Privacy Policy

Scope

This policy applies to this website, the founder submission form, the private admin view, and related communications. It does not apply to third-party websites or services linked from the website.

Sources of Personal Information

Information may come from:

• you or other authorized company representatives;
• the website automatically through request metadata and logs;
• service providers used to host, secure, store, or process submissions;
• publicly available sources if follow-up research is conducted after a submission.

How Information Is Used

Personal information may be used to:

• receive, validate, store, and privately review founder submissions;
• communicate with founders or company representatives;
• evaluate potential personal angel investment opportunities;
• conduct follow-up diligence if a founder later engages;
• operate, debug, secure, and improve the website;
• detect spam, fraud, abuse, security incidents, and unauthorized access;
• maintain records and comply with legal, regulatory, or dispute-related obligations;
• enforce the Terms of Use and Startup Pitch Submission Terms.

Data Minimization and Sensitive Information

The form requests links and business information, not file uploads. Please do not submit passports, government IDs, Social Security numbers, tax IDs, bank account details, passwords, source code, employee personal data, health data, children’s data, export-controlled data, material non-public information, trade secrets, or third-party confidential information unless there is a separate written agreement and a lawful basis to do so.

How Information Is Disclosed

Information may be disclosed to:

• hosting, infrastructure, security, and storage providers;
• form processing, email, webhook, and operational service providers if configured;
• professional advisers, such as attorneys, accountants, tax advisers, or compliance advisers;
• law enforcement, regulators, courts, counterparties, or others when reasonably necessary for legal, safety, compliance, or dispute purposes;
• a successor or transferee in connection with a business transfer involving website operations or records.

The current implementation does not create a public database of startups and does not disclose submissions through public routes.

Sale or Sharing of Personal Information

Based on the current implementation, this website does not sell personal information or share personal information for cross-context behavioral advertising. The current codebase does not include advertising pixels or retargeting tags. If those tools are later added, this policy and any required opt-out mechanism should be updated before they are enabled.

Cookies and Analytics

See the Cookie Policy and the Cookies section below. Google Analytics is used only if enabled and accepted through the cookie banner. Analytics events should not include founder names, email addresses, pitch deck links, company-sensitive text, or other submission content.

AI and Automated Decision-Making

AI review is not enabled in the current implementation, and the codebase does not send pitch submissions or deck contents to third-party AI APIs. If AI-assisted review is enabled later, this policy and the submission flow should be updated before submitted materials are processed by those tools. AI should not make final investment decisions.

Retention

Submissions and related records are retained while reasonably needed for private review, diligence, legal/compliance, dispute prevention, security, recordkeeping, and operational purposes. Records may be deleted earlier upon verified request unless an exception applies. Security logs and admin audit records may be retained as needed to protect the website and document access.

Security

Reasonable safeguards are used, including HTTPS enforcement in production, server-side validation, spam controls, private storage, password plus authenticator-code protection for the admin view, signed admin session cookies, restricted admin routes, and optional encryption for stored submissions if a storage encryption key is configured. No method of transmission or storage is completely secure.

California Privacy Rights

Depending on whether the California Consumer Privacy Act, as amended by the CPRA, applies to this website, California residents may have rights to know/access, delete, correct, opt out of sale or sharing, limit certain uses of sensitive personal information, and be free from discrimination for exercising privacy rights.

To make a privacy request, email legal@grigash.com. Verification may be required before fulfilling access, deletion, or correction requests. Verification information will be used only for that purpose.

Because the current implementation does not sell or share personal information for cross-context behavioral advertising and does not intentionally collect sensitive personal information for additional purposes, the website does not currently provide “Do Not Sell or Share” or “Limit the Use of My Sensitive Personal Information” links.

International Visitors

This website is operated from the United States. If you access it from outside the United States, your information may be processed in the United States and other countries where service providers operate. Those countries may have privacy laws different from those in your location.

Children and Minors

This website is not directed to children under 13. The founder submission form is intended only for adults who are authorized to act for a company. Do not submit personal information about children or minors.

Updates

This policy may be updated from time to time. The updated version will be posted here with a new “Last updated” date.

Contact

Privacy questions or requests may be sent to legal@grigash.com.