Legal

Privacy Policy

Effective 13 May 2026

Last updated 10 October 2026

DueVestor is an autonomous due-diligence platform operated from Israel. This policy explains what information we collect about users of our SaaS, why we collect it, how long we keep it, and the rights you have under GDPR (EU/UK), CCPA (California), and the Israeli Protection of Privacy Law. To exercise any right, email [email protected] or use the in-app data-export and erase-account controls.

1. What we collect

Account: name, email, OAuth identifier, optional phone number. Usage: pages viewed, features used, anonymous session ID via the `dv_sid` cookie (only when you consent). Billing: PayPal capture identifiers and transaction amounts (we never see your card). Subject data: the people/companies you choose to research — stored against your account and never shared. People researched in a customer's case: the organization that owns the case decides about that data, and we process it on its behalf. If the organization places a case on legal hold, it keeps that case's data under its own legal basis (for example GDPR Art. 17(3)(e), legal claims) until the hold is released at its request. An erasure request about such data that reaches us is forwarded to that organization, and we assist it. Case documents: files that members of an organization add to a case, and the text we read from them, which is stored with the document. The organization that owns the case decides about them, and we process them on its behalf. Audit trail: a server-side log of sensitive account actions, retained for two years. If you belong to an organization where the activity log is turned on, its administrators and owners can see a log of members' actions on the organization's cases: who opened, exported or deleted a case, or placed or asked to release a legal hold on one, and when. The log does not show network addresses or devices. Status e-mails: if you subscribe on our status page, we keep your e-mail address and language only to send a confirmation link and then notices when we open or resolve an incident, and, for abuse protection, a pseudonymised record of the request's network address for up to one hour; an address not confirmed within 48 hours is deleted, and unsubscribing (a link in every e-mail) deletes it at once.

2. How we use it

To run the service you signed up for, to bill you, to improve the product (aggregated analytics only), and to comply with our legal obligations. We do NOT sell your data, we do NOT use your subject data to train a model, and we do NOT run cross-site behavioural advertising.

3. Who we share it with

Sub-processors only: PayPal (payments), Google Cloud (Vertex AI, EU Multi-Region) and Amazon Web Services (Bedrock, eu-central-1) for LLM inference on report composition, Anthropic (fallback only, and for reports only with your explicit consent — see 3A; subject data is sent under their no-training contract), Cloudflare (CDN, DNS, WAF and file storage), RunPod (hosting for the application and database), Resend (email), Twilio (phone verification), and GitHub (code hosting; no user data flows there). The current list is at /sub-processors. We will notify you 30 days before adding a sub-processor that processes EU personal data.

3A. AI processing, European servers and your consent

Report composition runs on large language models hosted in the European Union: Google Cloud Vertex AI (EU Multi-Region) first, then Amazon Web Services Bedrock (eu-central-1, Frankfurt). In rare cases both are unavailable at the same time. We never move a report to US servers on our own. Instead the report is paused, we email you, and the report page asks you to choose: try again later on European servers, or explicitly consent to process this report via Anthropic on servers in the United States, where the provider retains your data for 30 days. Your consent is recorded, with the time and your account, before any data is sent there. If you do not decide within 7 days, the report is kept in your account as waiting for European servers — it is not marked as failed and you are not charged again. This consent applies to report processing. Report chat, uploaded financial statements and the help and sales assistants all ask for their own consent the same way. Case documents and the text we read from them are not sent to any AI provider.

4. How long we keep it

Account data: until you erase your account. Reports: indefinitely while the project is active, deleted when the project is. Audit log: 2 years (legal retention). Backups: daily backups are kept 14 days and weekly backups 8 weeks. When you exercise the right to erase, we soft-delete immediately and hard-delete after a 30-day grace window so you can reverse the decision by emailing [email protected]. Case documents: until the member who added a document, or an administrator of the organization, deletes it while the case is open and not on legal hold, or until the case or the organization is deleted. When a document is deleted, we send the deletion of the file to our file storage at once; our database backups do not contain the file. The text we read from it is deleted from our live database at the same time, but it stays in our encrypted database backups until they expire (daily backups 14 days, weekly backups up to 8 weeks). A case on legal hold keeps its documents until the hold is released.

5. Your rights

GDPR/UK: access, rectify, erase, restrict, port, object. CCPA: know, delete, opt-out of sale (we don't sell). Israeli PPL: access and correction. Two of these are self-service: GET /api/v1/me/export returns a JSON snapshot of your data; DELETE /api/v1/me/erase starts the erasure flow. For anything else, email [email protected] — we respond within 30 days.

6. Cookies

Essential: `authjs.session-token` (signed-in session), `dv_ref` (affiliate attribution, if applicable). Analytics (opt-in): `dv_sid` anonymous session ID — only set when you accept on the banner. We honor Do-Not-Track and Sec-GPC; if either header is present we skip analytics regardless of banner state.

7. Contact

Privacy/DPO inquiries: [email protected]. Security disclosures: [email protected]. General support: [email protected].