Privacy policy.

acq/ntd is operated from the United Kingdom. We are the data controller for the personal data described here. For privacy enquiries please contact us.

When you register and use the app, we collect:

• Account data — email address, name, and the role you registered as (founder or investor).
• Profile data — display name, bio, location, headshot, and any role-specific fields you fill in (company, sectors, milestones, firm, investor types, interest sectors, etc.).
• Photos and brand assets — anything you upload to your profile, stored via Supabase Storage with a public-read URL.
• Activity data — your swipes, nudges, matches, follows, messages, and updates so the platform can operate.
• Device data — Expo push tokens (so we can send notifications), basic crash + performance diagnostics from Vercel Analytics for the website.
• Communications — messages you send to other users on-platform, and any emails you send to us via the contact form (handled via Resend).

We use your data only to:

• operate matching, messaging, and notifications;
• show your profile to other users for discovery;
• investigate abuse and enforce our terms;
• improve the product through aggregate, non-identifying analytics;
• contact you about your account or material product changes.

We do not sell your data. We do not share it with advertisers. We do not use it to train models without your consent.

We rely on the following lawful bases under UK GDPR:

• Contract — running the platform that you signed up to use.
• Legitimate interest — operating securely, preventing fraud, basic analytics.
• Consent — push notifications, marketing emails, and any optional features that explicitly ask. You can withdraw consent at any time in Settings.

We use a small number of trusted infrastructure providers:

• Supabase — database + authentication + storage. Hosted in the EU.
• Expo — mobile push notification delivery.
• Vercel — website hosting + privacy-friendly analytics.
• Resend — transactional emails (sign-up, waitlist, contact form).
• Persona — optional identity + company verification. We pass only your user id; Persona handles the ID document and selfie. Founders upload a Companies House confirmation statement or incorporation document to prove shareholding in their own company. Investors upload a share certificate, SH01 return of allotment, or confirmation statement listing them as a shareholder in at least one company they claim to have backed. Persona returns only a pass/fail signal; we never see your underlying documents.

Each is bound by a data processing agreement. We do not share data with any third party for marketing.

Our processors may move data outside the UK (notably the EU and US) to operate the service. Where they do, transfers are protected by UK approved Standard Contractual Clauses or equivalent safeguards.

We retain your account data while your account is active. If you delete your account, we remove your profile from discovery immediately and purge personal data within 30 days, except where we must retain something for legal reasons (e.g. financial records, abuse history). Backups may persist for up to 90 days.

Under UK GDPR you have the right to:

• access a copy of the data we hold about you;
• correct anything inaccurate;
• delete your data (subject to legal exceptions);
• restrict or object to certain processing;
• port your data to another service;
• withdraw consent for any consent-based processing;
• complain to the UK Information Commissioner’s Office.

To exercise any of these, contact us. We respond within 30 days.

The website uses one essential cookie on the /invest page to remember that you’ve unlocked it. We use Vercel Analytics which is designed to be privacy-friendly and does not require a cookie banner under current UK guidance.

We may update this policy. Material changes will be flagged in-app or by email. The “Last updated” date at the top of this page reflects the current version.

Privacy enquiries: contact form.