Privacy Policy

Welcome to RoundRaise ("RoundRaise", "we", "our", or "us").

We are committed to protecting your privacy and handling your personal information responsibly. This Privacy Policy explains how we collect, use, disclose, store and protect your personal data when you use the RoundRaise platform, website and related services (the "Services").

RoundRaise is a cap table, data room and SEIS/EIS advance assurance platform for UK startups. It does not match founders with investors. It helps you build and model your cap table, prepare for SEIS/EIS, and share information securely with the people you choose. As part of providing these Services, we process personal information in accordance with the UK General Data Protection Regulation ("UK GDPR"), the Data Protection Act 2018 and other applicable data protection laws.

By using our Services, you acknowledge that you have read this Privacy Policy.

RoundRaise Limited ("RoundRaise", "we", "our" or "us") is the data controller responsible for the personal information collected through our website and Services.

Company Name:

RoundRaise Limited

Company Number:

16255366

Registered Office:

The Catalyst, Baird Lane, York, YO10 5GW, United Kingdom

Email:

support@roundraise.co.uk

If you have any questions about this Privacy Policy or how we process your personal information, please contact us using the details above.

The information we collect depends on how you use the platform.

3.1 Information You Provide

This may include:

• Full name
• Email address
• Telephone number
• Company name
• Job title
• Cap table and shareholder data (holders, share classes, instruments, options and vesting)
• Company and financial information you enter or import
• Scenario inputs, and the instructions and questions you give the agent
• Files you import, such as spreadsheets, CSV files and PDFs
• Documents you upload to a data room
• Email addresses of people you invite to a cap table or data room, and your sharing settings and allowlists
• SEIS/EIS and Advance Assurance information used to check eligibility and prepare drafts
• Messages sent to our support team
• Survey responses
• Account preferences

3.2 Google Account Information

If you choose to sign in using Google, we may collect:

• Google account email address
• Google profile name
• Google profile picture
• Authentication tokens required to maintain your secure login session

RoundRaise only requests Google permissions that are necessary to authenticate your identity and provide requested functionality.

We do not request access to Gmail, Google Drive, Google Calendar or other Google Workspace data unless you explicitly authorise additional permissions for a future feature.

RoundRaise's use and transfer of information received from Google APIs complies with the Google API Services User Data Policy, including its Limited Use requirements.

3.3 Technical Information

We automatically collect certain technical information, including:

• IP address
• Browser type
• Device type
• Operating system
• Pages visited
• Session duration
• Referring website
• Crash reports
• Performance diagnostics
• Security logs
• Authentication logs
• Cookie identifiers

3.4 Payment Information

Where payments are made through the platform, payment card information is processed by Stripe, our third-party payment provider.

RoundRaise does not store complete payment card details.

We may retain records of:

• subscription status
• invoices
• payment dates
• billing address
• transaction identifiers

3.5 Data-Room and Sharing Activity

When you share a cap table or data room, or when someone you have invited accesses one, we process information needed to operate and secure that sharing, including:

• share links and their access settings;
• invitee email addresses and allowlists;
• records of when shared cap tables and documents are viewed (access logs and share analytics);
• access controls you configure.

3.6 Usage Information

We collect information about how users interact with RoundRaise, including:

• features used;
• scenarios created and questions asked;
• documents opened or downloaded;
• account activity;
• interaction with results and recommendations.

This helps us improve the platform and maintain security.

We use personal information to:

• create and manage user accounts;
• authenticate users;
• operate your cap table and ownership records;
• run scenario modelling and carry out the instructions and questions you give the agent;
• map and import files you provide;
• check SEIS/EIS eligibility and prepare Advance Assurance drafts;
• store data-room documents and operate cap-table and data-room sharing;
• operate artificial intelligence features;
• respond to customer support requests;
• maintain platform security;
• prevent fraud and abuse;
• comply with legal obligations;
• communicate important service updates;
• administer subscriptions;
• improve the performance and reliability of our Services.

RoundRaise uses artificial intelligence, machine learning models and automated systems to provide features including:

• the agent — answering questions about, and making changes you instruct to, your own company data and data room;
• scenario modelling of rounds, ownership and outcomes;
• import mapping (matching columns and fields from files you provide);
• Advance Assurance draft assistance.

These outputs are intended to support decision-making and should not be considered financial, investment, legal or professional advice.

Although we continually improve our systems, AI-generated outputs may occasionally be inaccurate, incomplete or outdated.

Users remain responsible for evaluating outputs before making business decisions.

RoundRaise values the confidentiality of founder information.

Unless we clearly state otherwise or obtain your explicit consent, we do not use your confidential customer content — including cap tables, data-room files, imported documents and agent content — to train publicly available artificial intelligence models.

We may use anonymised and aggregated information to improve the performance, accuracy and security of our own platform where this cannot reasonably identify an individual or company.

We process personal data under one or more of the following lawful bases:

Contract

To provide the Services you request, including:

• account creation;
• operating your cap table, scenarios and agent;
• document storage and sharing;
• subscription management.

Legitimate Interests

Including:

• improving our platform;
• preventing fraud;
• maintaining platform security;
• monitoring system performance;
• product development;
• customer support.

We carefully balance these interests against your rights and freedoms.

Consent

Where required, including certain cookies and optional marketing communications.

Legal Obligation

Where processing is necessary to comply with UK law.

We never sell your personal information.

We never allow third parties to use your personal information for their own advertising purposes.

We may share information with trusted service providers who help us operate the platform, including providers of:

• cloud infrastructure and storage;
• authentication services;
• payment processing (Stripe);
• customer communications;
• analytics;
• email delivery;
• security monitoring;
• customer support;
• artificial intelligence processing.

We may also share a cap table or documents with the specific people you choose to invite — this sharing is controlled by you.

All service providers process data only under our instructions and are subject to contractual confidentiality obligations.

All customer data is hosted on infrastructure located in the United Kingdom.

If a service provider ever needs to process personal information outside the United Kingdom, we will ensure appropriate safeguards are in place, including:

• the UK International Data Transfer Agreement (IDTA);
• the UK Addendum to the EU Standard Contractual Clauses; or
• other legally recognised transfer mechanisms.

We retain information only for as long as necessary.

Typical retention periods include:

• Active accounts — while your account remains open.
• Deleted accounts — for a limited period where required for fraud prevention, legal compliance or dispute resolution.
• Financial records — as required by UK tax and accounting legislation.
• Security logs — for an appropriate operational period.
• Support communications — while necessary to resolve enquiries and maintain service records.

Where information is no longer required, it is securely deleted or anonymised.

RoundRaise uses cookies and similar technologies for:

• authentication;
• security;
• remembering preferences;
• analytics;
• improving website performance.

Where legally required, we will ask for your consent before placing non-essential cookies.

We implement appropriate technical and organisational measures designed to protect your information, including:

• encryption in transit;
• encryption at rest where appropriate;
• secure authentication;
• role-based access controls;
• least-privilege access principles;
• monitoring and logging;
• vulnerability management;
• regular software updates;
• secure backups.

While no online service can guarantee absolute security, we take reasonable steps to safeguard your information.

Under UK GDPR you may have the right to:

• access your personal information;
• correct inaccurate information;
• request deletion of your information;
• restrict processing;
• object to certain processing activities;
• request portability of your data;
• withdraw consent where processing relies upon consent.

To exercise your rights, contact:

support@roundraise.co.uk

We will respond within the timeframes required by law.

Certain RoundRaise features involve automated processing.

These systems assist users by generating model outputs, calculations and recommendations based on the data you provide.

These outputs are intended to support decision-making only and do not produce legally binding decisions.

Users may request further information about significant automated processing by contacting us.

RoundRaise is intended for individuals aged 18 or over.

We do not knowingly collect personal information from children.

If we become aware that personal information relating to a child has been collected without appropriate authorisation, we will take reasonable steps to remove that information.

We may update this Privacy Policy from time to time.

Where changes are significant, we may notify users through the platform or by email.

The latest version will always be published on our website together with the updated revision date.

If you have any questions, requests or concerns regarding this Privacy Policy or the way RoundRaise processes your personal information, please contact us:

We aim to respond to all privacy-related enquiries as promptly as possible and within the timeframes required under applicable data protection law.

If you believe we have not handled your personal information in accordance with applicable data protection law, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's independent authority for data protection.

We encourage you to contact us first so we can investigate and attempt to resolve your concerns before you contact the ICO.