Privacy Policy

Account information: name, work email, role, company, and authentication data.

Equity and compensation data: grant terms, vesting schedules, cap-table figures, and securities filings that you submit. We reference only the last four digits of any tax identifier where a form legally requires it — we do not store full SSNs or TINs.

Usage data: log data, device/browser information, and feature usage, used to operate and secure the Service. Analytics on the main Service are cookieless and store no personal data. The free tools at /tools use a second analytics provider that stores a visitor identifier in your browser; Section 6 sets out exactly what it collects.

We use personal data to provide, maintain, secure, and improve the Service; to authenticate users; to send transactional and compliance notifications; to provide support; to comply with legal obligations; and to detect and prevent fraud and abuse. We do not sell personal data, and we do not use Customer Data to train machine-learning models. Our legal bases under GDPR are performance of a contract, legitimate interests, consent (where applicable), and legal obligation.

We share data with a small set of subprocessors strictly to operate the Service: Supabase (managed database, authentication, storage), Vercel (application hosting), Resend(transactional email), Sentry (error monitoring, enabled only when configured), and PostHog (product analytics on the free tools only — see Section 6, which includes the one case in which it receives an email address). Each is bound by data-protection obligations. We do not otherwise disclose personal data except as required by law.

We retain Customer Data for as long as the account is active and as needed to provide the Service. Certain securities and audit records are subject to a 7-year regulatory hold and are preserved even after an erasure request, consistent with SEC retention requirements. Other data is deleted or anonymized after the applicable retention period.

Subject to legal limits, you may request access to, correction of, deletion of, or a portable copy of your personal data. Account holders can self-serve a GDPR-compliant data export and erasure from Settings → Compliance (or Settings → Account for individual exports). Records under regulatory hold are retained as described in Section 4; where we cannot delete a record, we pseudonymize personal identifiers while preserving the action record.

We use only the cookies strictly necessary to operate the Service, for example your authenticated session. We set no analytics cookies and no advertising cookies, and we do not track you across other sites.

On the public site — the pages you can read without signing in, including this one, the pricing page and the free tools — we use PostHog. Inside the product, once you have signed in, we run no analytics at all: what you do with your own equity data is not measured.

What PostHog records — which pages are opened, which question a visitor reaches, whether they finish, and whether they told us the result was useful. PostHog stores a visitor identifier in the local storage of your browser — not a cookie — so that a return visit is recognised as the same person. If you sign in, we tell PostHog your account identifier together with your segment and plan — not your email address.

PostHog session replay is enabled on the tools, with all text and all form inputs masked. The figures you type into a tool — revenue, cash, owner pay, prices — are not captured by the replay and are not sent to us. Tool calculations run entirely in your browser, and your inputs are stored only if you are signed in and press Save.

Turning it off. Every public page carries an analytics switch in its footer — the marketing pages and every page under /tools. Turning it off stops usage analytics and session replay for you from that moment, and the choice is remembered. It does not remove what was already collected — ask us under Section 5 and we will delete it. You can also clear this site's data in your browser, or block site storage entirely; the tools continue to work either way.

Our infrastructure is hosted in the United States. Where personal data is transferred from the EEA, UK, or Switzerland, we rely on appropriate safeguards such as the EU Standard Contractual Clauses. Enterprise customers may execute a Data Processing Agreement.

The Service is intended for business use and is not directed to children under 16. We do not knowingly collect personal data from children.

We protect personal data with encryption at rest (AES-256) and in transit (TLS 1.3), database-level tenant isolation (row-level security), access controls, and continuous monitoring. See our Security Policy for details.

We may update this Policy from time to time. Material changes will be communicated by email or in-product notice. The "Last updated" date above reflects the latest revision.

To exercise your rights or ask a privacy question, contact founders@unfoldingvalues.com.