PRIVATE PILOT

Privacy notice

This notice explains the limited data processing for the invite-only RaiseRails pilot.

Controller and contact

Taylor Griffin operates this pre-company pilot and is responsible for this processing. For privacy requests, contact taylor.griffin@esmt.berlin.

What we process

• email address, account identifier, pilot membership, and sign-in state to provide and secure access;
• a salted IP hash for rate limiting;
• saved filters and onboarding preferences;
• your answers to the onboarding questionnaire — whether you are open to equity, your target amount, your stage and your timeline;
• your acceptance of the data & confidentiality terms, with their version and the date;
• in-app usage events — which screen or feature you opened and when — used to run and improve the pilot;
• Jessica messages, model responses, feedback, startup submissions, and any uploaded file you choose to provide;
• demo-request details when you submit the public form.

Why and for how long

We process this data to run the pilot, secure access, answer your requests, improve the pilot, and meet legal obligations. A chat becomes inaccessible 7 days after it starts and is deleted by our hourly cleanup within the hour that follows; an uploaded file becomes inaccessible 24 hours after upload and is deleted on the same hourly schedule. IP rate-limit hashes are deleted after 2 days; feedback, startup submissions and usage events after 90 days; and unclaimed individual invitations after 90 days. Onboarding questionnaire answers are kept for the duration of the pilot as part of its dataset, and are deleted together with your account. Acceptances of the data & confidentiality terms are kept while the pilot runs, and are deleted together with your account. We delete account-linked data when a verified deletion request is completed, subject to legal retention duties.

Service providers and transfers

We use Supabase for authentication, database, and private file storage; Vercel for app hosting; Resend for demo-request email; and Google Gemini to generate Jessica responses. Your current message, recent chat context, and any attached file are sent to Gemini. Do not submit confidential, sensitive, financial-account, health, or third-party personal data. Providers may process data outside the EEA under their applicable contractual safeguards.

Your rights

You may request access, correction, deletion, restriction, or a copy of your personal data, and may object where applicable. Contact the address above. You may also complain to a competent data-protection authority.

Last updated: 22 September 2026