Privacy Notice.

ImpactVest is a product of Gaiosis Systems. References to "we", "us" and "our" in this Notice refer to Gaiosis Systems as the data controller for personal data processed via impactvest.com and the ImpactVest Test Workspace.

Contact for privacy enquiries: office@impactvest.com.

• Registration data — full name, professional email, organisation, job title, role, organisation type, country, chosen pathway (investor or company) and the three consents you gave on the registration form.
• Session data — a single-use email verification link and, after verification, a signed session token stored client-side. We do not use third-party tracking cookies.
• Product-usage events — pages viewed inside the Test Workspace, journey step completions, feedback you submit. Used to improve the product; never sold.
• Documents you upload — only in a live private workspace, only from you, only in scope of the analysis you asked for.

• Passwords for the Test Workspace (magic-link sign-in only).
• Payment card details (Stripe processes cards; card data never touches our servers).
• Location / device fingerprinting beyond standard HTTPS request metadata.

• Delivering the service you asked for — Article 6(1)(b), performance of contract.
• Product improvement analytics — Article 6(1)(f), our legitimate interest, balanced against your rights. You may object at any time.
• Consent-recorded processing — Article 6(1)(a), for the three explicit consents on the registration form.

Registration and session records are retained for the lifetime of your workspace plus 24 months, unless you request earlier deletion. Uploaded documents in live workspaces are retained per your instruction and are deletable on request. A durable soft-delete → hard-delete pipeline is planned as part of the Institutional Foundations release; until it ships, deletion requests are processed manually by the operator on receipt of a request to office@impactvest.com.

• Emergent — hosting, deployment, environment variable storage (secrets never leave the platform).
• Stripe — payment processing (customer-facing DBA: Gaiosis Systems). Live payments are currently disabled.
• Resend — transactional email delivery (magic-link sign-in emails).
• OpenAI / GPT-5 — evidence-extraction language-model calls, invoked only against documents you upload to a live workspace. No inputs are used to train third-party models.

You have the rights of access, rectification, erasure, portability and objection under GDPR and equivalent rights under UK, US-state and other applicable privacy law. Email office@impactvest.com to exercise any of these. We respond within 30 days.

Material changes will be posted here and communicated to registered users by email. The "Last updated" date above indicates the current effective version.