Venture Track — Privacy Policy
Effective date: 14 October 2026 Last updated: 14 October 2026
This policy explains how Blank Cut Inc. ("Venture Track", "we") collects, uses, and protects personal information in connection with the Venture Track platform.
1. Scope
This policy covers:
- Account data — information about the people who use Venture Track.
- Customer Data — the portfolio and company information our customers put into the platform.
- Website data — information collected from our public marketing site.
Where we process Customer Data on a customer's behalf, we act as a processor (or "service provider") and the customer is the controller. Our Data Processing Agreement governs that relationship. Our agreements with customers also let us use Customer Data to improve our products, including to train and evaluate our own machine-learning models, and to create Aggregated Data, as sections 3 and 4 describe. That applies only to Customer Data submitted on or after the date a customer accepts our Terms of Service as updated on 14 October 2026 (section 4).
2. What we collect
2.1 Information you give us
| Category | Examples | Why |
|---|---|---|
| Account information | Name, work email, firm name, role | Create and secure your account |
| Firm information | Firm name, website, description | Set up your organization |
| Invite requests | Name, work email, firm name and website, role, portfolio size band, what you're trying to solve, how you heard about us | Evaluate and respond to invitation requests |
| Customer Data | Companies you track, positions, notes, uploaded documents, chat messages, watchlist configuration | Provide the Service; improve our products and train our models (sections 3 and 4) |
| Billing information | Billing contact, billing address, tax details | Process subscriptions |
| Support correspondence | Emails you send us | Respond to you |
We do not collect or store full payment card numbers. Card details go directly to our payment processor.
2.2 Information collected automatically
- Usage data — features used, analyses run, timestamps. Used for billing limits, product improvement, and abuse prevention.
- Technical data — IP address, browser and device type, and error diagnostics. IP addresses are used for security and rate limiting.
- Authentication data — session records and single-use sign-in tokens.
2.3 Information from third parties
The Service ingests information about companies from public and licensed sources — news, academic research, regulatory filings, policy documents, and market data. This may include personal information about company personnel where it appears in those public sources (for example, an executive named in a funding announcement).
3. How we use information
- Provide, maintain, and secure the Service
- Authenticate users and prevent unauthorized access
- Process payments and enforce plan limits
- Send transactional email — sign-in links, signal alerts, digests, billing notices, and service announcements
- Respond to support requests and invitation requests
- Detect, investigate, and prevent abuse, fraud, and security incidents
- Develop and improve our products and services, including by training and evaluating our own machine-learning models (section 4)
- Create Aggregated Data, and use, license, and sell it (section 3.2)
- Comply with legal obligations
3.1 Legal bases (EEA/UK)
Where GDPR applies, we rely on: contract (providing the Service you signed up for), legitimate interests (security, abuse prevention, improving our products and services, training and evaluating our own machine-learning models, and creating Aggregated Data — balanced against your rights), consent (marketing email, where required), and legal obligation (tax and accounting records).
3.2 Aggregated Data
We may combine, aggregate, and de-identify the information we collect, including Customer Data and information about how the Service is used, so that it does not identify, and cannot reasonably be used to identify, a customer, a user, or any individual ("Aggregated Data"). We own Aggregated Data and may use, curate, license, and sell it, including metadata such as statistics and trends about how the Service is used and what is tracked on it, for any purpose. We do not create Aggregated Data from Customer Data submitted before the customer accepted our Terms of Service as updated on 14 October 2026.
Because it cannot reasonably be used to identify anyone, Aggregated Data is not personal information. We keep and use it only in de-identified form, we do not attempt to re-identify it, and we require anyone we license or sell it to not to attempt to re-identify it.
4. Machine learning and automated processing
The Service uses large language models, including models run by the AI model providers described in section 5.1, to summarize sources and produce analysis.
We may use the information we collect, including Customer Data, to develop and improve our products and services, including to train and evaluate our own machine-learning models. Those models are not used to disclose Customer Data that identifies a customer or its users to other customers or third parties.
Customer Data submitted before the date a customer accepts our Terms of Service as updated on 14 October 2026 stays under the terms that applied when it was submitted: we do not use it to train machine-learning models, and we do not create Aggregated Data from it.
The Service does not make decisions producing legal or similarly significant effects about individuals without human involvement.
5. How we share information
We may create, use, license, and sell Aggregated Data, which does not identify you, your organization, or any individual (section 3.2). We do not sell Customer Data or any other information that identifies you or your organization, and we disclose it, to other customers or anyone else, only as follows:
5.1 Service providers
Service providers (our subprocessors) process information on our behalf to run the Service. By category, with the information each receives:
- Hosting and infrastructure — application hosting, caching, rate limiting, and background jobs. All data in transit and processing.
- Database — primary database hosting. Account data and Customer Data.
- Document storage — file storage. Documents you upload.
- Payments — payment processing. Billing contact and payment details.
- Email — transactional email delivery. Recipient email addresses and message content.
- AI model providers — language models for chat, summarization, classification, and analysis. Questions asked in chat, and the company records, notes, screening answers, and excerpts of uploaded documents that chat and market analysis draw on; company names and signal text for digests, validation, and tagging.
- Search providers — real-time web search. Search queries containing company names.
- Data and analytics providers — finding and scoring news, filings, and research about the companies you track. Company identifiers and watchlist terms (company names, keywords, tickers, and industries), sent without your firm's name.
The current list of subprocessors is available to customers on request to support@blankcut.com. We give customers notice before adding or replacing a subprocessor that processes personal data in Customer Data, as set out in the DPA.
5.2 Other disclosures
- Legal — where required by law, or to establish or defend legal claims. We will notify affected customers unless legally prohibited.
- Business transfer — in a merger, acquisition, or sale of assets, subject to this policy continuing to apply.
- With your direction — where you ask us to share.
6. International transfers
We process data in the United States. If you are in the EEA, UK, or Switzerland, your information will be transferred outside your jurisdiction. We rely on Standard Contractual Clauses and equivalent mechanisms for those transfers, as detailed in the DPA.
7. Retention
| Data | Retention |
|---|---|
| Account data | While the account is active |
| Customer Data | While the subscription is active, plus 30 days after termination |
| Sign-in tokens | 15 minutes; deleted on use |
| Usage records | 24 months, for billing history and product analytics |
| Billing records | 7 years, or as tax law requires |
| Security and access logs | 12 months |
| Invite requests | 12 months from submission, unless converted to an account |
After the retention period, data is deleted or irreversibly anonymized. Backups are purged on their own rotation, no later than 7 days after deletion.
Deletion does not extend to Aggregated Data, or to machine-learning models and other improvements to our products made using information before it was deleted (sections 3.2 and 4).
8. Security
Measures in place include: encryption in transit (TLS) and at rest; role-based access control with tenant isolation enforced at the query layer; passwordless authentication with single-use, expiring sign-in links; secrets held in a managed secret store rather than in code; and least-privilege access for staff, granted only where operationally necessary and logged.
No system is perfectly secure. If we become aware of a breach affecting your personal information, we will notify you without undue delay and as required by law.
Report a vulnerability to support@blankcut.com.
9. Your rights
Depending on where you live, you may have the right to access, correct, delete, port, restrict, or object to processing of your personal information, and to withdraw consent.
If you are a user of a customer's account, direct requests about Customer Data to that customer — they control it. We will assist them in responding. You may also contact us about our own use of Customer Data described in sections 3 and 4.
To exercise rights over data we control, contact support@blankcut.com. We respond within 30 days. We will not discriminate against you for exercising these rights.
California
California residents have rights under the CCPA/CPRA, including to know, delete, and correct personal information, and to opt out of sale or sharing. We do not sell or share personal information as those terms are defined by the CCPA. We use personal information for the purposes in section 3, which include improving our services and training our own machine-learning models. Aggregated Data is de-identified information, not personal information, under the CCPA, and we handle it as section 3.2 describes.
EEA/UK
Where we rely on legitimate interests (section 3.1), including to improve our products and train our own models, you may object to that processing. Aggregated Data cannot reasonably be used to identify anyone, so it is not personal data. You may lodge a complaint with your supervisory authority.
10. Cookies
We use cookies that are strictly necessary for the Service to function — authentication, session management, and security. We do not use advertising cookies. Any analytics cookies on the marketing site are described in the consent banner, where one is required.
11. Children
The Service is for business use and is not directed at anyone under 18. We do not knowingly collect information from children.
12. Changes
We may update this policy. When the Service asks you to accept an updated policy, it takes effect for you when you accept it. Other material changes will be notified by email or in-product at least 30 days before taking effect. The "last updated" date above always reflects the current version.
Contact: support@blankcut.com · Blank Cut Inc., c/o Northwest Registered Agent Service, Inc., 8 The Green, Suite B, Dover, DE 19901