Privacy Policy

Angel Hub is a multi-tenant platform for angel investment due diligence. Each angel group that uses Angel Hub acts as the data controller for personal data processed about its members and the entrepreneurs whose pitches it reviews. The operator of Angel Hub acts as a data processor on behalf of those groups, under written instructions. Angel Hub is operated by Certitia Ltd.

For any data-protection question, contact your angel group's data protection lead. For platform-level technical matters, contact the Angel Hub operator at the address provided in your group's onboarding pack.

Account data (all users)

• Full name, email address.
• Authentication credentials (hashed passwords, magic link tokens).
• Sign-in timestamps and session data.
• Role assignments, group memberships.
• High-net-worth / sophisticated investor self-certification status and dates.

Entrepreneur-submitted data

• Business plans, pitch decks, financial models, articles of association, shareholders' agreements, case studies, and any other documents you upload.
• Free-text notes and descriptions you write.
• These documents may contain personal data about you and third parties (co-founders, directors, customer contacts). You are responsible for ensuring you have the right to share third-party data.

Assessor / lead / angel activity

• Screening decisions and reasons.
• Q&A questions and answers.
• Lead Investor reviews and analysis.
• Investment interest levels and committed amounts (visible to the lead).
• AngelAI chat prompts (processed but not stored after the session).

AI-derived data

• Document classifications, topic assessments, coverage observations.
• Document summaries.
• Auto-generated tags (sector, stage, spinout status).
• AI-generated reviews and opportunity summaries.
• Pitch signatures (anonymised deal patterns).

System data

• Audit log (who did what, when, to which deal).
• Document upload metadata (filenames, sizes, timestamps).

We rely primarily on legitimate interests (UK GDPR Article 6(1)(f)): the angel group has a legitimate interest in conducting due diligence on investment opportunities; the entrepreneur has a legitimate interest in seeking investment; the platform has a legitimate interest in providing the service. A Legitimate Interests Assessment is documented for each processing activity.

Contract performance (Article 6(1)(b)) applies to processing required to provide the service to the angel group under its subscription agreement.

Consent (Article 6(1)(a)) is used for specific activities such as outcome tracking beyond the immediate DD purpose. You can withdraw consent at any time.

Documents and free-text fields you submit are processed by an AI system (Anthropic Claude) to classify, summarise, and assess them, and to produce AI-generated reviews. AI-generated outputs are clearly labelled in the platform. A human reviews every AI output before it influences a decision — Angel Hub does not make automated investment decisions.

You can correct AI-assessed coverage and edit AI-generated text where the UI allows. Under Article 22 of UK GDPR, you have the right not to be subject to decisions based solely on automated processing.

• Anthropic — AI classification, summarisation, review, and chat. US-based. Commits not to train its models on customer content.
• Supabase — database, authentication, and document storage.
• Cloudflare — application hosting (Workers runtime).
• Resend — transactional email (invitations, notifications).
• Lovable — development platform.

We maintain Data Processing Agreements with each sub-processor. A current sub-processor list is available on request.

Several of our sub-processors are based in the United States. Where personal data is transferred outside the UK, we rely on Standard Contractual Clauses (SCCs) or the UK International Data Transfer Agreement (IDTA), supported by a Transfer Impact Assessment. We minimise the personal data sent to third-country sub-processors and apply encryption in transit.

• Active deals: duration of the DD process, plus 6 years.
• Closed deals (invested): retained while the investment is active.
• Closed deals (not invested): 2 years after close, then anonymised or deleted.
• Withdrawn entrepreneur documents: deleted within 30 days of withdrawal.
• Inactive user accounts: 2 years of inactivity, then notified and deleted.
• Audit logs: 6 years.
• Record of emails sent (the Outbox: copy of each email, recipients and delivery status): 12 months.
• AngelAI chat: not retained after the session.
• Pitch signatures: indefinite, anonymised.

You have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate or incomplete data.
• Request erasure (subject to the retention policy and deal stage).
• Port your data in a commonly used format.
• Object to processing based on legitimate interests.
• Withdraw consent for any processing that relies on it, at any time.
• Lodge a complaint with the UK Information Commissioner's Office (ICO).

Contact your angel group's data protection lead to exercise these rights.

Angel Hub uses one first-party UI preference cookie (sidebar_state) to remember whether the sidebar is collapsed. We do not use analytics, advertising, or any third-party tracking cookies.

Authentication is performed using your browser's local storage, not cookies. Your sign-in session is held client-side and validated on every request.

Personal data is encrypted in transit and at rest. Access to deal data is enforced by row-level security policies. Every change is recorded in an audit log. We test our access controls regularly.

In the event of a personal data breach likely to result in a risk to your rights and freedoms, the data controller (your angel group) will notify the ICO within 72 hours of becoming aware, and will notify you without undue delay if the risk is high. Angel Hub as processor notifies the controller without undue delay.

Data controller: your angel group. The group's data protection contact is provided in your onboarding pack.

Data processor (platform operator): the contact address is shared with each group at the time of onboarding.

We may update this policy from time to time. When we make material changes, we will ask you to acknowledge the updated notice on next sign-in.