. We maintain technical and organisational measures appropriate to the risk, as Article 32 UK GDPR requires. They include access controls, separation of each client's environment, encryption in transit, encryption of stored identity documents and passport numbers, logging of access, secure sign-in, backups and recovery, and a procedure for handling security incidents. Only people who need Client Personal Data for their work, and who are bound by confidentiality, can access it. A summary of these measures is available on request, and we review them when risks or the service change.

C6. Providers (sub-processors). You give general authorisation for us to use the providers listed below and at valantai.com/subprocessors. We will give you at least 14 days' notice of any new or replacement provider, with its name, purpose and location, and you may object on reasonable data protection grounds. If we cannot reasonably resolve the objection, you may end the affected service. Each provider is bound by written data protection terms giving protection equivalent to this Schedule, and we remain responsible to you for them.

The providers are:
- Supabase: database and file storage.
- Vercel: hosting of the application.
- Anthropic: AI drafting and analysis, with no training on your data.
- OpenAI: AI drafting and analysis, with no training on your data.
- Resend: sending emails.
Where each provider processes data is listed at valantai.com/subprocessors, which we keep up to date.

C7. Transfers. We will not transfer Client Personal Data outside the UK, or allow a provider to, unless UK data protection law permits it. Where needed we use UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the EU standard contractual clauses, or another valid mechanism, with any transfer risk assessment and extra safeguards the law requires. Details of where data is processed and the mechanism used are available on request.

C8. Helping you, and breaches. Taking into account the nature of the processing and the information we have, we will help you respond to people exercising their data protection rights, meet your security obligations, deal with personal data breaches, and carry out data protection impact assessments and any prior consultation with the ICO. We will tell you without undue delay after becoming aware of a personal data breach affecting Client Personal Data, and aim to do so within 48 hours. We will give you the information we have about the breach, the data affected, the likely consequences and what we are doing about it, and more as it becomes available. We will not notify the people affected or a regulator on your behalf unless you instruct us or the law requires it. This does not affect our own duties as an independent controller.

C9. At the end. When the service ends you may export Client Personal Data (clause A12.3) or tell us to delete it, unless the law requires it to be kept. At the end of the 30-day export period we delete what remains from our live systems. Backup copies are kept out of ordinary use and deleted in our backup cycle, within 35 days. Anything the law requires us to keep is protected and used only for that purpose. This clause does not require us to delete records we hold as an independent controller, as described in our Privacy Policy.

C10. Information and audits. We will make available the information needed to show we meet our obligations under Article 28 UK GDPR, and allow and contribute to audits and inspections by you or an auditor you appoint, including to investigate a suspected serious breach or meet a regulator's requirement. Routine audits will be on reasonable notice, in normal business hours, and carried out in a way that protects other clients' information and our security. We may offer independent audit reports or equivalent evidence where they reasonably show compliance.