Privacy policy

Data we process

• Account details, workspace membership, sessions, and security records.
• Deal profiles, investor decisions, uploaded documents, analysis results, diligence tasks, and deal chat.
• Public web sources found while researching the company and the people, products, competitors, customers, and investors named in its deal details or its documents. When the documents name no founders or leaders, the leaders the company’s own website lists are researched too. Web searches use those names and a short line about what the company sells, taken from the first pages of its deck when no one has typed one; never the rest of a document. We keep the text of the web pages our research gathers with the deal, as its evidence, and delete it when the deal or its workspace is deleted. From sites that collect and sell information about people, we keep only each page's title and link, not its text.
• US patent records: when a document prints patent or application numbers, our server looks each one up in the US Patent and Trademark Office’s public records, sending the number and nothing else.
• Connected email account details, encrypted access credentials, and email evidence saved for a specific deal.
• If you create your account from one of our links, the channel and campaign tags of the first tagged link that brought you to our site (for example a partner community). The pages you viewed are not kept with your account.
• Wire checks: the counterparty details you save, and a record of each check you run, which keeps the account details it compared but not the instruction text you pasted. The bank details in both (account and routing numbers, IBAN and SWIFT codes) are encrypted before they are stored. Saved counterparty details are deleted automatically once a year passes without a check against them, while the record of each check stays until the workspace is deleted.
• Paired browser-extension devices: a device label, a hashed access token, and the documents you capture with the extension or drop into it.
• Operational records such as analysis status, usage counts, security events, and error details.

Browser extension

The AngelSift Capture extension opens as a side panel beside the page you are viewing. It acts on a page only after you click its icon or press its keyboard shortcut on that page. In page-capture mode it records the rendered pages of a deck during a capture session you explicitly start, keeps them only inside the extension on your device, and sends nothing until you confirm. What reaches AngelSift on confirm is the captured deck (or the fetched file), the page address and title, and the extension’s own device token as the request credential. You can also drag a deck file from your computer into the panel; that file and its name are sent, with no page address.

While the panel is open, it shows the deals in your workspace that need you, what is running on them, and their verdicts, read from your account with the same device token. A paired browser can also confirm a deal’s company and start that deal’s first workup. Each one uses one of your workspace’s workups.

The extension holds no host permissions, injects nothing automatically, collects no browsing history, and does nothing in the background beyond the capture session you started; the panel checks your workspace only while it is open. Its device token is issued only after you approve pairing inside your account, is stored server-side only as a hash, and expires 90 days after issue. You can revoke it per device from Settings at any time, or with Disconnect in the panel, which cancels it on our servers too. Discarded or abandoned captures are deleted from the device without being transmitted.

Gmail and Outlook

Gmail access uses gmail.readonly. Outlook access uses delegated Mail.Read. These permissions can read messages in the connected account, but AngelSift searches only when a workup or quick read runs on the deal, or you ask Angel about it, using company search details you confirmed. If you connect an email account, Anthropic reads the emails a search for a deal turns up, to judge whether they are evidence, and reads the ones kept when it writes your workup. OpenAI indexes the ones kept, and reads matching emails when you ask Angel about a deal; we don't save what it reads.

AngelSift does not synchronize the full email account and cannot send, draft, label, archive, move, or delete messages in Gmail or Outlook. Messages that are not saved as deal evidence are discarded. Saved message content is stored only with the workspace and deal where it was saved.

AngelSift's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

How data is used

Data is used to sign users in, run requested analyses, extract and search evidence, generate scorecards and reports, answer deal-specific questions, prevent abuse, and operate the service. Private deal or email evidence is not used for advertising.

Where data is processed

Application data is stored using Vercel and Neon infrastructure, with files kept in private cloud storage. Anthropic and OpenAI process the limited inputs needed for requested research, analysis, chat, and search. Neither trains its models on what you send: both providers' business terms, which we have accepted, forbid them from doing so. Both delete what they receive within 30 days, except where they must keep it longer to look into suspected abuse. Google and Microsoft provide connected email access. Postmark sends AngelSift’s email, and Resend receives the decks you forward in. Airtable holds the waitlist and the requests you send from the support page, and PostHog records page events on angelsift.com that don’t identify you. When you have an account, the app also tells PostHog when you sign up, finish your free analysis, start a checkout and pay, under an account number, never your name, email or anything from your decks. It also tells PostHog when a research brief the app writes about a deal quotes an expert in words we cannot find on any of its source pages, so we can review that brief. That note carries the same account number and how many such quotes there were, never the quote, the expert's name or anything from your decks. It also tells PostHog when you download a memo and in which format, under the same account number, never the memo or anything from your decks. When something in the app breaks, PostHog also receives an error report saying what failed and where, under an account number at most, after we strip quoted text and email addresses from it. We run AngelSift from Slack and Linear, so they receive a short note when you sign up, finish your free workup, pay or miss a payment, cancel, reach a usage limit, contact support or hit an error, under an account number, never your name, email or anything from your decks. The one exception: if a payment reaches us after you have deleted your workspace, the note asking us to refund it includes the email the payment was made with. Each company processes data under its own business terms, which we have accepted.

Stripe handles payments. You enter your card on Stripe's own page, and your card number never reaches us. Stripe keeps your card with your email address and billing address. That includes the card you add before your free workup, which is saved without a payment. What we keep is Stripe's reference for your account, which plan you are on, whether it is paid up, and when the current billing period ends. When you delete your workspace, we remove the card you added for your free workup from Stripe.

Retention and deletion

Saved evidence, workups, reports, and audit records remain available until the workspace is deleted. A custom retention schedule is not currently available. Disconnecting an email account removes its stored access credentials, but does not erase evidence already saved with a deal. Workspace deletion removes the workspace records and privately stored files. Chats with Angel belong to the workspace: everyone in it can read them, and anyone but a viewer can delete them. They are kept until deleted, or until the deal or workspace they belong to is deleted, even after the person who started one leaves. Resend and Postmark, which carry our email, keep copies of it, and of decks forwarded in it, for up to 45 days. Neon, which holds our database, keeps a 6-hour history so we can undo an accident, so a deleted record can linger there for up to 6 hours. When you write to us from the app's support page, the email that tells us carries only a link to the request, never your name, address, topic or message; if saving the request fails, nothing is kept and the page asks you to send it again. Support requests and their screenshots are deleted with the workspace, and two years after they are sent at the latest; the copies our providers keep are gone within 45 days after that. To keep Angel's message limits, we also keep a record of when each question was asked and from which account, without the question itself; it goes when the workspace is deleted. To keep our usage limits, when you delete a deal or a review we keep a short record of each run it made (its kind, when it started, whether it finished and which workspace ran it, but nothing from the deck or the analysis) and delete it within 40 days. To keep the free workup to one per person, we keep a one-way fingerprint of your email address for two years from the day you sign up, even after you delete your account; only our own systems can match it, and we use it only to recognise that address if it signs up again. If an account's email address is never confirmed, we delete the account 7 days after the last confirmation email we sent, along with the fingerprint it created. Before your free workup starts, we ask you to add a card on Stripe's own page, and it is not charged. To keep the free workup to one per card, we keep a one-way fingerprint of the card, never its number, for two years, even after you delete your account; only our own systems can match it. Wallets like Apple Pay can't be used for this step. We also keep a record of each time you start adding a card, when and with what result, never the card itself, as proof of your agreement, for two years.

Logs, Do Not Track and changes

Our hosting provider keeps server logs of each request, including the IP address it came from, to keep the service secure and running. When you sign in, we keep the IP address and browser of that session with your account. Our analytics service does not store IP addresses. Browsers' Do Not Track setting has no agreed meaning, so we don't treat it differently, and nothing here tracks you across other sites. When this page changes, the date on it changes too. Before a material change takes effect, meaning a new company receiving your information, a new use for it, or keeping it longer, we email you. We ask you first before we use information we already hold in a new way.

Your choices

You can disconnect Gmail or Outlook from the Email accounts page and revoke the grant in your Google or Microsoft account. Workspace owners can remove members and request workspace deletion. Send questions, privacy requests, and deletion assistance to info@angelsift.com.