Covers the waitlist, your account and everything in the app, and the pitches founders send. Last updated 23 October 2026.
Investoried, Malmö, Sweden is the controller of the personal data described here. Questions, requests and complaints: hello@investoried.com. Using the app is also governed by our terms of use.
The details on the form: name, email, phone, LinkedIn profile, how you invest (type, ticket size, currency, networks, investments made), your answers to the optional questions, where the link came from (referrer and campaign tags), your browser’s user agent and a scrambled (salted hash) form of your IP address used to stop abuse. Joining the waitlist doesn’t create an account; when we invite you, an account is opened under your email, onboarding starts with the name you gave, and your waitlist entry is marked as joined when you first sign in.
Name, email, and what you add to your profile: phone, company, title, city and country, LinkedIn and X links, bio, picture, how you invest and your track record. You choose who can see your profile (everyone signed in, your connections and the people you share deals and networks with, connections only, or nobody), which fields are hidden, and whether people can find you by name. By default your profile is visible to your connections and the people you share deals and networks with, your ticket size, number of deals, email and phone are hidden, and people can find you by name. Someone who types your exact email or phone can send you a connection request without learning whether you have an account, unless you have turned requests off. We also keep your email and notification settings and, if you connect Slack, your Slack user and workspace ids and an encrypted access token.
Your password (stored only as a one-way hash), passkeys (a public key and a device label such as “Mac, Chrome”), your two-step login secret (encrypted) and hashed backup codes, your sign-in sessions and when they were last used, and short-lived records of failed attempts, keyed by a hash of the email and IP address, to stop password guessing. If you sign up with LinkedIn through a founder’s link, we receive your LinkedIn id, name and email; we don’t keep LinkedIn access tokens or your LinkedIn picture.
The rounds you take part in: your role, your commitments and how they change, whether you’re not investing, the documents in the deal, the deal chat (for the lead and co-investors), an activity feed, and your private notes (encrypted, seen only by you). We record each time someone opens a deal document. The lead sees who has opened each document and when; other members see how many have opened it and, except observers, an activity feed of who opened what. A lead can add an investor as hidden: they then show as “Undisclosed investor” to everyone except the lead and themselves.
When a founder sends a pitch through an investor’s pitch link or founder page, we store the company details, the contact person’s name, email and phone, the founders’ names and LinkedIn profiles, the deck and later documents and answers, the consent they gave, and a salted hash of the IP address to stop abuse. If an organisation number is given, we look the company up in Bolagsverket’s register (we send only the organisation number); the public filings returned can name board members. An AI summary (one-pager) is written for the investor from the deck, the answers and the register data. Investors can add their own notes and stages, ask the founder questions and ask to talk. Founders never see which investors opened, passed on or moved their startup.
Network memberships and invitations, startups shared in a network and the interest members show (including an amount and comment if given); connection requests and their note (encrypted), and the email or phone typed to find someone; contacts built from the rounds you take part in and the favourites you mark; and direct, group, network and deal chats with their attachments. Message text is encrypted in the database and shown to the people in that chat.
Files and folders you upload, their versions and comments, and whom you share them with. When you import documents, their content is read by AI to suggest investments (company, amount, date, terms and people named). If you pick files from Google Drive, the Google sign-in stays in your browser with access only to the files you pick; we never receive or store a Google token. Your portfolio holds the investments you add, including names, emails and roles of people you note against them.
When club deals are available, the lead enters each participant’s legal name, email, whether they invest privately or through a company, and the joint company’s bank details and address. Each participant adds their postal address and either their personal identity number (personnummer) or their company’s organisation number and signatory, accepts three declarations (stored with the time and IP address), uploads signed documents and reports their payment. Identity numbers and addresses are encrypted and shown masked in the app; each time they are decrypted to generate documents or the lead’s export, the access is logged. The lead also sees the organisation numbers they type in when creating the club deal.
The generated documents (such as the share register and subscription list) contain full identity numbers and addresses and are shared with every participant in that club deal, because the company’s documents legally require them. They are stored like other deal documents, without extra encryption. The lead can also export the register. The assistant never reads club-deal documents, so they are not sent to the AI provider. Investoried never holds or moves the money.
Events you host, join or share: your attendance status, answers to the host’s questions, and, for hosts, the venue address. Hosts always see their guest list; other people see it if the host leaves the guest list visible. To place a hosted event on a map we send its venue address to OpenStreetMap’s geocoding service, and the event page shows an OpenStreetMap map, which your browser loads from OpenStreetMap. Listed public events are read from public pages such as Luma; no user data is sent to do so.
Your questions and the answers (encrypted in the database) and the titles of your conversations. To answer, the assistant reads what you can see in Investoried — your portfolio, deals, startups and documents, documents shared with you, and your contacts’ profiles as far as their settings allow — and sends the parts it needs, with your name and the page you are on, to our AI provider. It can also search the web through the AI provider. It never reads club-deal documents.
While Investoried is in beta we note, per day, which parts of the app you open (for example Deals or Portfolio), how often, and whether you had a round open at the time — never which deal, startup or document. We use it to learn whether Investoried is useful between rounds; only we see it, in our admin dashboard.
We send sign-in links, invitations, security notices and the notifications you choose, and keep a log of what was sent to which address. If you connect Slack, we send you direct messages that name the deal and link to it, never its contents.
Much of what is in Investoried is entered by someone else: a lead who invites you by email, a co-investor who adds you to their portfolio notes, a founder who names you as a teammate, or a participant list in a club deal. The person who adds it is responsible for having a reason to do so (see the terms). You can ask us what we hold about you either way.
You don’t have to give us any data, but without an email and name we can’t give you an account, and a club deal can’t produce valid documents without each participant’s identity details.
Personal identity numbers are used only in club deals, where the company’s share register and subscription documents require secure identification of each shareholder, as Swedish law allows.
We don’t make decisions about you by automated means that have legal or similarly significant effect. AI summaries and suggestions are aids; people decide.
We never sell personal data or share it for advertising.
The app runs in the EU, and our database and the files you upload are stored there, in Frankfurt. Some data is handled outside the EU or EEA: by the AI provider, in email delivery logs, in some of our hosting provider’s build and request logs, in our domain and email-forwarding provider’s worldwide network, in our encrypted nightly backups, in our Gmail inbox, and by the services you choose to use. Those transfers rely on EU standard contractual clauses or the EU–US Data Privacy Framework. The full list, with what each does and where: service providers.
We use only what the site needs to work. No analytics, advertising or tracking cookies.
theme: light or dark mode (1 year).founder_company: which startup a founder account is looking at (1 year).You can delete your account under Settings, Account, Delete account (after signing in within the last 15 minutes), or ask us at hello@investoried.com. While you lead an open deal or are the only admin of a network, hand it over or close it first. Your profile, contact details, sign-in methods, Slack connection, your files and folders, imports, portfolio, private startups, notes, connections, assistant conversations, usage records, network memberships and waitlist entry are deleted, and your pitch links are closed. Events you host pass to a co-host or are cancelled.
Some things stay because they are also other people’s records, shown under “Removed user” rather than your name: your commitments and activity in shared deals and which documents you opened, messages you sent to others (their text stays in those chats), posts and replies you wrote in networks, startups you shared or sent to others, questions you asked founders, interest you showed in a network that was already answered, deals you led, and our own log of admin actions concerning your account. Where you signed a commitment, the record that it was signed (the amount and the date) stays with the round, but the name you typed to sign is replaced with “Removed user”. Club-deal participant details stay with the club deal, for the reasons in section 4, except your email address, which is removed so no more club-deal mail reaches you. Ask us at hello@investoried.com if you want any of these looked at; we will remove whatever we don’t have a reason to keep, and answer within a month.
Connections are encrypted (HTTPS); sensitive fields are encrypted in the database; passwords are hashed; you can use passkeys and two-step login; sign-ins are rate limited; and every page in the app checks who you are and what you may see. No system is perfect: if we discover a breach that puts you at risk, we will tell you and the Swedish Authority for Privacy Protection as the law requires.
You can ask to see the data we hold about you and get a copy, to correct it, to have it erased, to restrict or object to how we use it, and to receive what you gave us in a portable format (we send it to you). Where we rely on consent, you can withdraw it at any time. Email hello@investoried.com; we answer within a month. You can also complain to the Swedish Authority for Privacy Protection (IMY, imy.se).
Investoried is for people aged 18 and over. We don’t knowingly collect data about children.
When this policy changes in a way that matters, we will update the date above and tell users by email or in the app at least 30 days before the change takes effect.