Seedable Privacy Policy

1. Scope and identity of the controller

The Services are operated by Seedable (“Seedable”, “we”, “us” or “our”).

For the personal data described in this Privacy Policy, Seedable generally acts as the data controller because it determines why and how that personal data is processed.

If Seedable later provides services on behalf of an organisation under a separate written agreement, Seedable may act as a processor for some processing activities. In that situation, the relevant organisation’s privacy notice and the applicable data-processing agreement may also apply.

Seedable is subject to the ADGM Data Protection Regulations 2021, as amended from time to time. Depending on where you live and how the Services are offered to you, other data-protection laws may also apply.

For privacy questions or requests, contact:

Email: admin@seedable.co

References in this Privacy Policy to “personal data” mean information relating to an identified or identifiable natural person.

2. Personal data we collect

The personal data we collect depends on your role, the features you use and the information you choose to provide.

2.1 Account and authentication data

When you create or use an account, we may process:

• Your full name;
• Email address;
• Account role, such as founder or investor;
• Username, profile handle or startup handle;
• Seedable and Supabase account identifiers;
• Email-verification status;
• Account creation and update timestamps;
• Login, session and authentication information;
• Account status, including whether an account is active, suspended, banned, pending deletion or deleted; and
• Security information connected with your account or sessions.

Authentication credentials are processed using Supabase Auth. Seedable does not receive or store your password in readable plain text.

2.2 Founder, startup and pitch information

If you create a founder or startup profile, we may process information such as:

• Startup name and profile handle;
• Founder name;
• Sector, development stage and location;
• Whether the startup is actively raising funds;
• Funding target;
• One-line pitch;
• Descriptions of the problem, solution, traction and team;
• Pitch videos;
• Video file names, storage paths, file types, sizes, duration and upload information;
• Startup profile images or founder avatars;
• Pitch status, such as draft, submitted, approved, rejected or taken down;
• Documents and supporting materials you upload;
• Document file names, storage paths, types, sizes and access settings; and
• Other information you voluntarily include in your profile, pitch, biography or documents.

Startup information may include confidential commercial or financial information. You are responsible for deciding what you upload and whether you have authority to share it.

2.3 Investor profile and preference information

If you create an investor profile, we may process information such as:

• Display name and investor handle;
• Investor type;
• Firm or organisation name;
• Professional title or headline;
• Location;
• Biography;
• Sectors, startup stages and geographic areas of interest;
• Website and LinkedIn links;
• Profile image; and
• Other professional information you voluntarily provide.

We may also process your selected investment preferences to organise or personalise startup pitches shown to you.

2.4 Posts, interactions, connections and communications

When you interact with other users, we may process:

• Activity posts and uploaded images;
• Comments and replies;
• Likes, saves and shares;
• Connection requests and connection status;
• Group or conversation membership;
• Direct and group messages;
• Message attachments;
• Message and attachment metadata, including sender, conversation, file name, type, size and upload time;
• Message-read information and the time a conversation was last read;
• Notifications and whether they have been read;
• Notification preferences; and
• Deleted, hidden or moderated versions of content where retention is necessary for conversation continuity, safety, dispute resolution or enforcement.

Messages and attachments are intended for the participants in the relevant conversation. Seedable personnel may access them where reasonably necessary to investigate a report, enforce the Terms, protect users, maintain security, comply with law or provide support.

Other users may copy, screenshot or redistribute information you share with them. Seedable cannot control copies independently retained by recipients.

2.5 Discover viewing and engagement information

When a signed-in user uses the Discover feed, Seedable may record information about how startup pitches are viewed and engaged with.

This may include:

• Your Seedable user identifier;
• A randomly generated identifier for the relevant Discover page visit;
• The startup or pitch shown;
• Whether and when a pitch impression occurred;
• Whether and when a meaningful view occurred;
• Whether and when you opened the startup profile;
• The amount of qualifying time for which a pitch video was actively watched;
• The furthest position reached through natural video playback;
• Video duration;
• Likes, saves, shares and comments;
• Previous exposure to a pitch; and
• Timestamps associated with these events.

In the current measurement design:

• A pitch impression may be recorded when at least 60% of the pitch card remains visible for 1 continuous second;
• Active watch time accrues only while the video is playing, sufficiently visible, available for playback and the browser page is visible;
• A meaningful view may be recorded after at least 5 seconds of qualifying active watch time; and
• Seeking forward does not increase the natural-playback measurement.

These measurements are associated with the signed-in user. They are therefore not anonymous analytics.

We use this information to operate and improve Discover, reduce repetitive content, understand engagement and personalise the order of pitches. See section 6 for further information about feed ranking and profiling.

2.6 Cookies, browser storage and preference information

Seedable and its service providers use cookies, local storage and similar browser technologies.

Depending on the features used, browser storage may contain:

• Authentication and session information;
• Email-verification or login-verification state;
• Founder or investor onboarding state;
• Theme or interface preferences;
• Notification and unread-message information;
• Recently viewed or searched profiles;
• Discover playback preferences;
• Cookie-consent choices; and
• Other information needed to provide, secure or remember the state of the Services.

Recently viewed or searched profile information stored in your browser may include a person or startup’s name, handle, profile context, avatar, profile link and the time it was recorded.

Our Cookie Policy provides more information about these technologies, their purposes and their duration.

2.7 Technical, network and security data

When you use the Services, Seedable and its infrastructure providers may automatically receive technical information such as:

• Internet Protocol address;
• Request timestamps;
• Requested pages or endpoints;
• Authentication and session events;
• Error, diagnostic and security logs;
• Browser or operating-system information made available through network requests;
• Rate-limit counters;
• Security-event information; and
• Information used to detect suspicious, automated or abusive activity.

Seedable uses IP-address information for security and rate limiting. Rate-limit records are designed to be short-lived and are opportunistically removed after their applicable security window.

Our hosting, authentication, database and email providers may also generate their own operational logs when providing services to Seedable.

2.8 Safety, moderation and enforcement information

We may process:

• Reports submitted about users, messages, conversations or content;
• The reported user, reporting user and relevant content or conversation;
• Report reasons and supporting details;
• User blocks;
• Investigation and review status;
• Moderator or administrator notes;
• Suspension, banning, restoration or other enforcement actions;
• Reasons for enforcement;
• Related timestamps;
• Administrator audit logs;
• Internal safety communications;
• Evidence reasonably required to investigate abuse or disputes; and
• Information required to prevent a banned or abusive user from immediately returning.

Some moderation records may be retained after other account information has been deleted where necessary to protect users, establish or defend legal claims, comply with law or maintain the integrity of enforcement decisions.

2.9 Support and service communications

When you contact us, we may process:

• Your name and email address;
• The subject and contents of your request;
• Attachments or evidence you provide;
• Records of our response;
• Delivery and engagement information for service emails; and
• Information needed to investigate and resolve the request.

Seedable uses Resend to deliver transactional or service-related emails. Resend may process the recipient address, message content and delivery metadata on Seedable’s behalf.

2.10 Payment and subscription information

The current Seedable MVP does not process paid subscriptions through the platform.

When paid features are introduced, we may process plan, subscription, invoice and transaction information and may appoint a payment provider. We will update this Privacy Policy and identify the relevant provider before collecting payment information.

Seedable does not intend to store full payment-card numbers itself.

2.11 Inferred and derived information

Seedable may derive information from your profile, selected preferences and use of the Services, such as:

• Likely sector, stage or geographic interests;
• Pitches you may find relevant;
• Whether you have previously been exposed to a pitch;
• Engagement or relevance indicators;
• Feed-ranking values; and
• Signals used to detect spam, abuse or unusual activity.

These inferences are used to operate, secure and personalise the Services. They are not investment advice and are not used by Seedable to determine whether an investment should be made.

2.12 Consent and legal-acceptance records

To document privacy choices, contractual acceptance and age eligibility, Seedable may process:

• Your internal Seedable account identifier;
• Whether optional cookie or similar-technology categories were accepted, rejected, changed or withdrawn;
• The applicable consent-policy version;
• The date and time of each consent, refusal, change or withdrawal event;
• The versions of the Terms of Service and Community Guidelines accepted;
• The version of the Privacy Policy acknowledged;
• The date and time of the acceptance or acknowledgement;
• Confirmation that you stated you were at least 18 years old; and
• The Platform process through which the record was created.

Seedable does not collect your date of birth solely for this age confirmation. Seedable does not collect an IP address, device fingerprint or advertising identifier solely to create these records.

Consent and legal-acceptance records are retained in restricted form and are not used for advertising or unrelated personalisation.

3. How we obtain personal data

We obtain personal data:

1. Directly from you, when you register, create a profile, upload a pitch or document, send a message, post content, set preferences, submit a report or contact us.
2. From your use of the Services, including interactions, viewing activity, authentication events, browser-storage activity and technical or security logs.
3. From other users, for example when another user messages you, connects with you, mentions you, reports an interaction or uploads information relating to you.
4. From organisations you represent, where an organisation provides or confirms professional information about its authorised users.
5. From service providers, such as Supabase, Resend and Vercel, when they provide authentication, database, storage, hosting, email or security services to Seedable.
6. From public sources or links you provide, such as a company website or LinkedIn profile.

We do not purchase personal data from data brokers.

4. How and why we use personal data

We process personal data only where we have an appropriate legal basis.

Where we rely on legitimate interests, we consider whether the processing is necessary and proportionate and whether your rights or interests override our interests.

Where we rely on consent, you may withdraw that consent at any time. Withdrawal does not make earlier processing unlawful.

If certain personal data is necessary to create an account or provide a requested feature and you do not provide it, we may be unable to provide that feature.

5. Sensitive and special-category personal data

Seedable does not intentionally ask users to provide special-category personal data, such as information revealing racial or ethnic origin, political opinions, religious beliefs, health information, sexual orientation, genetic information or biometric data used for identification.

However, such information may be incidentally revealed in:

• Profile photographs or pitch videos;
• Biographies;
• Uploaded documents;
• Posts or comments;
• Private messages; or
• Reports and supporting evidence.

Please do not upload special-category personal data unless it is genuinely necessary and you have a lawful right to provide it.

Seedable does not currently use facial recognition, biometric identification or special-category personal data to rank pitches or target advertising.

If Seedable intentionally introduces processing involving special-category personal data, we will identify an appropriate legal condition, provide any additional notices required and implement suitable safeguards before beginning that processing.

6. Feed ranking, profiling and automated processing

Seedable uses automated rules to select and order content in the Discover feed.

Signals may include:

• Investor-selected sectors, startup stages and geographies;
• Whether a pitch has previously been shown;
• How recently it was shown;
• Pitch impressions;
• Qualifying watch time and natural playback;
• Meaningful views and derived completion information;
• Profile clicks;
• Likes, saves, shares and comments;
• Blocking and moderation status;
• Content rotation; and
• Limited randomisation used to maintain variety.

This processing may affect the order and frequency with which pitches are shown. It may therefore influence the visibility a startup receives on Seedable.

However, Seedable does not use this ranking to make investment decisions, determine creditworthiness, provide regulated financial advice or decide whether a user is legally eligible to receive a service. The ranking is not intended to produce legal effects or similarly significant effects on users.

Moderation and enforcement decisions may use technical or behavioural indicators, but material account suspensions or bans are intended to remain subject to review by authorised Seedable personnel.

You may contact admin@seedable.co to request more information about feed personalisation, object to processing based on legitimate interests or raise concerns about a decision you believe was made solely through automated processing.

7. How we share personal data

We may share personal data as follows.

7.1 With other users

Information may be shared with other Seedable users according to the feature and audience selected, including:

• Founder, investor and startup profile information;
• Approved startup pitches;
• Posts, comments, likes and shares;
• Connection information;
• Group membership;
• Messages and attachments sent to conversation participants; and
• Documents made available to accepted or specifically selected connections.

We do not make private messages available to unrelated users.

7.2 With administrators and authorised personnel

Seedable administrators and authorised personnel may access information where reasonably necessary to:

• Operate and support the Services;
• Review pitches;
• Investigate reports;
• Moderate content;
• Enforce the Terms;
• Protect users or Seedable;
• Diagnose technical problems;
• Respond to privacy requests; or
• Comply with law.

Access should be limited according to role and operational need.

7.3 With service providers

We use service providers that process personal data on our behalf, including:

• Supabase, for authentication, database, storage, application programming interfaces and real-time platform functionality;
• Resend, for transactional and service-email delivery;
• Vercel for application hosting, networking and operational logs; and
• Professional advisers or technical contractors where reasonably required.

Service providers receive only the information reasonably required to perform their services and are expected to protect it under contractual and legal obligations.

Supabase is a service provider and may process authentication and platform information, but its involvement does not automatically mean that every Supabase-related cookie is a “third-party cookie”. Cookie classification depends on how the technology is deployed and which domain sets or receives the cookie.

7.4 Corporate transactions

If Seedable is involved in a merger, financing, acquisition, reorganisation, insolvency or sale of assets, personal data may be disclosed to relevant advisers, counterparties or successors, subject to appropriate confidentiality and data-protection safeguards.

7.5 Legal, regulatory and safety disclosures

We may disclose personal data where we reasonably believe disclosure is necessary to:

• Comply with law, regulation, court order or a valid governmental request;
• Respond to an emergency involving danger to a person;
• Investigate fraud, abuse or security incidents;
• Enforce our Terms or other agreements; or
• Establish, exercise or defend legal claims.

7.6 At your direction

We may share information where you ask us to do so or give valid consent.

Seedable does not currently sell personal data or use personal data for third-party cross-site behavioural advertising.

8. Information visible to other people

Information you add to a profile, pitch, post or comment may be visible to other users according to the relevant feature and access settings.

In particular:

• Founder and investor profile details may be visible to signed-in users;
• Approved startup pitches may appear in Discover;
• Posts, comments, likes and shares may be visible to the relevant Seedable audience;
• Messages are visible to the participants in the conversation;
• Documents may be limited to accepted or specifically selected connections;
• Profile handles may be used to identify and link to profiles; and
• Content may remain visible in de-identified form where necessary to preserve an existing discussion or message history.

Before uploading confidential information, consider who can access it. Access settings reduce visibility within Seedable but cannot prevent an authorised recipient from independently copying, downloading or sharing the information.

9. International transfers

Seedable’s service providers may process personal data outside the ADGM or the country in which you live.

In particular:

• Supabase processes data in the region selected for Seedable’s project and may use supporting infrastructure or subprocessors in other jurisdictions;
• Resend may process email addresses, message content and delivery information in jurisdictions where it or its subprocessors operate; and
• Vercel may process application requests and operational logs in its configured hosting regions.

Where applicable, Seedable will use a legally recognised transfer mechanism, such as:

• A finding that the destination provides adequate protection;
• ADGM Standard Contractual Clauses;
• An approved addendum to other standard contractual clauses;
• Another appropriate safeguard recognised by applicable law; or
• A permitted legal derogation in limited circumstances.

You may contact us for further information about the safeguards used for a particular transfer.

10. Data retention

We retain personal data only for as long as reasonably necessary for the purposes described in this Privacy Policy, including providing the Services, maintaining security, resolving disputes, enforcing agreements and complying with legal obligations.

The following describes our current retention approach. Exact periods must correspond with Seedable’s implemented retention schedule.

We may retain information for longer where:

• Required by law or a valid legal hold;
• Necessary to investigate fraud, abuse or a security incident;
• Necessary to establish, exercise or defend legal claims;
• Needed to preserve the rights and records of other users; or
• The information has been irreversibly anonymised and can no longer identify an individual.

11. Security

Seedable uses technical and organisational measures intended to protect personal data, including:

• Authentication and session controls;
• Database row-level access controls;
• Private storage and access rules for restricted files;
• Role-based administrative access;
• HTTPS encryption in transit;
• Rate limiting and abuse-prevention controls;
• Moderation and administrator audit records;
• Account suspension, banning and session-revocation controls;
• Security-focused software development and review; and
• Contractual and security review of service providers where appropriate.

No online service can guarantee absolute security. You are responsible for protecting your password, email account, devices and active sessions and for notifying us promptly if you suspect unauthorised access.

Where required by applicable law, Seedable will notify the relevant regulator and affected individuals of a qualifying personal-data breach.

12. Your privacy rights

Depending on applicable law and the circumstances, you may have the right to:

• Be informed about how your personal data is used;
• Obtain confirmation that we process your personal data;
• Request access to your personal data;
• Correct inaccurate or incomplete personal data;
• Request deletion of personal data;
• Request restriction of processing;
• Object to processing based on legitimate interests;
• Object to direct marketing;
• Receive certain personal data in a structured, commonly used and machine-readable format;
• Withdraw consent where processing relies on consent;
• Request information about automated decision-making or profiling;
• Ask not to be subject to a solely automated decision that produces legal or similarly significant effects; and
• Submit a complaint to a data-protection authority.

These rights may be subject to legal limitations. For example, we may need to retain information to comply with law, preserve another person’s rights, maintain shared conversation records or establish or defend legal claims.

To exercise a right, contact admin@seedable.co. We may request information reasonably necessary to verify your identity and locate the relevant records.

13. Account and data deletion

You may request deletion through the account settings made available in the Services or by contacting admin@seedable.co.

Seedable’s account-deletion process is designed to:

• Disable further account use;
• Remove authentication access;
• Remove stored profile images, pitch videos, documents and other user-owned files included in the deletion process;
• Remove or de-identify profile and startup information;
• Remove likes, saves, shares, notifications, preferences, blocks and similar account-specific records;
• Remove or redact user-created posts and comments where appropriate;
• Mark the account and startup as deleted; and
• Retain a minimal de-identified database record where necessary to preserve shared messages, referential integrity and audit records.

Messages already sent to other users are not automatically hard-deleted during account deletion. They may remain in the relevant conversation and be attributed to a generic “Deleted user” record. Other users may also retain independent copies of information previously shared with them.

Certain safety, moderation, legal and audit records may be retained where necessary and lawful.

Cookies or local-storage information on your device may remain until it expires or is cleared through Seedable’s controls or your browser settings.

Account deletion does not immediately remove the limited consent, withdrawal and legal-acceptance records described in section 10. Those records are retained in restricted form for the stated periods to demonstrate compliance, establish the terms that applied and address legal claims. They are not used to provide, personalise or market the Services after account deletion.

Deletion from active systems may not immediately remove information from provider backups. Backup copies will expire according to the relevant provider’s backup cycle and will not normally be restored except for disaster recovery, security or legal purposes.

14. Marketing and service communications

Seedable may send transactional or service-related communications necessary to operate your account, such as:

• Email-verification or login messages;
• Password and security notices;
• Connection, message or account notifications;
• Changes to the Services or legal terms;
• Moderation or enforcement notices; and
• Responses to support requests.

These are not necessarily marketing communications and may continue while you maintain an account.

If Seedable introduces optional marketing emails, we will provide an unsubscribe method and honour applicable consent and objection rights.

15. Cookies and similar technologies

Seedable uses cookies and browser storage for authentication, security, verification, onboarding, preferences and platform functionality.

Seedable also processes Discover viewing and engagement information to measure and personalise the feed. Because this information is linked to signed-in users, it should not be described as anonymous analytics.

Where applicable law requires consent for non-essential cookies, local storage or behavioural tracking:

• Seedable will request consent before enabling that processing;
• Rejecting optional tracking will not prevent access to strictly necessary account functionality;
• Consent and refusal choices will be presented with comparable prominence;
• Users will be able to change their choice through an accessible Cookie Settings control; and
• Withdrawing consent will prevent future optional tracking but will not invalidate processing lawfully performed before withdrawal.

Seedable does not currently use third-party advertising cookies or cross-site advertising pixels.

Please read our Cookie Policy for details about the technologies used, their purposes, providers and durations.

16. Children

The Services are intended only for people aged 18 or older.

Seedable does not knowingly permit children under 18 to create accounts or intentionally collect their personal data through the Services.

If you believe that a person under 18 has provided personal data to Seedable, contact admin@seedable.co. We will investigate and take appropriate action, including deletion where required.

17. Third-party websites and services

The Services may contain links to third-party websites or services, such as company websites or LinkedIn.

Seedable does not control those third parties and is not responsible for their privacy practices. Their own terms and privacy notices apply when you visit or use them.

18. Changes to this Privacy Policy

We may update this Privacy Policy to reflect changes to the Services, our processing activities, our providers or applicable law.

We will update the “Last updated” date when changes are made. If a change materially affects how we use personal data, we will provide additional notice where reasonably appropriate or legally required.

Where processing requires consent, we will obtain new consent if a proposed change falls outside the scope of the consent already provided. Continued use of the Services will not replace consent where valid consent is legally required.

19. Questions and complaints

Please contact us first if you have a privacy question or concern:

Email: admin@seedable.co

You also have the right to submit a complaint to the ADGM Office of Data Protection:

Email: data.protection@adgm.com
Website: https://www.adgm.com/operating-in-adgm/office-of-data-protection

Depending on where you live, you may also have the right to complain to the data-protection authority in your country or region.

This Privacy Policy does not limit any rights available to you under applicable data-protection law.