Policy
What is collected, who it is shared with, and the grant a startup gives before an investor reads anything.
Who is responsible for your data
GetValuated is operated by Hess Adnani Ltd, which is the controller of the personal data described in this policy. This policy explains what we collect, why, who it reaches, and what you can ask us to do about it.
For anything in this policy, or to exercise a right under section 9, write to legal@getvaluated.com.
The platform is for business use. Most of what we hold is information about companies rather than about individuals - but a founder's name, a team member's role, and the contact details on an account are personal data, and this policy covers them.
What we collect
What you give us
- Account details
- Your email address, your name, and your password - which is stored only as a salted scrypt hash, never as text we could read. For a startup account: the company name, its stage, and any referral code. For an organisation account: the organisation name and type, the portfolio size, and the country and VAT number used for billing.
- Assessment content
- Everything a startup answers in an assessment. This is mostly commercial and financial information about the company: its market, its traction, its finances, its legal position and its governance. It can also include personal data where an answer names a founder, a team member, an adviser or a shareholder.
- Invitations
- The email address of a founder an organisation invites, and the terms of the invitation - who is to pay the assessment fee, and how much.
- Reporting and audit responses
- The metrics and documents a portfolio company reports against a standard its investor has set.
- Correspondence
- What you write to us, and what we reply.
What the platform records as you use it
- Sessions
- A SHA-256 hash of your session token and its expiry. The token itself is only ever in your browser's cookie, so a copy of our session records could not be used to sign in as you.
- Relationship history
- An append-only record of what has happened in a connection between a startup and an organisation: who acted, when, and what changed - an assessment released, a stage moved, access revoked. It is append-only deliberately, so that neither side can quietly rewrite a shared history.
- Certification records
- The frozen answers an assessment was certified on, the result produced, the version of the model that produced it, and the certificate number issued.
- Delivery records
- Whether an invitation email was accepted by our email provider, its message id, and any error it returned - so a failed send is visible and can be retried rather than silently lost.
- Server logs
- Our hosting provider records standard request information, including IP addresses, for security and to keep the service running.
We do not run analytics, advertising or tracking of any kind, and there is no third-party script on the platform collecting anything about you. See the Cookie Notice.
Why we use it, and on what legal basis
- To provide the platform - performance of a contract
- Creating and running your account, keeping you signed in, storing and displaying assessments, releasing them to the organisations you choose, producing valuations and certificates, running application calls and reporting cycles, and sending the service messages the platform depends on.
- To bill you - performance of a contract, and legal obligation
- Issuing invoices, recording who has paid, and keeping the accounting and tax records the law requires us to keep.
- To keep the platform secure and working - legitimate interests
- Detecting and preventing abuse and unauthorised access, diagnosing faults, and keeping the append-only records that make a connection's history reliable. Our interest is in operating a service people can trust; we consider it is not overridden by your interests, because the data used is limited to what running the service requires.
- To improve the service and produce benchmarks - legitimate interests
- Understanding how the platform is used, and producing aggregated, de-identified statistics such as comparable sets and distributions. Aggregated output does not name you or your company and is not presented so that either can reasonably be identified.
- To answer you - legitimate interests
- Responding to support and other correspondence.
- To meet our legal obligations - legal obligation
- Responding to lawful requests, and complying with tax, accounting and other law that applies to us.
We do not use your personal data for marketing to you, and we do not sell it or share it with anyone for their own marketing.
Automated processing and AI
Scoring
A certified assessment is scored automatically from the answers submitted: a valuation range, dimension scores, drivers and a comparable set. This is automated processing of the company's submission. It does not produce a legal or similarly significant effect on an individual by itself - no investment decision, no acceptance and no rejection follows from a score alone. Every such decision is taken by a person at the organisation reading it, on their own judgement.
If you believe a result rests on an answer that was recorded wrongly, write to us and we will look at it.
Ask
Ask answers questions using a large language model provided by Anthropic. What we send is scoped to what the person asking is already entitled to see - their own workspace, or an assessment that has been released to them - together with their question.
Anthropic processes it as our processor, under its commercial terms: it does not use it to train its models, and it retains it only for a limited period for abuse monitoring before deleting it. Anthropic is in the United States, so this is an international transfer - see section 8.
Do not paste into Ask anything you would not put in the assessment itself.
How it is protected
- Passwords are hashed with scrypt, salted per user. We cannot recover your password and would never ask you for it.
- A session cookie carries a random 32-byte token; only its SHA-256 hash is stored, so our records hold nothing that could be replayed to sign in as you.
- Changing your password revokes every other session on the account.
- Traffic is encrypted in transit, and the connection to the database is encrypted too.
- Sign-in does the same work whether or not an address has an account, so the form cannot be used to discover who is registered.
- Access to an assessment is checked on the server on every request, against the release the startup actually made - not merely hidden in the interface.
No system is perfectly secure. If we become aware of a breach affecting your personal data that is likely to result in a risk to you, we will tell you and the relevant supervisory authority as the law requires.
How long we keep it
- Account details
- For as long as your account is open, and for 12 months after it is closed.
- Draft assessments
- Until you submit or delete them, or until the account is closed. A draft is yours alone and has been shown to nobody.
- Submitted and certified assessments, and certificates
- For 7 years from certification. A certificate is an artefact that other parties have relied on, and it has to keep verifying after the account that produced it has gone - a certificate that stopped resolving because someone closed an account would be worse than no certificate.
- Connection and audit records
- For 7 years from the end of the relationship, as the shared record of what passed between the two sides.
- Billing and tax records
- For 7 years, as the law requires.
- Sessions
- Deleted at expiry; expired rows are cleared routinely.
- Correspondence
- For 3 years from the last message.
After these periods we delete the data or de-identify it so that it can no longer be linked to you or your company. De-identified statistics may be kept indefinitely.
Data outside the UK and the EEA
Assessments and accounts are stored in the European Economic Area - the database is in Frankfurt, Germany.
Our processors named in section 5 are established in the United States, so some processing involves a transfer outside the UK and the EEA. Those transfers are made under the UK International Data Transfer Addendum and the European Commission's Standard Contractual Clauses, with additional measures where they are needed, so that your data keeps a level of protection essentially equivalent to the one it has here.
You can ask us for details of the safeguards in place for any particular transfer.
Your rights
Under UK and EU data protection law you may ask us to:
- give you a copy of the personal data we hold about you;
- correct it, where it is wrong or incomplete;
- delete it, where we no longer have a reason to hold it;
- restrict what we do with it while a dispute about it is resolved;
- send it on, in a structured, commonly used, machine-readable form, where we hold it on the basis of your contract or consent;
- stop processing based on our legitimate interests, where your particular situation outweighs them; or
- withdraw consent, where we relied on it - without affecting anything done before you withdrew it.
Some rights have limits. We cannot delete a certified assessment or a connection record within its retention period, because it is a record another party has relied on and a shared history neither side may rewrite. Where we cannot do what you ask, we will tell you why.
Write to legal@getvaluated.com. We will answer within one month. There is no charge unless a request is manifestly unfounded or excessive.
If you are not satisfied with how we have handled it, you can complain to the UK Information Commissioner's Office at ico.org.uk, or to the supervisory authority where you live or work.
Personal data about other people
Where you submit information about someone else - a co-founder, a team member, an adviser, a shareholder, or a founder you invite - you confirm that you may lawfully give it to us for the purposes in this policy, and that you have told them about it where you are required to. Tell them they can read this policy at this address.
Children
The platform is for business use and is not directed at anyone under 18. We do not knowingly collect personal data about children. If you believe we hold any, write to us and we will delete it.
Changes to this policy
We may update this policy. The version in force is always the one at this address, with the date it took effect at the top. Where a change materially affects how we use your personal data, we will tell you by email or in the platform before it takes effect.