Privacy Policy

1.1 Information We Process for Lunaseed

Lunaseed processes certain information for its own business purposes, including account administration, security, fraud prevention, billing, product operations, service analytics, legal compliance, support, and communications. For this information, Lunaseed determines the purposes and means of processing, subject to applicable law.

1.2 Information We Process for Organizations

For diligence materials and other information controlled by a venture or investment firm, Company, or other organization, Lunaseed may process personal information on that organization’s behalf under a commercial agreement or other authorization. In those circumstances, the organization may act as the business or controller and Lunaseed may act as its service provider or processor. If you have a request concerning information controlled by an organization, we may direct you to that organization or assist it in responding.

1.3 What This Policy Does Not Cover

This Policy does not govern an organization’s independent handling of information outside Lunaseed, or the independent privacy practices of third-party websites, connected services, verification providers, payment providers, or other external services. Those parties may provide their own privacy notices and terms.

3.1 Account and Profile Information

We may collect names, business email addresses, job titles, organization names, profile photos, authentication identifiers, account and workspace IDs, role and permission information, and other profile details. Phone numbers may be collected when a feature, verification process, or security measure requires them.

3.2 Organization and Engagement Information

We collect information about venture firms, Companies, diligence engagements, invitations, workspace membership, role assignments, request status, activation and workflow events, and organization settings. We may also process business contact information for prospective customers, partners, and other professional contacts.

3.3 Customer Content and Diligence Materials

The Service may process documents, files, financial and operational records, data-room materials, company information, contributor submissions, messages, notes, Fact Sheets, Carter interactions, Investigation reports, Editor content, Deal Review content, Firm Memos, and other material submitted to or generated within an authorized workspace. Customer Content may contain personal information about founders, employees, customers, vendors, counterparties, advisors, or other individuals.

3.4 Connected Integration Data

At an authorized Company representative’s direction, Lunaseed may connect to third-party systems to retrieve permitted information for diligence. The Company selects the source, available scope, and historical period, subject to the connected provider’s capabilities and limitations. Lunaseed uses temporary, read-only access to capture a point-in-time snapshot of permitted information and then disconnects or revokes access after capture, subject to limited temporary technical persistence needed to complete or verify the process or recover from an interruption. Lunaseed does not use this workflow to write data back to the connected source system. Captured snapshots may be retained as part of the authorized diligence record under Section 10.

3.5 AI-Assisted Inputs and Outputs

We process prompts, questions, selected context, retrieved evidence, citations, generated responses, classifications, extractions, summaries, and other AI-assisted outputs when users interact with features such as Carter, Fact Sheets, and Investigations. Production AI-model inference involving Customer Content is routed through Amazon Web Services (AWS) Bedrock, including Anthropic Claude Sonnet and other approved models. Other infrastructure and search providers may process limited information as necessary to support the authorized workflow; this does not authorize those providers to train foundation models on Customer Content. Not every provider receives every category of Customer Content or personal information.

Lunaseed does not use Customer Content, including documents, integration snapshots, prompts, or generated responses, to train or fine-tune generalized artificial intelligence or foundation models and does not authorize its model providers to do so.

3.6 Verification, Identity, and Banking Information

Depending on the features used, third-party identity, banking, KYC, or background-verification providers may collect information directly from individuals and may provide Lunaseed with status information, results, identifiers, or other permitted data. Lunaseed seeks to minimize direct collection of highly sensitive verification information where a specialized provider can collect it directly. Founder verification, when enabled, is subject to separate disclosures and authorization presented in the verification flow.

3.7 Billing and Payment Information

We collect customer billing contacts, billing addresses, invoices, transaction records, payment status, engagement pricing, and related commercial information. Payment card or payment-account information may be processed by Stripe or another payment provider. Lunaseed is not intended to store complete payment card numbers.

3.8 Device, Usage, Security, and Log Information

We may collect IP address, browser and device information, authentication events, pages or features used, timestamps, workspace actions, access events, integration connection events, submission activity, billing events, diagnostic information, and other logs used to operate, secure, troubleshoot, and audit the Service.

3.9 Website, Cookie, and Analytics Information

Lunaseed uses session and authentication technologies to keep users signed in and Google Analytics to understand use of the website and application. We do not currently use marketing pixels or session-recording tools. More information is provided in the Lunaseed Cookie Policy.

3.10 Communications

We collect the content and metadata of communications you send to us, including support requests, privacy or legal requests, product feedback, meeting or demo inquiries, and other correspondence. If we send optional marketing communications, you may unsubscribe using the method provided in the communication.

6.1 AI-Assisted Features

Lunaseed uses artificial intelligence, machine learning, retrieval, extraction, classification, embeddings, search, and other automated techniques to support diligence workflows. Production AI-model inference involving Customer Content is routed through AWS Bedrock, including Anthropic Claude Sonnet and other approved models. Other infrastructure and search providers may support non-model functions as necessary for an authorized workflow. Access to model invocation is restricted through least-privilege AWS IAM and application permissions. Lunaseed limits sensitive prompt and response logging and retention to what is necessary to provide, secure, and support the Service or comply with law. AWS Bedrock does not use customer inputs and outputs to train foundation models or share them with third-party model providers; any AWS retention for abuse detection or other service operations depends on the model, account settings, and applicable AWS terms.

6.2 No Generalized Model Training on Customer Content

Lunaseed does not use Customer Content to train or fine-tune generalized AI or foundation models, and does not authorize third-party model providers to do so. Lunaseed may use De-identified Data for security, aggregated analytics, product measurement, and service improvement where the data is not reasonably capable of identifying a person, Company, venture firm, or other organization or disclosing confidential diligence information across engagements. For current model inference through Amazon Bedrock, customer inputs and outputs are not used by AWS or third-party model providers to train their foundation models.

6.3 Human Review and Decision-Making

AI-assisted outputs can be incomplete, inaccurate, or context-dependent. Lunaseed provides tools to surface facts, conflicts, citations, and derived information, but does not make investment decisions on behalf of venture firms and does not determine whether a Company or founder should receive an investment. Users remain responsible for their own review, diligence, judgment, and decisions.

7.1 Authorized Organizations and Engagement Participants

We disclose information within authorized workspaces and diligence engagements according to permissions and the applicable data-sharing authorization. Acceptance of an invitation does not itself constitute submission of the completed diligence response. Information submitted by a Company may be made available to the requesting venture firm and its authorized users in the applicable engagement; before submission or activation, limited document or integration names and request metadata may be visible where supported, without disclosing the underlying contents. Contributors receive access only to the workspace and purpose for which they are invited, subject to applicable permissions and confidentiality obligations.

7.2 Service Providers and Subprocessors

We disclose information to service providers that help us operate the Service, including cloud hosting and storage, transactional email, integration middleware, payment processing, identity or banking verification, analytics, model and search processing, operational logging, and other infrastructure. These providers process information for the functions they perform for Lunaseed and are subject to contractual, platform, or provider terms appropriate to their role. These providers include AWS for Amazon Bedrock AI processing.

7.3 Third-Party Services You Choose to Connect

When you connect or use a third-party service, information may flow between Lunaseed and that provider as necessary to perform the requested function. The third party’s own terms, permissions, and privacy practices also apply. You should connect only accounts and information that you are authorized to use for the applicable purpose.

7.4 Legal, Safety, and Corporate Transactions

We may disclose information when reasonably necessary to comply with law or legal process; protect rights, safety, or security; investigate fraud or abuse; enforce agreements; or respond to an emergency. We may also disclose information in connection with a financing, merger, acquisition, reorganization, bankruptcy, sale of assets, or similar corporate transaction, subject to appropriate confidentiality protections.

7.5 At Your Direction or With Authorization

We may disclose information when you or the relevant organization directs or authorizes us to do so, including through invitations, submissions, integration connections, exports, verification requests, or other platform actions.

8.1 Engagement-Specific Authorization

A Company’s authorization to share diligence information is specific to the requesting venture firm and engagement. Accepting an invitation establishes or approves the engagement, but is separate from submitting the diligence response and does not by itself grant the requesting firm access to the underlying submitted-data contents. Accepting an invitation from one venture firm does not authorize sharing with another venture firm. A new requesting firm requires a separate Diligence Data Sharing Authorization.

8.2 Follow-Up Requests and Sensitive Actions

Follow-up requests within the same engagement may be handled under the existing engagement authorization, subject to the scope of that authorization. Each new integration connection or refresh is a separate Company-directed action under the applicable Integration Data Access Authorization, and founder verification or other sensitive actions may require separate individual disclosures and consent before processing or disclosure.

8.3 Access Changes and Prior Copies

Removing a user or ending future access does not retroactively erase information that an authorized recipient lawfully accessed, downloaded, exported, or retained before access ended. A venture firm or other recipient may also have independent legal or contractual obligations concerning records it has received.

8.4 Administrators and Workspace Records

Organization administrators may manage user access and permissions. Work created in an organization workspace may remain part of the organization’s records after an individual user is removed, subject to applicable agreements, retention practices, and privacy rights.

9.1 Essential and Authentication Technologies

We use cookies and similar technologies that are necessary to authenticate users, maintain sessions, remember security-related settings, and operate the Service. Disabling these technologies may prevent parts of the Service from functioning.

9.2 Analytics

We use Google Analytics to help us understand traffic, usage, and product performance. Google Analytics may collect device, browser, usage, and similar information through cookies or related technologies. We use analytics for measurement and product improvement and do not currently use marketing pixels or session-recording tools.

9.3 Do Not Track and Universal Opt-Out Signals

Some browsers offer a legacy "Do Not Track" (DNT) setting. Because there is no uniform industry standard for DNT, Lunaseed does not currently respond to DNT headers as a separate control. Where applicable law requires recognition of a legally valid universal opt-out preference signal, we will honor that signal for processing activities to which the signal legally applies. Because Lunaseed does not currently sell personal information or use it for cross-context behavioral advertising, such a signal does not change those practices today.

9.4 Third-Party Collection

Third-party analytics or other service providers may collect information through technologies they operate on or through our Service. Their handling of information may also be governed by their own privacy policies and contractual roles. See the Lunaseed Cookie Policy for additional information about cookies and controls.

10.1 Active Accounts and Engagements

Lunaseed retains customer and diligence information while the relevant account, organization, or engagement is active and for as long as reasonably necessary to provide the Service, maintain source-linked records, satisfy contractual obligations, and support security, billing, audit, and legal requirements.

10.2 Valid Deletion Requests

Following a valid deletion request, Lunaseed will remove the applicable customer data from active production systems, including relevant PostgreSQL records, S3 files, integration snapshots, MongoDB archive copies, and other active production stores, within 30 days, except for limited records that must be retained for legal, billing, security, fraud-prevention, dispute, or audit purposes to the extent required or permitted by applicable law. Where appropriate, this period may also provide a limited opportunity to export or recover information before deletion is completed, without extending the 30-day deletion period or any shorter period required by applicable law.

10.3 Termination Without a Deletion Request

After termination of an account or customer relationship, Lunaseed provides a 30-day export or recovery period, subject to applicable legal and security restrictions. After that period, Lunaseed will delete customer content from active systems within 90 days after termination, subject to limited legal, billing, security, dispute, and audit retention requirements to the extent required or permitted by applicable law. A valid deletion request is handled under Section 10.2 and is not extended by this termination schedule.

10.4 Backups

Lunaseed maintains encrypted rolling backups for 35 days, after which they automatically expire or are overwritten. Information deleted from active systems may remain in backups only until the applicable backup expires. Lunaseed does not ordinarily perform surgical deletion from rolling or immutable backups; however, restored backup data remains subject to the applicable deletion restrictions and must not be restored into active use except as necessary for recovery, security, or legal obligations.

10.5 Retention by Data Type

10.6 De-identified Data

Lunaseed may retain information that has been aggregated or de-identified so that it is not reasonably capable of identifying a person, Company, venture firm, or other organization. Lunaseed will not attempt to re-identify De-identified Data except as permitted by law to test or maintain the effectiveness of de-identification processes.

12.1 Account Information

You may update certain account and profile information through the Service. Organization administrators may also manage certain organization-level profile, role, and access information.

12.2 Privacy Requests

You may contact privacy@lunaseed.io to request access to, correction of, deletion of, or a copy of personal information associated with you. We may need to verify your identity and, where relevant, your authority to act for an organization or another individual before completing a request. Legal, security, contractual, and record-retention exceptions may apply.

12.3 Organization-Controlled Information

If your request concerns information that Lunaseed processes on behalf of a venture firm, Company, or other organization, we may refer the request to that organization or process it according to the organization’s instructions, as required by applicable law and contract.

12.4 Marketing Communications

If you receive optional marketing communications from Lunaseed, you may opt out using the unsubscribe mechanism in the message or by contacting us. You may continue to receive non-marketing communications that are necessary for your account, diligence engagements, security, billing, legal notices, or the operation of the Service.

13.1 Categories Collected and Disclosed for Business Purposes

During the preceding 12 months, Lunaseed may have collected the categories below and disclosed them to service providers, contractors, authorized engagement participants, or connected services for the business purposes described in this Policy. The categories actually processed depend on the features used.

13.2 Sale, Sharing, and Targeted Advertising

Lunaseed does not sell personal information. Lunaseed does not currently share personal information for cross-context behavioral advertising or use personal information for targeted advertising. We do not currently use marketing pixels. If these practices change, we will update this Policy and provide any legally required opt-out controls before or when the changed practice begins.

13.3 Sensitive Personal Information

To the extent Lunaseed processes sensitive personal information, we use it only as reasonably necessary to provide and secure requested features, perform identity, banking, or founder verification, prevent fraud, comply with law, or for other purposes permitted by applicable law. Lunaseed does not use sensitive personal information to infer characteristics about individuals for advertising purposes.

13.4 Exercising State Privacy Rights

To exercise an applicable state privacy right, email privacy@lunaseed.io with enough information for us to understand and verify the request. We may ask for information reasonably necessary to verify identity, residency, authority, or account relationship. We will respond within the period required by applicable law. If applicable law gives you a right to appeal a decision, you may submit an appeal by replying to our response or emailing privacy@lunaseed.io with the subject line "Privacy Appeal."

13.5 Authorized Agents

Where permitted by law, an authorized agent may submit a request on your behalf. We may require evidence that the agent has authority to act for you and may also verify your identity directly, unless the law provides otherwise.

13.6 No Financial Incentives for Personal Information

Lunaseed does not currently offer a financial incentive, price difference, or loyalty program in exchange for the collection, sale, or sharing of personal information.

13.7 Minors

The Service is intended for users who are at least 18 years old. Lunaseed does not knowingly sell or share the personal information of individuals under 16 and does not knowingly permit children under 18 to create accounts.

13.8 California Direct-Marketing Disclosure

Lunaseed does not disclose personal information to third parties for those third parties’ own direct-marketing purposes in the manner contemplated by California’s "Shine the Light" law.