Privacy policy

1. The data controller

The data controller is GJO&PARTNERS LTD, a company registered in England and Wales under number 17319883, whose registered office is at 128 City Road, London EC1V 2NX, United Kingdom.

For any question about your data, or to exercise your rights, write to contact@gjoandpartners.com.

2. What we collect

Account data: your full name, your email address, a password stored in encrypted form, your profile (company or investor), your interface language, the account creation date, your acceptance of the terms of use and, if you gave it, your time-stamped consent to receive our commercial communications. For an investor: your type of organisation, its country and the date of your professional declaration.

File data, for a company: legal name, country, sector, stage of development, revenue range, EBITDA, amount sought, instrument, uploaded pitch deck, username and published updates. The legal name is never shown publicly.

Credibility signals and direct contact, for a company, if it fills them in: registration number and country of incorporation, reference client names, number of employees, and a contact email address or WhatsApp number. The registration number is visible only to our team, for verification; the other items are shown only if the company ticked the corresponding box.

Profile data, for an investor: organisation name, description, website, tickets, target sectors, countries and instruments, and, when claiming an existing profile, the role and professional contact details you provide to establish your affiliation.

Directory: unclaimed profiles are compiled from funds' public information and describe organisations only, never individuals. Should a profile mention a natural person, that person may ask for it to be corrected or removed.

Interaction data: the contact requests you make, the co-investment notices you post or flag yourself on, the updates you back, the comments and replies you post, the members you follow, the introduction on your profile page and the messages you exchange through messaging (content, time sent and read), each time-stamped.

Diagnostic without an account: if you use the public diagnostic, your email address and the answers you enter, to send you the report and a short sequence of three emails, each carrying an unsubscribe link.

Technical data: the access and error logs produced by our hosting providers, and an internal, append-only audit log that records sensitive actions (account creation and deletion, changes to a file's status, consents).

3. Why we process it

To perform the contract between us: run your account, publish your file or profile, apply the filter on declared criteria, pass on your contact requests and notify you of publications that fall within your criteria.

On the basis of our legitimate interest: security of the service, prevention of abuse and false identities, completeness and authenticity checks before publication, product improvement.

On the basis of your consent, which you may withdraw at any time: sending our commercial communications, and the email sequence that follows the public diagnostic.

To comply with our legal obligations: responding to requests from competent authorities, keeping proof of consent.

The filter compares your data with the criteria declared by other users; it produces no solely automated decision with legal effect on you. We do not use your data for advertising on behalf of third parties.

4. Who has access

Other users, within the limits you set. An investor sees only an anonymous teaser of a company, until the company chooses to reply. When an investor requests contact, their name, organisation and email are passed on to the company and become visible to the other investors who requested contact on the same file. When an investor flags themselves on a co-investment notice, their name and email are passed on to the author and the other flagged investors. These rules are enforced by the database itself, not only by the screen.

If a company chooses to show a direct contact channel, its email address or WhatsApp number is visible only to investors whose profile has been verified by GJO & Partners, on its updates and teaser. A comment is visible to the same people as the update it relates to: signed-in users, or any visitor if the company made the update public. An investor appears there under the name of their organisation, a company under its username, each with its profile type shown.

Our technical processors, within the limits of their function: Supabase for hosting the database, authentication and uploaded files; Vercel for hosting the application; Resend for sending emails; Google (Gemini API) for reading the sentence typed or the document imported into the search assistant, the analysis drawn from it in the diagnostic and the search for leads on the web; InvestMatching stores neither the sentence nor the document (only the analysis, in the report), but Google may use them to improve its products.

Members can report content or users from posts, comments, profiles and conversations, or the Report page. The report reason and details are accessible only to its author and our moderation team. Members can also block and unblock a user: their posts and comments are hidden and new messages between both members are prevented. Reports are deleted with their author’s account.

A message is shown to its two participants only; the interface shows it to no one else, our team included. We access it in the database only on request from a competent authority, or to handle an abuse report sent to us by one of the participants.

Our team, for the completeness and authenticity check before publication, and when you ask for assistance.

We do not sell or rent your data, do not pass it to any financial intermediary, and do not use it to train models.

5. Where it is hosted

The database and uploaded files are hosted by Supabase in the European Union. The application is served by Vercel from its international network, and emails are sent by Resend.

Where a transfer outside the European Economic Area or the United Kingdom is necessary, it relies on the European Commission's standard contractual clauses or on a recognised adequacy mechanism.

6. For how long

Your account, file, profile and interaction data are kept as long as your account is active. You can request deletion of your account from your dashboard: your file, profile and interactions immediately stop being visible, then the account, the file and the pitch deck are erased by an automated process thirty days after the request, during which you can cancel. Proof of consent and the audit log are kept for at most two years, then purged automatically.

A conversation is erased, for both participants, when either participant's account is actually deleted.

Public diagnostic data is erased automatically twelve months after it was entered, or the day after you unsubscribe if that comes first.

Technical logs are kept for at most twelve months.

7. Your rights

You have the right of access, rectification, erasure, restriction, objection and portability over your personal data, and the right to withdraw any consent at any time. You can edit your file, your profile and your notifications from your account; for the other rights, write to contact@gjoandpartners.com. We reply within one month.

If our reply does not satisfy you, you may complain to the competent supervisory authority: the Information Commissioner's Office in the United Kingdom, or the data protection authority of your country of residence.

8. Cookies

Invest Matching only uses cookies strictly necessary for its operation: those that keep your session open. They serve no advertising tracking.

The service embeds no audience measurement tool and no third-party tracker. That is why no consent banner is shown to you.

9. Security

Exchanges with the service are encrypted in transit. Separation between accounts and the reciprocity of contact requests are enforced by the database, row by row, and not only by the application. Pitch decks are accessible only through signed, time-limited links.

In the event of a data breach likely to put your rights at risk, we notify the competent authority within seventy-two hours and inform you without undue delay.

10. InvestMatching mobile application

This policy also applies to the InvestMatching mobile application for Android and iOS, published by GJO&PARTNERS LTD. Connected features display the same service as the website: the account, file, document and message processing described above still applies.

Your funding notebook, notes, stages and preparation checklists, bookmarks and language preference are stored locally on your device. They are not automatically synchronised with your account or sent to our servers. You can delete briefs and bookmarks in the app. This local storage does not add app-specific encryption; its protection depends on your device's security.

When you launch a search from a notebook brief, the necessary funding criteria are transmitted to the connected service. When you choose to share a brief, its text, including your notes, is passed to the service or recipient you select in your device's share menu; check the content before sharing.

The app retains session cookies required to sign in to the service in its embedded browser. It includes no advertising, advertising identifier or native audience measurement tool. Any files or photos you choose to upload to the connected service follow the processing and retention rules in this policy.

To delete online account data, use the deletion request in your signed-in dashboard or write to contact@gjoandpartners.com. This request does not delete the notebook kept only on your device: delete local briefs as well if you wish to erase them.