Legal

Privacy Policy

Effective 9 October 2026

1. Who we are

The Angel App Ltd("TheAngel", "we") runs theangel.app, portfolio software for angel investors. We are the data controller for the personal data described in this policy. We are a company registered in England and Wales, company number 09809528, registered office 20 Wenlock Road, London N1 7GU, registered with the UK Information Commissioner's Office (ICO) under number Z8265701. We process personal data in line with the UK GDPR and the Data Protection Act 2018.

2. Data we collect

We collect:

Account data: your email address and your name. You sign in with Google, with a link emailed to you, or with your email address and a password. If you sign in with Google, our authentication provider, Supabase Auth, also receives the basic profile Google shares (your name, email address and profile picture). Google acts under its own privacy policy for that sign-in. If you choose a password, it goes from your browser directly to Supabase Auth, which stores it only as a one-way hash. It does not pass through our own servers, and we never see or store the password itself.
Portfolio data: the positions, companies, marks, notes and documents you add, and any email you forward to us for a position.
Founder update request data:the founder's email address and the answer they give when you send them a request.
Contact form data: your name, email address and message, if you write to us through the Contact page.
Technical and cookie data: IP address, browser and device information, and cookies or similar technologies; see our Cookie Policy for the categories we use and how to manage them.
Usage data: pages viewed, features used and how you arrived, linked to a random identifier and, if you are signed in and have allowed analytics, to your account ID.
Founder invitation data: if you accept an invitation to list, your name, company name, email address, phone number, website and LinkedIn profile, whether you chose to receive product updates, and which version of our terms you accepted and when. We record the invitation code, who we sent it to and when, and when and by whom it was used. To limit abuse we log each attempt to use a code with a one-way hash of your IP address, never the address itself.
Listing data:if you list a company, what you add to the listing: company details, the raise and its terms, your team's names, roles, short biographies, photos and LinkedIn profiles, your pitch deck, a pitch video link, traction figures and the evidence behind them, and data room files. Your phone number is never shown on a listing.
Payment data: if you pay for a listing, Stripe tells us the plan, the amount and currency, its own references for the payment, subscription and customer, and when you paid or were refunded. We also keep a copy of each message Stripe sends us about a payment, which can include the name, email address and billing details Stripe collected. We never receive your card details.
Founder waiting-list data: the name, email address, company and answers you give in the waiting-list form go to GoHighLevel, our contact system. We do not keep a copy in our own database.
Investor activity on listings: if you register interest in a listing, the listing, the date and any message you add; if you watch a listing, that you watch it; and, when you open a listing while signed in, that you viewed it that day. Views are used only to count them.
Investor statement: before you see full listing details, you make an investor statement. We keep which statement you made (high net worth, self-certified sophisticated investor or, where offered, US accredited investor), or that none applied, the exact wording you were shown and your answers, your legal name and typed signature, your country of residence, the date and time, and the IP address and browser you signed from.

3. How we use your data

We use personal data to:

Provide and operate the tracker: store your portfolio, calculate your figures, and let you sign in, including by sending you a one-time sign-in link when you ask for one.
Send a founder update request on your behalf, and show you their answer.
Read documents and forwarded emails you add, using Anthropic's AI models, to pull out the terms of a position automatically.
Give you support: a small number of TheAngel staff can read your portfolio to help you when you ask.
Reply to a message sent through the Contact page.
Detect abuse and enforce rate limits, for example on founder update requests and the contact form.
Where you have given analytics consent, understand how the website and the signed-in app are used (pages viewed, features used, how you arrived, and whether people go on to sign up or list), including by linking that use to your account ID. Where you have given marketing consent, measure the effectiveness of our own advertising. If you have not given consent, we count sign-ups and feature use with cookieless analytics only.
Run founder listings: review a listing and its evidence before it goes live, using Anthropic's AI models to draft a score and a briefing from your pitch deck and listing for our reviewers, publish it, show it to investors, and give founders the registered interest their plan includes. A person reviews an AI briefing before it is published.
Take payment for listings and keep payment records.
Keep a contact record in GoHighLevel for founders who join the waiting list or accept an invitation. A record is made whether or not you choose product updates; that choice is recorded on it.
Check that an investor's statement is current before showing full listing details, and remind them once before it ends.
Operate and monitor the Service. When someone registers as a founder or an investor, their name, email address, sign-up method (email or Google) and registration time are sent to an internal workflow on n8n, which posts them to our team's Slack channels. Payment and error alerts reach the same channels the same way; they carry the company, the amount, a link for our team and error details, but no founder's name or email address. When a founder submits or resubmits a listing for review, a message with the company name, the plan, any early-bird place and a link for our team goes the same way, with no founder's name, email address or phone number. n8n also reads summary figures, including account names and email addresses, from our database for internal reports.

Our legal basis is performance of our contract with you (running your portfolio, sending update requests, running your listing, taking payment, and delivering registered interest to founders on the plans that include it), our legal obligations (keeping payment records, and checking an investor's statement before showing full listing details), our legitimate interests (support, security, abuse prevention, reviewing listings, keeping founder contact records, operating and monitoring the Service through the notifications and alerts above, and improving the Service, including the cookieless counts), or your consent (analytics, including linking use to your account ID, marketing cookies, and product updates for founders).

4. What founders, investors and the public see

Anyone:when a listing is live, its page on theangel.app shows the company name, one-line description, logo and cover image, sector, stage, region, type of instrument, the listing's plan, whether its traction is verified, and when it opened and closes. It does not show the amount being raised or its terms, and it does not show founder names or the team. Logos, cover images and team photos are stored as public files, so anyone with a file's address can open it.
Search engines: listing pages are not indexed by search engines and are not in our sitemap.
Signed-in investors:the full listing, including the amount being raised and its terms, the team's names, roles, biographies, photos and LinkedIn profiles, traction, the published score and briefing, and the pitch deck, once their investor statement is current. Without a current statement, a signed-in investor sees the company name, one-line description, sector and stage, and what the company does, but not the raise. An investor can open data room files only after registering interest in that listing, through a download link that works for 15 minutes. We do not log who downloads a file, and we do not ask for or record a separate non-disclosure agreement.
Founders:on the Basic plan, a founder sees how many investors registered interest, not who they are. On Featured and Advanced (and Growth, on older listings), a founder sees, for each investor who registered interest, their name, email address, the sectors, stages and largest cheque size from their investor profile, any message they added, and the date. Paid plans also show how many investors viewed and watched the listing. Founders never see who viewed or watched a listing, an investor's portfolio, or an investor's statement. When an investor withdraws their interest, the founder no longer sees it and the investor loses access to the data room.
Our staff:a small number of TheAngel staff (reviewers and administrators) can read listings and everything attached to them, including traction evidence, review notes and data room files, as well as investor statements, registered interest, profiles and investor portfolios. They use this to review listings and evidence and to give support. Each change to a listing's status is recorded with the member of staff who made it. We do not keep a separate log of what staff read.

5. Who we share data with

We use the following processors to run the Service:

Supabase: our database and sign-in (Supabase Auth), hosted in London.
Vercel: hosting for the website and tracker, and cookieless usage analytics.
Anthropic: reads documents and forwarded emails you add, to extract investment terms, and reads a listing's pitch deck and details to draft a score and a briefing for our reviewers.
Resend: sends and receives email on our behalf (sign-in links, founder update requests, listing notifications, the contact form).
PostHog (PostHog Inc., United States): product analytics, only once you have given analytics consent. It receives usage events, a random identifier and your account ID, never your name or email.
Stripe:takes payment for founder listings and upgrades. You enter your card details on Stripe's own checkout page, so they never reach us. Stripe receives your email address and what you are paying for.
GoHighLevel: our contact system for founders. It receives the name, email address, company and answers you give in the founder waiting-list form, and, if you accept an invitation to list, your name, email address, phone number and where your listing has got to. It stores contact records only and runs no automated messages.
Cloudflare Turnstile: checks that a sign-in, sign-up or similar form is sent by a person, not a bot. It receives your IP address and information about your browser, not your email address.
n8n: runs our internal workflows on our own server, hosted by Hostinger: the registration notifications, payment and error alerts, and internal reports described above.
Slack:our team's messaging. It receives the registration notifications and the payment and error alerts.
Google Workspace: hosts our team mailbox, which receives contact-form messages and notices about listings sent to our team.
Google, Meta and LinkedIn: Google Analytics only once you have given analytics consent, and advertising measurement only once you have given marketing consent, in the cookie banner. Google Analytics and advertising measurement do not run in the signed-in app. See the Cookie Policy.

A founder you send an update request to receives your name and the request; they do not receive any other part of your portfolio. What founders see when you register interest in a listing is set out in section 4. We do not sell personal data, and we share it with no one else except where required by law, for example a request from a UK regulator or law enforcement body.

6. International transfers

Your account, portfolio and listing data is held in Supabase's London region. Some of our processors (Anthropic, Resend, Vercel, Stripe, GoHighLevel, Cloudflare, Slack, Google Workspace and Hostinger, which hosts our n8n server, and, where you have given consent, PostHog, Google, Meta or LinkedIn) may process data outside the UK, including in the United States. PostHog stores analytics data in the United States. Where data leaves the UK, we rely on the UK International Data Transfer Addendum, the EU Standard Contractual Clauses, or another safeguard recognised under UK data protection law.

7. Retention

We keep your portfolio data for as long as your account exists. When you delete your portfolio from Settings, we delete it, along with every file you uploaded; this is permanent. A founder update request you sent, and the founder's answer, is kept as part of the relevant company's record until you delete it. We do not keep a separate copy of a contact-form message in our database; it is sent to us by email and kept under our normal email retention.

Analytics events are kept for up to 12 months.

Deleting your portfolio from Settings deletes your portfolio, not your account: your sign-in, profile, investor thesis and listing alerts, investor profile, registered interest and watches, listing view records, questions you asked, field confirmations and your investor statements stay until you ask us to delete your account. We keep a record that the portfolio was deleted.

Listings: we keep a listing, its files, its review history and its payment records after it ends or is withdrawn. Removing a data room file deletes it. To delete a listing or a founder account, write to us.
Payment records:we keep payment records and the copies of Stripe's messages about them.
Invitations: we keep the record of an invitation and its use. The log of attempts to use a code, with hashed IP addresses, is deleted after 30 days.
Registered interest and watches: withdrawing your interest or unwatching a listing deletes that record. View records are deleted after 400 days.
Investor statements: a statement lasts 12 months. A renewal adds a new statement and keeps the earlier ones. Statements are never edited, and are deleted with your account.

8. Your rights

Under UK data protection law, you can ask us to:

Give you access to, or a copy of, the personal data we hold about you.
Correct inaccurate data.
Delete your data. You can delete your portfolio yourself, from Settings; to delete your account, a listing or anything else, write to us.
Restrict or object to certain processing.
Receive your data in a portable format.
Withdraw consent, where we rely on consent (analytics and marketing cookies, and product updates for founders).

To exercise any of these, write to hello@theangel.app. You can also complain to the ICO, the UK's supervisory authority, at ico.org.uk.

9. Security

Your positions, marks, documents and updates are visible only to you, enforced in the database itself and not only in the app; a small number of TheAngel staff can read them to give support. Data is encrypted in transit and at rest. You can sign in with Google, a one-time emailed link, or your email address and a password. A password is stored only as a one-way hash by our authentication provider, Supabase Auth, and never reaches our own servers. More detail is on our Security page. No method of transmission or storage is completely secure, and we keep improving these controls.

10. Children

The Service is not directed at, and we do not knowingly collect personal data from, anyone under 18.

11. Changes

We may update this Privacy Policy from time to time. We will change the "Effective" date above when we do, and tell you on the Service if a change is significant.

12. Contact

Privacy questions: hello@theangel.app.