Privacy Policy

1. Who We Are

RVC Capital (“we”, “our”, or “us”) operates the enterprise diagnostic platform available at this website. We are the data controller responsible for your personal data under the General Data Protection Regulation (GDPR) and applicable privacy laws.

Privacy contact: privacy@rvccapital.com
Registered address: [Registered Address]

2. What We Collect

• Account data: email address, hashed password, email verification status.
• Diagnostic data: financial and operational information you submit through the intake form.
• Uploaded files: documents attached to your submission.
• Usage data: IP address, browser type, pages visited, and timestamps recorded in server logs.
• Session data: an authentication session cookie.

3. How We Use Your Data

• Generate your enterprise diagnostic report and pitch deck.
• Operate and secure the platform.
• Send email verification messages and account communications.
• Improve the platform’s AI models and user experience.

4. Legal Basis for Processing (GDPR Art. 6)

• Contract performance (Art. 6(1)(b)): account creation, report and deck generation, and platform access.
• Legitimate interests (Art. 6(1)(f)): platform security, fraud prevention, and service improvement.
• Legal obligation (Art. 6(1)(c)): where required by applicable law.

5. Data Retention

• Account data: retained while your account is active and for 30 days after account deletion.
• Intake submissions: retained for 12 months from submission date.
• Server logs: retained for 90 days.

You may request deletion at any time (see Section 8, Your Rights).

6. Data Sharing

We do not sell your data. We share it only with the following processors:

• Google Gemini (AI processing):de-identified and minimized intake data may be sent to the Google Gemini API to generate diagnostic reports, subject to the configuration and safeguards described in our Client Confidentiality & AI Data Processing Agreement.
• Vercel (hosting):our platform is hosted on Vercel’s infrastructure.
• Neon (database): your data is stored in a Neon PostgreSQL database.

All processors are bound by data processing agreements.

7. International Transfers

Our processors (Google, Vercel, Neon) are based in the United States. Data transfers outside the European Economic Area are protected by Standard Contractual Clauses (SCCs) approved by the European Commission.

8. Your Rights

Under GDPR, you have the right to:

• Access: request a copy of your personal data.
• Rectification: correct inaccurate data.
• Erasure: request deletion of your data (“right to be forgotten”).
• Portability: receive your data in a structured, machine-readable format.
• Restriction: limit how we process your data.
• Objection: object to processing based on legitimate interests.
• Complaint: lodge a complaint with your national supervisory authority ([Supervisory Authority]).

To exercise any right, contact privacy@rvccapital.com. We will respond within 30 days.

9. Cookies

We use one session cookie to keep you signed in. We do not use tracking, advertising, or third-party analytics cookies.

10. Security

We protect your data with:

• TLS encryption in transit.
• Encryption at rest for database storage.
• Sensitive form fields redacted before any AI processing.
• Access controls limiting who can view submission data.

11. Changes to This Policy

We will notify you of material changes by email or prominent notice on the platform at least 30 days before they take effect.

12. Contact

For privacy requests or questions: privacy@rvccapital.com
Registered address: [Registered Address]