Privacy Policy

Effective date: 24 October 2026. This policy describes what InvestSecure LLC ("InvestSecure," "we") collects when you visit this website or view an Active Diligence Record, certificate, or badge page on it, what we hold about persons named on a Record, and what we do with it.

1. What We Collect From Visitors

Server logs. Standard technical data: IP address, browser type, pages viewed, and the time of access — the ordinary server logs any website keeps.

Visit analytics. Lovable, the Site's host, measures visits with its built-in analytics. On each page, its scripts send Lovable the page address, the referring page, any campaign tags in the link, your browser type and language, an approximate country, how long the page is in view, page-load timings, technical errors, and a random visit ID kept in a cookie for 30 minutes. Lovable reports this to us in aggregate (visitors, page views, pages, traffic sources, device types and countries); we do not use it to build individual profiles.

Invite-only access. Where an issuer elects an invite-only Record, we log credential and QR-code use — which credential accessed which Record, and when — because the issuer controls that access and may revoke it. That log exists so revocation works; it is not used for marketing.

Forms and the Questions panel. If you send us your details through a form on the Site or the Questions panel, we receive what you enter, such as your name, email address, phone number, company, title, role, website, the services you are interested in, the fund you name or choose to include, and your question, and, with your consent, save it, with the consent wording and the time you sent it, in our contact records (HubSpot) to follow up with you. When an issuer sends a request, our team receives an internal notice that a request arrived, without your details. To limit request volume on the Questions panel and forms, we keep a one-way code derived from your IP address that changes daily; each code is set to expire after one day.

AI assistant. Questions you type to Vera, the Site's AI assistant, are sent to an AI model provider to produce an answer. Do not include personal details, financial files or credentials.

What we do not collect. No account is required to view a Record that is not invite-only. We do not ask visitors for names, email addresses, or financial information to view a Record, and we do not collect payment details on the Site.

2. What Is on a Record

A Record displays verification status about an issuer and its offering — statuses, sources, and review dates. Records display the names of issuer entities, designated persons in summary form where the issuer's record calls for it, and named service providers, including the issuer's administrator wherever the administrator's records are the source. Records never display investor identities, investor account data, or investor personal documents. The verification evidence behind a Record is held off the Site, under the retention rules of the InvestSecure Standard: for each review, the sources consulted, the method and time of access, what was seen, counts, dates, statuses, and the name of the reviewer who signed off the point — no investor personal data.

3. What We Do With Visitor Data

We use visitor data to operate and secure the Site; to make issuer-controlled revocation of invite-only access work; to measure aggregate usage; to answer and follow up on requests you send us; to enforce the Terms of Use against scraping, mirroring and unauthorized access; to respond to requests under §8; and to comply with law.

4. What We Do Not Do

We do not sell visitor data. We do not share it for advertising. We do not build marketing profiles of Record viewers from what they view; a fund you viewed reaches our contact records only if you include it in a form you send us, by ticking it or by sending the form from that fund's filing page, where the form shows it before you send. We do not use visitor data to identify prospective investors for any issuer, and we do not report to an issuer who viewed its Record. Details you send through a form are used to follow up on your request and, where you agreed, to email you about our services; you can unsubscribe at any time.

5. Sharing

Service providers that host and secure the Site and support its features, under confidentiality consistent with this policy: Lovable (hosting, the Site's built-in visit analytics described in §1, and the AI gateway), Supabase (database), HubSpot (contact records), Google (the Gemini model behind the AI assistant, and the typefaces on the standalone sample record page) and Slack (internal notices, without your details). Any other analytics provider we add will be named here. Booking a meeting opens Calendly, which handles the booking under its own privacy policy. Issuers, for an invite-only Record only: the credential identifier and the time of each access using that issuer's credentials, so the issuer can manage revocation — no IP address, browser data, or other visitor information. Authorities, where the law requires it.

6. Retention

Server logs and visit analytics are held by our hosting provider, Lovable, under its own retention schedule. Invite-only access logs are kept while the issuer's Record is published and for ninety (90) days after it expires or is withdrawn, then deleted. Contact details you send us stay in our contact records until you ask us to delete them or they are no longer needed to follow up. To stop duplicate submissions, our database also keeps, for each form request, a random request ID, a one-way code computed from what you entered, its outcome and its time, with no set deletion date; it does not keep what you entered. Verification evidence is retained for seven (7) years after the Record it supports expires or is withdrawn, under the InvestSecure Standard; that rule, not this policy, governs it.

7. Cookies

The Site uses a cookie that saves your privacy choices for six months, a security cookie that its hosting network may set to filter automated traffic, and a 30-minute visit cookie set by Lovable's built-in visit analytics (§1). The sample record page remembers in this browser whether you have closed its guided tour, so it does not open again. If you turned on fund memory on an earlier visit, this browser keeps one fund record remembered for up to 30 days; you can forget it at any time. Lovable's built-in visit analytics runs on every page; the Site's privacy preferences and the Global Privacy Control signal do not switch it off. The privacy preferences list optional Analytics and Marketing categories for any other service; none is connected at present. If one is added, it will load only after you allow its category, and never while your browser sends the Global Privacy Control signal. No advertising cookies, no cross-site tracking. If that changes, this policy and the Site's notice change first.

8. Designated Persons

If an issuer has designated you as a covered person for its offering, InvestSecure holds your name, your role, and the results of reviews of named public sources about you, and a Record may display your name in summary form. The issuer is responsible under its agreement with InvestSecure for obtaining any consent the law requires before designating you. You may ask us at contact@investsecure.org which Records name you, to correct an inaccuracy against the source, or to raise a concern; we will answer within thirty (30) days. We cannot remove you from a Record at your request while the issuer keeps you designated, because the Record must reflect the issuer's roster; we can and do tell you who to ask.

9. Your Choices and Rights

You can view Records that are not invite-only without providing any personal information. Where applicable law grants access, correction, or deletion rights over personal data we hold about you, requests go to contact@investsecure.org and we honor them as the law provides. Residents of jurisdictions with specific disclosure regimes (for example, the California Consumer Privacy Act, or the EU and UK General Data Protection Regulation) have the rights those laws provide.

10. Security

Access to the systems holding logs and verification evidence is credentialed and restricted to named staff. Our access to any issuer's administrator systems is read-only. We maintain commercially reasonable administrative, technical, and physical safeguards appropriate to the data we hold. No method of transmission or storage is perfectly secure, and we do not promise otherwise.

11. Children

The Site is not directed to children and we do not knowingly collect data from them.

12. Changes

We may update this policy; the posted version governs, and material changes are posted with a new effective date.

Contact: contact@investsecure.org