Privacy Policy

1. Who we are and what this policy covers

vccatalog.com (the "Platform") is a free directory of venture capital firms, the startups they back and the people who work at those firms. It is operated by Team Social LTD, a company registered in Israel ("we", "us"), which decides how and why the personal data described here is processed (the data controller).

This policy covers three groups of people:

• People listed in the catalog (for example partners and investment team members of VC firms), section 2;
• Visitors to the Platform, section 3;
• Account holders who sign in with Google or with an e-mail code, section 4.

We process personal data under the Israeli Privacy Protection Law, 1981 and its regulations. Because the catalog includes people in the European Union and the United Kingdom, we also apply the General Data Protection Regulation (GDPR) and the UK GDPR. Questions and requests: [email protected].

2. People listed in the catalog

What a public profile shows. A person's profile can show:

• name, current firm or firms, job title and role (for example partner or principal), and whether they are known as an investor or founder;
• city and country of work;
• a short professional biography, areas of expertise and education, each with a link to the public page it came from where we have one;
• links to the person's public LinkedIn and X profiles;
• professional relationships derived from the catalog (for example companies their firm invested in, co-investors). Signed-out visitors see only a summary of these; the full lists require sign-in.

Ratings. Every profile shows a rating from 10 to 100: the Kingmaker Tier for a firm, the Smart Money Rating for a person and the Rocket Ship Rating for a company. It is calculated automatically, once a day, from the data the catalog holds. A person's rating is never below 65 and comes from the firms they are listed at, their role there, and whether a public LinkedIn profile or a published e-mail address is on record. It reflects what the catalog knows about the person's professional position; it is not an assessment of the person, and nothing is decided about anyone on its basis. If the data behind a rating is wrong, tell us and we will correct it; the person can also have the whole profile removed (section 7).

What we hold but never publish. E-mail addresses that a firm or person published on a public web page. We use them only to confirm that a removal request really comes from that person (section 7). We do not publish phone numbers or home addresses.

Where the data comes from. Public sources only, collected with automated tools:

• the websites of venture capital firms and startups (team and portfolio pages);
• public regulatory filings, mainly SEC Form D filings in the United States, which name the officers of investment funds;
• public LinkedIn profiles found by searching a person's name and firm. Matches are accepted automatically when the name and firm agree; uncertain matches are reviewed with the help of an AI model, and rejected when the evidence is weak. A match can still be wrong: tell us and we will remove it;
• news articles, press releases and other public web pages.

Why and on what legal basis. We publish a structured directory of the venture capital industry so that founders, investors and researchers can understand who invests in what. Under the GDPR our legal basis is our legitimate interests (Article 6(1)(f)): the data is professional, already public, and limited to the person's role in the industry. Every listed person can object and have their profile removed (section 7).

Sensitive information. We do not look for information about health, religion or beliefs, political opinions, sexual orientation, ethnicity or family life. Biographies are taken from public professional pages; if one contains such details, write to us and we will remove them.

We do not sell the data, and we do not use it for advertising or to make automated decisions about the people listed.

3. Visitors

When you visit the Platform, your browser sends technical data with every request: IP address, browser and device type, the page requested and the time. Our network provider (Cloudflare) and our servers use it to deliver pages, to block attacks and abusive automated traffic, and to apply per-visitor rate limits. Our application keeps only the page route and the outcome of each request in its logs, not your IP address. Legal basis: our legitimate interest in running a secure service.

Google sign-in prompt. On your first visit, after you answer the cookie banner and only in browsers that support Google's browser sign-in standard (FedCM), until you dismiss it, the page loads Google's sign-in service to offer one-click sign-in ("One Tap"). Loading it sends your IP address and browser data to Google, and Google can tell whether you are signed in to a Google account; we receive nothing unless you choose to sign in. Google processes this data under its own privacy policy. Legal basis: our legitimate interest in offering quick sign-in. Once you dismiss the prompt it is not shown again in that browser.

Cookies and similar storage.

• vcw_session: keeps you signed in (necessary; only after you sign in; up to 180 days, or until you sign out).
• vcc_consent: remembers your cookie choice (necessary; 180 days).
• Small items in your browser's local storage that remember interface choices, for example that you dismissed the sign-in prompt (necessary; stay until you clear them).
• Google Analytics cookies (_ga, _ga_*): set only if you choose "Accept all"in the cookie banner. They help us understand which pages are used. Google Analytics is provided by Google; Google keeps this data under its own retention settings (up to 14 months). Legal basis: your consent, which you can withdraw at any time with the "Cookie settings" link at the bottom of every page.

4. Account holders

You can sign in with your Google account. Google then shares with us your name, e-mail address and Google account identifier. Or you can sign in with your e-mail address: we e-mail you a one-time code, and we keep the address and a record of the codes sent to it for up to two days. We use them to run your account (sign-in, share links, the corrections you suggest) and to protect it. Legal basis: providing the service you asked for. When you sign in, Google processes your sign-in under its own privacy policy. We keep your account data until you ask us to delete your account at [email protected]; we do so within one month.

Requests about a profile. When you send a claim, correction or removal request about a profile, we ask who is asking: you confirm an e-mail address at that organisation's own domain (we send a one-time code to it), or, if you cannot, you leave an address where a reviewer can write to you. We keep that address with the request so the reviewer can check who is asking and answer you. It is shown to reviewers only, never published, and is erased when your account is deleted. Legal basis: our legitimate interest in changing or removing a profile only at the request of someone entitled to ask.

The newsletter. The weekly VC Catalog newsletter is sent only to account holders who asked for it: by ticking the newsletter box when signing up, by pressing "Subscribe" on the newsletter page, or in Account settings. The box is never ticked for you, and an account works the same without the newsletter. We keep a record of the request (the text you agreed to, when and where) and pass your e-mail address, and nothing else, to the service that sends the newsletter (section 5). Legal basis: your consent. You can withdraw it at any time with the unsubscribe link at the bottom of every issue or in Account settings; we then stop sending and keep only a record that the address must not be sent the newsletter.

5. Who processes the data, and where

• Google Cloud: hosts the Platform, its database, its backups and its server logs in the europe-west3 region (Frankfurt, Germany).
• Cloudflare, Inc. (United States): delivers the Platform through its global network and protects it against attacks. Requests are handled at the Cloudflare data center nearest to the visitor, which can be outside the European Union.
• Google: Sign-In for account holders, and Google Analytics for visitors who accept analytics cookies.
• Resend (United States): delivers the e-mail that confirms a profile removal request, the one-time codes that verify an e-mail address for a request about a profile, and the sign-in codes. It also sends the newsletter: it receives the e-mail address of each account holder who asked for the newsletter, and records whether an issue was delivered, opened or unsubscribed from.

Each provider processes the data on our instructions under its data processing terms. Transfers from the European Union to Israel rely on the European Commission's adequacy decision for Israel; transfers from Israel to the EU are permitted by the Privacy Protection (Transfer of Data to Databases Abroad) Regulations, 2001. Where a provider is in the United States, the transfer relies on the EU-U.S. Data Privacy Framework where the provider is certified, or on the European Commission's Standard Contractual Clauses.

6. How long we keep data

• Catalog profiles: while the person holds a role in the venture capital industry, until the profile is removed.
• A removed profile's record is kept hidden (never shown anywhere) together with the suppression record, so that the removal can be checked and, if you ask, reversed. Ask us at the address below if you want the hidden record erased as well.
• After a removal: a short suppression record (section 7) is kept for as long as the catalog exists, because its only purpose is to keep the profile from coming back.
• Removal requests and the messages sent with them: as long as needed to handle the request and to show that we handled it.
• Account data: until you ask us to delete your account.
• Database backups: 35 days. Daily disk snapshots of the server: 7 days.
• Server logs: 30 days.

7. Removing your profile

Every profile has an "Is this you? Remove my profile" link. Because anyone could try to remove someone else's profile, we check that the request comes from the person:

• By e-mail confirmation. We send a single-use link, valid for 24 hours, to a public e-mail address we hold that belongs to that person only, or to a work e-mail address you enter whose domain is the website domain of the firm you are listed at (not a free or shared e-mail provider). Opening the link and confirming removes the profile at once. An address at any other domain is not sent a link: the request goes to manual review.
• By manual review. If you cannot use such an address, leave a contact address and a short message on the removal page, or write to [email protected]. We check your identity; the profile stays visible until we approve the request, and is removed when we do.

What removal does. The profile is hidden at once from every part of the Platform: the profile page, search, relationship maps, team lists, datasets, reports and sitemaps. So that it does not come back when public sources are collected again, we keep a suppression record: the internal profile identifier, the name, the LinkedIn profile address and a one-way hash of the person's e-mail addresses (from which the addresses cannot be read back). A new copy of the person is recognized by the LinkedIn address or e-mail address; if a source names the person with neither, the profile could reappear, and you can report it again. Copies in backups disappear when those backups expire (section 6). Search engines may show an old copy until they revisit the page.

8. Your rights

Depending on the law that applies to you, you have the right to:

• know whether we hold data about you and get a copy of it (access);
• have wrong or incomplete data corrected (signed-in users can also suggest a correction on any profile);
• have your data erased, or object to our use of it; for a catalog profile this is the removal described in section 7;
• ask us to restrict processing while a question about your data is open;
• receive the data you gave us as an account holder in a portable format;
• withdraw consent to analytics cookies at any time.

Write to [email protected]. We answer within one month and may ask you to confirm your identity. You can also complain to a data protection authority: in Israel the Privacy Protection Authority; in the EU the authority of your country; in the United Kingdom the Information Commissioner's Office.

9. Security

• All traffic to the Platform is encrypted (HTTPS, TLS 1.2 or newer).
• The server has no public internet address: it is reachable only through Cloudflare's encrypted tunnel, and administration only through Google Cloud's identity-checked access.
• Data at rest, including backups, is encrypted by Google Cloud.
• The public web application cannot read the database directly; each internal component uses its own database account with only the rights it needs. Passwords and keys are kept in Google Cloud Secret Manager.
• E-mail addresses used to match removal requests are stored as one-way hashes in the suppression records.

10. Database registration in Israel

We are preparing the registration of this database with the Israeli Database Registrar of the Privacy Protection Authority. This policy will be updated when the registration is complete.

11. Children

The Platform is meant for professionals and is not directed at children under 16. We do not knowingly collect their data.

12. California residents

We do not sell personal information and do not share it for cross-context behavioral advertising. California residents can use the rights in section 8 and the "Do Not Share My Info" page.

13. Changes and contact

When we change this policy we update the "Last Updated" date at the top. Contact:
Team Social LTD (company no. 516013471), Tel Aviv-Yafo, Israel
E-mail: [email protected]