Privacy policy

What we collect

Most of what Vanelo holds about you is something you typed into it. The categories below are what the platform collects in normal use.

• Account details. The information you give us when you create and run an account: name, email address, password credentials, and the settings and preferences attached to your account.
• Business and round information. What you record about your company and your raise: funding ask, currency, pre-money valuation, equity offered, use of funds, previous raises, SEIS or EIS position, your answers to the 14 Investability Assessment questions, the inputs you give the Valuation Engine, your due diligence checklist progress, and the notes and stages you keep in the investor CRM. Some of this is company information rather than personal data, but it sits alongside your account and we treat the whole record with the same care.
• Documents you upload to the data room. Pitch decks, legal documents and anything else you put in your Digital Data Room, together with the per-recipient access grants and expiry dates you set, and the access log of who opened what.
• Showcase campaign content. What you submit for review before a campaign goes live in Deal Discovery, including any edits you make to reviewed content.
• Investor verification evidence. On the investor side, the information and documents you provide so that we can verify you before you are given access to full campaign detail.
• Booking and advisory information. The advisory services you book, when, and anything you tell us in the course of arranging or attending a session.
• Payment and billing information. Paid parts of Vanelo, such as the founder subscription and the Showcase review fee, are charged through a third-party payment provider, which handles your card details. Vanelo itself stores the amount, the currency, the status of the payment and its own reference for it.
• Messages you send us. Emails to hello@vanelo.io and anything you send through our contact page, along with our replies.
• Usage data. Technical and behavioural information generated as you use the platform: log data, device and browser information, IP address, and records of the actions you take in the product.

We do not ask you for special category data, such as health or biometric information. If you upload a document to your data room that happens to contain it, it is stored as part of that document. Please do not put anything in Vanelo that does not belong in a fundraising record.

Why we use it, and our lawful basis

Under UK GDPR we need a lawful basis for every use of personal data. The mapping below is our working position and is one of the things the legal review will confirm.

• To provide the platform. Creating your account, running your round record, scoring your Investability Assessment, producing a valuation range, hosting your data room, matching your target list against the investor database, and running your CRM pipeline. Basis: performance of a contract with you.
• To take payment. Charging the founder subscription, Showcase review and re-review fees, and advisory bookings, and keeping the records that go with them. Basis: performance of a contract, and legal obligation for tax and accounting records.
• To review Showcase campaigns. Vanelo reviews a campaign before it goes live in Deal Discovery, and reviews it again when reviewed content is edited. Basis: performance of a contract with you.
• To verify investors. Checking investor identity and status before full campaign detail is unlocked. Basis: legitimate interests, namely protecting founders from unverified parties reading their round.
• To keep the service secure and working. Logging, monitoring, fraud and abuse prevention, backups, and the data room access log. Basis: legitimate interests in running a secure platform, and performance of a contract for the access log, which is a feature you rely on.
• To support you. Answering your emails and support requests. Basis: performance of a contract, or legitimate interests where you are not a customer.
• To improve Vanelo. Understanding how the platform is used so we can make it better. Basis: legitimate interests.
• To send marketing. Product updates and other marketing email, where you have asked for it or where the law otherwise allows it. Basis: consent, or legitimate interests for existing customers. You can opt out at any time.

Where we rely on legitimate interests, we have to balance those interests against your rights, and you have the right to object.

Automated scoring, and what it is not

Two parts of Vanelo produce a result automatically from what you enter. The Investability Assessment scores 14 questions across Viable business, Sizable opportunity and Backable team and places you in one of the published tiers. The Valuation Engine runs Scorecard, Berkus and Venture Capital methodologies and returns a valuation range, never a single recommended figure.

Both are tools for your own use. Neither is a decision made about you by us, and neither is investment advice. No funding outcome is decided by the platform without a person involved.

Who we share it with

We do not sell personal data. We share it in these situations, and no others without telling you.

• People you choose to share with. When you grant data room access to a recipient, they see the documents you granted, within the expiry you set. When you submit a Showcase campaign and it goes live, verified investors can read its full detail in Deal Discovery. These are your decisions, made in the product, and you can see the result in your access log.
• Advisors you book. When you book an advisory session, the advisor delivering it needs enough information to run the session, and only sees what you grant them access to.
• Our hosting and infrastructure providers. The application is hosted by Vercel, in its London region. The database and your uploaded documents are held by Supabase.
• Our email provider. Account, transactional and support email is sent through Resend.
• Our payment provider. Card payments are processed by Stripe. We never receive or store your card number.
• Other processors. Sentry, for error monitoring, and Google, where you choose to sign in with a Google account. Investor verification runs through an external identity provider; that provider is still being selected and will be named here before verification opens.
• Professional advisers and authorities. Our accountants and lawyers where needed, and any disclosure we are legally required to make.
• A buyer, if the business changes hands. If PitchHub Ltd is sold or reorganised, personal data may transfer as part of that. We would tell you.

Every processor we use is bound by a written contract that limits them to acting on our instructions.

Your rights under UK GDPR

You have the following rights over your personal data. They apply whether you are a founder, an investor, or someone a founder shared a data room with.

• Access. Ask for a copy of the personal data we hold about you, and an explanation of how we use it.
• Rectification. Have inaccurate data corrected and incomplete data completed. Most account and round details you can edit yourself in the product.
• Erasure. Ask us to delete your personal data. You do not have to ask us for your account: an account holder can erase their account in Vanelo directly. Erasure is not absolute, and we may keep what we are legally required to keep, such as billing records.
• Restriction. Ask us to pause our use of your data while a dispute about accuracy or lawful basis is resolved.
• Portability. Receive the data you gave us in a structured, commonly used, machine-readable format, or ask us to send it to another provider where that is technically feasible.
• Objection. Object to processing we base on legitimate interests, including profiling. You can object to direct marketing at any time and we will stop.
• Rights around automated decisions. Where a decision with legal or similarly significant effect is made about you by automated means alone, you can ask for human involvement and contest the outcome. See the note above on the Investability Assessment and Valuation Engine.
• Withdraw consent. Where we rely on consent, you can withdraw it at any time. That does not undo processing carried out before you withdrew.

To exercise any of these, email hello@vanelo.io from the address on your account, or tell us enough for us to find your record. We do not charge for this. We aim to respond within one month, which is the standard UK GDPR time limit, and we will tell you if a complex request needs longer. We may need to check who you are before we act on a request.

If you are not satisfied with how we have handled your data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office, the UK supervisory authority for data protection.

Common questions

Changes to this policy

We will update this policy as the platform changes and as the legal review completes. The date at the top of the page always shows when it last changed. Where a change materially affects how we use your data, we will tell account holders rather than rely on you noticing the date.

This policy sits alongside our terms and our pricing page, which sets out what we charge and states plainly that there are no refunds on booked services, campaign submissions or subscriptions.

Last updated 1 September 2026.