Skip to main content

Privacy & Data Protection Policy

Last updated July 26, 2026Version 2.2 (BETA)14 min read

1. Introduction

1.1 This Policy explains how Aventro Ltd., an Israeli company with its registered office at Yigal Yadin 1/5, Ra'anana, Israel ("Aventro Ltd.", "we", "us"), collects, uses, shares, and protects personal data in connection with the Aventro platform (the "Service").

1.2 Our role. For personal data of our account holders and website visitors, Aventro Ltd. is the controller. For personal data that a business customer uploads and processes through the Service about its own data subjects, Aventro Ltd. generally acts as a processor on that customer's behalf, and our Data Processing Agreement applies.

1.3 Who this covers. This Policy applies to (a) Users of the Service, (b) visitors to our websites, and (c) third-party individuals described in the Service who did not themselves register — for example founders, executives, team members, and competitors named in an analyst-sourced or user-submitted company profile. Section 4 explains the basis for processing that third-party data and the rights those individuals have.

1.4 Because our Users are global, this Policy addresses the EU/EEA GDPR, the UK GDPR, Israel's Protection of Privacy Law (including Amendment 13), and the California Consumer Privacy Act (CCPA/CPRA). Region-specific rights are in Section 8.

2. Information We Collect

2.1 Information you provide

  • Account information — name, email, password, role, and organization details.
  • Profile information — professional background, avatar, and, if you choose to connect it, professional-profile data (for example via LinkedIn).
  • Deal and evidence data — company intake information across areas such as company, product, market, competition, traction, monetization, unit economics, customer data, team, IP, fundraising, and risk; and uploaded evidence such as financial statements, cap tables, pitch decks, contracts, and resumes. Some of this is business-confidential and may include material non-public information (MNPI).
  • Communications — messages, collaboration-room content, tasks, and support requests.
  • Billing information — where paid plans are offered, billing details processed by our payment processor (we do not store full card numbers).

2.2 Information about third parties that Users submit or we derive

When you or an Analyst create or analyze a company profile, the Service may collect and generate personal data about individuals other than you — such as a company's founders, executives, team members, inventors, or competitors' executives — including names, roles, professional history, education, public profile links, and inferences drawn from public sources. See Section 4.

2.3 Information collected automatically

  • Usage and device data — interactions with the Service, browser/device information, and approximate location derived from IP address.
  • Analytics and session data — where you consent, product-analytics events and session recordings (see the Cookie Policy). These are off by default and only run after you opt in.
  • Security and audit logs — records of security-relevant actions (for example visibility changes, shares, exports).

2.4 Information from third-party and public sources

To verify claims, the Service queries public and third-party sources, which may return personal data. These include patent registers (USPTO, EPO/Espacenet), securities filings (SEC EDGAR), corporate registries (for example OpenCorporates), professional and code profiles (for example LinkedIn where connected, GitHub), research sources (for example Semantic Scholar), and domain records. A current list is in the Subprocessors & data sources page.

2.5 Google Drive imports

When you choose files through the Google Drive Picker, Aventro requests the drive.file permission, which permits access only to the specific files you select or open with the Service. We download a copy of each selected file to import and process it as evidence for due diligence. We do not use this permission to browse or access other files in your Google Drive, and we do not retain Google OAuth refresh tokens for this feature. Imported files are used, stored, shared, and deleted as Deal and evidence data under this Policy, including Sections 3, 5, and 6; deleting an imported copy from Aventro does not delete the original file from Google Drive. Our use and transfer of information received from Google APIs complies with the Google API Services User Data Policy, including its Limited Use requirements.

3. How We Use Your Information

We use personal data to:

  • provide, operate, secure, and support the Service, including intake, analysis, scoring, verification, reports, collaboration, and sharing;
  • generate AI Output (analysis, scores, flags, narratives, projections) as decision-support;
  • verify company and individual claims against public and third-party sources;
  • communicate with you about the Service (see Section 11);
  • process payments where paid plans are offered;
  • prevent fraud, abuse, and security incidents, and comply with law;
  • with your consent, measure and improve the Service using product analytics.

3.1 AI training — what we do not do. We do not use one customer's or organization's Content to train or improve AI models for another customer, and we do not authorize our AI providers to use your Content to train their general-purpose models. We may use aggregated or de-identified data (which does not identify you or any individual) to evaluate and improve the Service. We do not sell personal data.

4.1 Legal bases (GDPR / UK GDPR / PPL). We rely on: performance of a contract (to provide the Service to you); legitimate interests (to operate, secure, and improve the Service, and to provide due-diligence tooling); consent (for optional analytics/session recording and marketing communications); and legal obligation (to comply with law).

4.2 Processing of third-party data subjects. Where the Service processes personal data about individuals who did not register (Section 2.2), we rely on our and our Users' legitimate interests in providing and using business due-diligence tooling, balanced against those individuals' rights. We have assessed this balance (a legitimate-interests assessment) and apply safeguards, including:

  • Transparency — this Policy and, for analyst-sourced profiles, an on-profile notice identifying the profile as analyst-created and unverified.
  • Notice at collection from other sources — consistent with GDPR Article 14 and equivalent PPL requirements, we make this Policy available describing the sources, purposes, and rights.
  • Data minimization on public views — where an unclaimed analyst-sourced profile is shared publicly, we minimize the public view and exclude certain personal data and conclusions until the profile is claimed or verified.
  • Objection and removal — any individual or company can request notice, access, correction, objection, or removal via privacy@aventro.ai or the "Request removal / dispute this profile" link on a public profile. We will review and, absent an overriding legitimate ground, honor such requests.

4.3 Especially sensitive data (PPL Amendment 13). Where we process data that Israeli law treats as "especially sensitive" (for example financial details), we apply heightened safeguards and process it only as needed to provide the Service.

5. Data Sharing and Disclosure

5.1 Subprocessors. We share personal data with vendors that process it on our behalf to run the Service, under contractual data-protection terms. Current subprocessors include our AI provider (OpenAI), cloud and database hosting (Supabase, Vercel), background analysis compute (Render), off-platform backup storage (Cloudflare), transactional email (Resend), web-search retrieval (Exa), and — only where you consent — product analytics and error/session monitoring (PostHog, Sentry). The full, current list with purposes and regions is at Subprocessors & data sources.

5.2 Other Users. Content is shared with other Users as the Service requires — for example collaborators on a Deal, members of your Organization with appropriate permissions, and recipients of reports you choose to share.

5.3 Public and private sharing. If a Deal owner enables sharing, a report may be shared privately with named recipients or via a public, unauthenticated link accessible to anyone with the URL. Public links carry no-index directives but can be viewed and copied by anyone who has them. You control whether to enable sharing.

5.4 Platform operators (Admins). A limited number of Aventro Ltd. operators have audited, elevated access used to operate, support, and secure the Service.

5.5 Legal and business transfers. We may disclose data to comply with law or lawful requests, to enforce our terms, to protect rights and safety, or in connection with a merger, acquisition, or asset sale (subject to this Policy).

5.6 We do not sell personal data, and we do not share confidential Deal information for others' marketing.

6. Data Retention

6.1 We retain personal data for as long as needed to provide the Service and for legitimate business, legal, and security purposes. Indicative periods:

  • Account data — for the life of the account; deleted or de-identified within 90 days of account closure, subject to legal-hold and record-keeping requirements.
  • Deal and evidence data — for the life of the Deal; on deletion, removed or de-identified within 30 days, except where retention is required (for example anti-fraud or legal obligations).
  • Analytics/session data — retained per the Cookie Policy.
  • Security and audit logs — retained for 12 months for security and compliance.

6.2 When you delete your account, we delete associated Content and stored files, subject to the exceptions above.

7. Automated Decision-Making and AI

7.1 The Service uses AI and automated processing to generate scores, flags, and reports. These are decision-support: they are intended to inform, not to make, decisions, and a human reviews material decisions.

7.2 We do not use the Service to make decisions that produce legal or similarly significant effects on an individual solely by automated means without human involvement. Where GDPR Article 22 applies, you may request human review of, express your view on, and contest an automated decision.

7.3 Consistent with the EU AI Act's transparency requirements, we label AI-generated content and AI interactions within the Service.

7.4 California ADMT. Where California's automated-decision-making rules apply to us, we will provide the required pre-use notice and honor access/opt-out rights.

8. Your Rights

Depending on where you live, you may have rights to access, correct, delete, port, restrict, or object to processing of your personal data, and to withdraw consent.

8.1 EU/EEA & UK (GDPR / UK GDPR). Access; rectification; erasure ("right to be forgotten"); restriction; portability; objection (including to legitimate-interests processing and direct marketing); and rights regarding automated decisions. You may lodge a complaint with your supervisory authority (EU) or the ICO (UK).

8.2 Israel (PPL). Rights to inspect, correct, and delete personal data held about you, and to object; you may contact the Israeli Privacy Protection Authority.

8.3 California (CCPA/CPRA). Rights to know, access, delete, correct, and opt out of "sale"/"sharing" (we do not sell or share for cross-context behavioral advertising), and to limit use of sensitive personal information; you will not be discriminated against for exercising these rights.

8.4 How to exercise. Email privacy@aventro.ai or use in-Service controls (data export in Settings; account deletion). We respond within the timeframe required by applicable law (generally within 30–45 days). We may need to verify your identity.

9. Security Measures

9.1 We use technical and organizational measures appropriate to the risk, including: encryption in transit (TLS); encryption at rest for sensitive evidence categories (for example financials, cap tables, and IP) using per-Deal derived keys; role-based access control and row-level security; segregation of data by organization; audit logging of security-relevant actions; and vendor due diligence.

9.2 Our infrastructure providers maintain independent security certifications (for example SOC 2 and/or ISO 27001). Aventro Ltd. itself is not represented as holding those certifications unless separately stated.

9.3 No method of transmission or storage is completely secure; we cannot guarantee absolute security.

10. International Data Transfers

10.1 Aventro Ltd. is based in Israel, which the European Commission recognizes as providing an adequate level of data protection (a recognition reaffirmed in 2024). Transfers of personal data from the EEA to Aventro Ltd. may therefore rely on that adequacy recognition.

10.2 Some subprocessors are located outside Israel/the EEA (for example in the United States). Where we transfer personal data internationally to such subprocessors, we use an appropriate transfer mechanism, such as the EU Standard Contractual Clauses (and the UK Addendum), together with supplementary measures where needed.

11. Electronic Communications

We communicate with you electronically as described in the Terms. Service communications (account, security, transactional, and legal notices) are required while your account is active; marketing communications are optional and you can opt out at any time.

12. Children's Privacy

The Service is intended for business use by adults and is not directed to children under 18 (or the applicable age of majority). We do not knowingly collect personal data from children. If you believe a child has provided data, contact us and we will delete it.

13. Updates to This Policy

We may update this Policy. If a change is material, we will provide notice before it takes effect. The "Effective" date above shows the latest version.

14. Contact Us

Controller: Aventro Ltd. — operator of the Aventro platform Yigal Yadin 1/5, Ra'anana, Israel Privacy and data-protection enquiries, and to exercise your rights: privacy@aventro.ai

Questions about this document? Contact us at legal@aventro.ai