Privacy policy

01Who we are

undrsight is operated by Undrhand CommV, a limited partnership registered in Belgium under VAT number BE 1014.885.957. When we talk about "we," "us," or "undrsight," we mean Undrhand CommV. We act as the data controller for personal data we collect from visitors to our website and account holders on our platform. For the content your organisation uploads to the platform (deal documents and analyses), we act as a processor on behalf of your organisation — see our Data Processing Agreement for that role.

You can reach us at privacy@undrsight.com. We do not currently have a statutory DPO designated under Art 37 GDPR; the same address reaches the person responsible for privacy at the company.

Postal contact for privacy notices: Undrhand CommV, Brussels, Belgium. Please use the privacy email above for the fastest routing of data-subject requests.

02Scope of this policy

This policy covers personal data processed when you:

• Visit our marketing website (undrsight.com)
• Create an account or use the undrsight platform
• Communicate with us (email, contact forms, sales calls)
• Are invited into an organisation on the platform by a customer

It does not cover processing we do purely as a processor under instructions from a customer organisation — in that scenario, the customer's own privacy policy governs what happens to personal data they upload. Our processor obligations in that case are set out in our DPA.

03Data we collect

Account data

When you create an account: email address, full name, a bcrypt-hashed password, and your chosen display preferences (theme, digest subscription, MFA configuration). If you enable multi-factor authentication, we store an encrypted TOTP secret and bcrypt-hashed backup codes. We never store plaintext passwords or TOTP seeds.

Organisation & usage data

When you use the platform we log request metadata, audit events (login, upload, deletion, role changes), organisation settings, and timestamps needed to render the activity feed and enforce audit retention.

Content you upload

Deal documents, analyses, findings, comments, notes, and related artefacts uploaded by members of your organisation. We process this material on behalf of your organisation under the DPA. Core storage is EU-hosted; the inputs needed for AI analysis may be sent to approved LLM sub-processors under the transfer safeguards described below.

Communications

If you email us or fill in a contact form, we store your message and reply for as long as needed to follow up and meet legal bookkeeping requirements.

Technical data

IP address, browser user-agent, device type, approximate location (country/region) inferred from IP, and pages visited. Used to keep the service secure and diagnose issues.

04Why we process your data

• Provide the service: authenticate you, route your requests to your organisation's data, let you upload and analyse deal documents.
• Secure the service: detect unauthorised access, support user-level MFA, maintain audit logs that satisfy regulatory expectations for M&A / private-markets workflows.
• Support & operations: respond to emails, investigate incidents, restore data from backups on request.
• Improve the product: aggregate operational usage data to decide what to build next — never linked to the content of your deals.
• Billing: invoice your organisation (paid plans only — the platform is invite-only today).
• Legal compliance: accounting, tax, responding to lawful requests from authorities.

05Legal bases (Art 6 GDPR)

• Contract performance (Art 6(1)(b)): running the platform for account holders and their organisations.
• Legitimate interests (Art 6(1)(f)): fraud prevention, security monitoring, operational product analytics, handling support enquiries, exercising or defending legal claims.
• Consent (Art 6(1)(a)): optional features like the morning digest email.
• Legal obligation (Art 6(1)(c)): Belgian accounting / VAT record-keeping, responding to court orders.

06Recipients & sub-processors

We share personal data only with the service providers needed to run the platform. Each of them is bound by a written data-processing agreement that mirrors our commitments to you.

We will notify customer organisation administrators of material changes to this list at least 30 days before they take effect, with a right to object.

07International transfers

Our primary processing takes place in the European Union. Where a sub-processor is in the United States — currently OpenAI, Anthropic and Resend — we rely on the European Commission's Standard Contractual Clauses (Module 2 or Module 3 as applicable) and, where the provider is certified, the EU-US Data Privacy Framework as an additional safeguard.

Deal-document content is stored in the EU. The files, extracts, prompts, and outputs needed for a requested analysis may be processed by approved LLM providers outside the EEA under the safeguards described here. See the DPA for details.

08Retention

• Account data: until you delete your account, plus 30 days in archive for accidental-deletion recovery.
• Deal content: kept until deleted by your organisation. Delete requests trigger a 24-hour grace window, then hard delete. See the Security page for the lifecycle diagram.
• Audit logs: kept per organisation policy (default 7 years; configurable by admins). Required for regulatory post-deal review.
• Billing records: 7 years, as required by Belgian tax law.
• Backups: rolling 30 days. Deleted data persists in backups for that window before it falls out of scope.

09Security

We take appropriate technical and organisational measures (Art 32 GDPR). In summary: transport encryption (TLS 1.2+), encryption at rest for the application database and file storage, role-based access control, least-privilege operational access, user-level multi-factor authentication via TOTP enrollment, immutable append-only audit logging, 24-hour hard-deletion pipeline with an evidence trail, and regular vulnerability scanning. Full list in the Security page and Annex II of the DPA.

10Your rights

Under GDPR you have the right to:

• Access — a copy of the personal data we hold about you.
• Rectification — correct inaccuracies.
• Erasure — delete your data where we don't have an overriding obligation to keep it.
• Restriction — pause processing while a dispute is resolved.
• Portability — receive your data in a structured, commonly used, machine-readable format.
• Objection — object to processing based on our legitimate interests.
• Withdraw consent — where processing relies on consent, for processing from the point of withdrawal.
• Complain — to your supervisory authority. In Belgium: the Gegevensbeschermingsautoriteit / Autorité de protection des données.

Email privacy@undrsight.com and we will respond within one month, extendable by two further months for complex requests per Art 12(3).

11Cookies & tracking

On the marketing site we set only strictly-necessary cookies by default. We do not currently use third-party session-replay analytics.

On the platform itself we use a single authentication cookie (the JWT) plus local-storage entries for org preferences. None of these are third-party.

12AI processing

The platform uses third-party LLM providers (currently OpenAI and Anthropic) to generate due-diligence analyses from the documents your organisation uploads.

Inputs sent to providers are scoped to the analysis being requested and may include file references, extracts, prompts, and generated outputs. Outputs are stored in our EU database; provider-side handling is governed by our DPA, provider terms, and the transfer safeguards described above.

Outputs from LLMs are probabilistic. The platform surfaces citations back to source documents for every claim so analysts can verify before relying on them. See the Terms of Service for the AI-output disclaimer.

13Children

The platform is not intended for or directed to anyone under 18. We do not knowingly process personal data from children. If you believe a child has submitted data to us, email privacy@undrsight.com and we will delete it.

14Changes to this policy

We update this policy when the product, our sub-processor list, or applicable law changes. Material changes are emailed to registered account holders at least 30 days before they take effect. The "last updated" date above is the source of truth for the current version; a versioned change log is available through the public policy history once published, and by email for historical versions.

15Contact & complaints

Privacy questions, requests, or complaints:

• Email: privacy@undrsight.com
• Postal: Undrhand CommV, Brussels, Belgium.
• Supervisory authority: Gegevensbeschermingsautoriteit / Autorité de protection des données, Rue de la Presse 35, 1000 Brussels, Belgium — dataprotectionauthority.be.