Privacy Policy
Valuepoint Labs ("we", "us", "our") is the data controller responsible for personal data processed about users of the Valuepoint Labs platform ("the Service"). This Privacy Policy explains how we collect, use, and safeguard that information.
1. Data We Collect
We collect the following categories of personal data:
- Account data: name, email address, and hashed password when you register
- Usage data: pages visited, features used, and session information
- Content data: value propositions, customer profiles, and financial models you create and save in the Service
- Shared-viewer data: if you open a business case that an account holder has shared with you by entering your email address, the email you provide, a record of your views (including timestamps), and any comments you leave
- Technical data: IP address, browser type, device information, and cookies
2. How We Use Your Data
We use your data to:
- Provide and maintain the Service
- Authenticate your identity and manage your account
- Send transactional emails (e.g. password resets)
- Improve the Service and fix bugs
- Comply with legal obligations
We do not sell your personal data to third parties. We do not use your content data to train AI models.
3. Legal Basis (GDPR)
Our legal basis for processing personal data is: (a) contract performance — to provide the Service you have signed up for; (b) legitimate interests — to operate and improve the Service; and (c) legal obligation — where required by applicable law.
4. Data Retention
We retain your account data and value prop content for as long as your account is active. You may delete your account at any time, after which your personal data will be deleted within 30 days, except where retention is required by law.
5. Data Security
We use industry-standard security measures including encrypted storage of passwords, HTTPS for all data in transit, and session-based authentication. No method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.
6. Sub-processors and International Transfers
To provide the Service we use a small number of vetted sub-processors, each under a data-processing agreement. The content you submit to AI features is processed to deliver the Service:
- Anthropic, PBC (United States) — AI generation. Content you submit to AI features is sent to Anthropic to produce the output. Anthropic processes it under a data-processing agreement, does not use it to train its models, and we have enabled limited/zero data-retention options.
- Railway (United States) — application hosting and database
- Stripe (EU/United States) — payments, billing and tax
- Postmark (United States) — transactional email (account, billing, invitations)
- Cloudflare R2 (European Union) — encrypted off-site database backups, stored in the EU
Some of these process data outside the EEA (including the United States). For those transfers we rely on the European Commission's Standard Contractual Clauses (and the UK IDTA/Addendum for UK data), with supplementary measures where appropriate. We do not sell personal data and do not use it for advertising. A current sub-processor list is available on request via the contact below.
7. Your Rights (GDPR)
Under GDPR, you have the right to:
- Access your personal data
- Correct inaccurate data
- Request deletion of your data
- Object to or restrict processing
- Data portability
- Lodge a complaint with a supervisory authority (in Finland: Tietosuojavaltuutettu)
8. Cookies
We use strictly necessary session cookies to maintain your authenticated session. We do not use tracking or advertising cookies.
9. Shared Business Cases
Account holders can share a business case with other people. If a case is shared with you and you open it by entering your email address, we process that email and your view activity (including timestamps), together with any comments you leave, and we make them visible to the account holder who shared the case (the "sender") — for example, in a list of who has viewed the case. We do this to operate the sharing feature; our legal basis is our and the sender's legitimate interest in knowing who has accessed a case they shared, and in providing the functionality you chose to use by opening the link. The sender, not Valuepoint Labs, decides what to share and with whom. To stop being shown a case, ask the sender to revoke your access; to exercise your data rights, contact us at the address below.
10. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated via email or a prominent notice in the Service.
11. Contact
For privacy-related queries or to exercise your rights, contact: [email protected]