Privacy

Olnest (“we”) runs finvestoros.com. This notice covers the website and the Olnest app. It also covers their forms: the contact form, the in-app issue report, and interest forms such as the one for Olnest tools for firms.

• Your account. You sign in with Google, which shares your name, email address and profile picture with us.
• Your portfolio. The holdings, trades, cash balances, goals and notes you add. Also what you import: CSV files, PDF statements and broker emails you forward to your Olnest address.
• What you write. Your profile, posts and messages, any fund you make public, and your conversations with Oli, the in-app AI assistant.
• Room messages, checked before they’re posted. Every message you post in a chat room is checked automatically first, by our own code and by an AI model that Anthropic runs for us (section 06), which receives the message’s text. A message that passes is posted and kept like your other messages. A message that is refused is not posted, and we don’t store it. If the check can’t run, nothing is posted and nothing is kept.
• What you send us. The contact form takes your email address and message. The in-app issue report takes a subject and message. An interest form takes what you enter, such as your name, work email, firm and the licence you hold. Licences are self-reported; we don’t verify them.
• Payments. If you subscribe or buy something, we keep a record of what you bought and your Stripe customer reference. Your card details go to Stripe, never to us. If you pay an agency’s invoice, we keep what was paid, when and by whom. If you run an agency, we keep its Stripe account ID, whether Stripe’s identity check passed, and its payout bank’s name and last four digits. Stripe holds the documents and the full bank details, never us. For each of an agency’s clients, we keep when the client’s first quote became a project, because the referral fee the agency pays us applies to the quotes that client accepts in the 24 months after it.
• Tools you connect, if you’re a founder. Install our read-only app on Stripe and we read your active subscriptions, their prices and coupons. We keep your Stripe account ID, the app’s read-only token (encrypted) and the monthly revenue we work out, never your Stripe secret key. Connect Notion and we read the pages you share with us, and keep links to the ones you add to your data room. Add a Slack webhook and we keep its address, encrypted. Connect LinkedIn and LinkedIn tells us your LinkedIn member ID, your name, your email address and whether it is verified, a link to your profile photo and your language setting. We keep only the ID, the name and the date you connected it, and your investor profile shows the same link. A meeting scheduled on an introduction keeps its time, length and video link, and both of you can see it. Its Add to Google Calendar button opens Google Calendar in your own browser with the meeting filled in.
• Checks you ask for, if you’re an investor. An ID check runs in Stripe Identity: you show Stripe a photo ID and a selfie, and Stripe tells us whether they match and the first and last name on the ID. We keep that result and that name, never the images or the ID number. Link LinkedIn and LinkedIn tells us your LinkedIn member ID, your name, your email address and whether it is verified, a link to your profile photo and your language setting. We keep only the ID, the name and the date you linked it. For a track-record check we keep the links you send us and the team’s decision and note. A reference a founder gives you keeps their line and the date, and shows on your card until they withdraw it.
• Who viewed whom, between startups and investors. When you open a startup as an investor, or open an investor’s profile beside their introduction request as a founder, we record that you did, on which day and from which page. That startup’s team, or that investor, sees it in Insights. How much they see depends on their plan: from only that someone looked, up to your name, your photo and what your investor profile or your startup says about you, and, for a startup’s team, which of its data room files you opened. Turn on Browse privately in Settings and they see only that someone looked, and on which day. Insights shows the last 90 days; the records go when your account does.
• Messages and files between startups and agencies. When your startup and an agency message each other, we keep the messages, encrypted, and the files either side attaches, in private storage that opens only through short-lived links. Your startup’s team and the agency’s team can read them. When someone on your startup first opens a quote from an agency, we record when, and the agency sees the quote marked “Viewed”.
• Projects, approvals and reviews. When your startup works with an agency through Olnest, we keep the project: its scope, value, dates and milestones, who on your team approved each milestone or asked for changes and when, and who confirmed the project was done. To confirm it happened, the agency can send our team a document about the project, which only our team and the agency can open. You can then review the agency. You choose whether a review shows your name; if you don’t, it is shown without your name or the project’s name, and dated by its month, never its day. The agency’s notification of such a review comes in a daily update, not the moment you post it. If the agency has worked with only a few founders on Olnest, we warn you before you post that it may be able to tell the review is yours. An agency can name your startup in its case studies only if your startup agrees, and you can withdraw that. An agency can have an AI note written from these.
• Technical data. Cookies that keep you signed in, and your IP address, which we count for a short time to stop abuse such as form spam. Our hosting providers also keep standard server logs.
• How the site is used — only if you agree. We ask, the first time you visit, whether we may use Google Analytics to count visits and see which pages get read. If you decline, or simply never answer, nothing is loaded and nothing is sent. If you accept, it sets its own cookies, named _ga, to tell one visit from the next, and it tells Google which pages you opened, roughly where you are, and what browser and device you used. It never receives your holdings, your messages or anything you type into the app. Change your mind later and we delete those cookies — section 07.

• To run Olnest for you: sign you in, import and show your portfolio, and answer what you ask the AI.
• To take payment when you subscribe or buy something.
• To reply when you contact us or register interest.
• To keep Olnest secure and working, such as stopping abuse and fixing faults.
• To improve the product, by counting which pages get read and which do not — if you agreed to that.

We never sell your data. Agencies can pay for Sponsored placements that founders see in Olnest. Which one you see depends on your startup’s stage, sector and city, never your holdings or messages. We record which Sponsored placements you saw, clicked or asked a quote from; agencies see only totals. Google Analytics is the one measurement tool we use, it runs only with your agreement, and it is there to count pages, not to build a profile of you.

• Your account. We keep your data while your account exists. Delete your account and we delete your profile, portfolio, posts, messages and AI conversations from our database.
• Work with an agency. A startup’s conversations with agencies belong to the startup, not to one person on it. When the startup’s owner deletes their account, the startup goes, and its conversations with agencies and their files go with it. The agency keeps its quotes, its invoices and what was paid on them, and the projects you ran together, with their milestones, approvals and files, as its business records, but no longer linked to your account or your startup. A review is deleted when the person who wrote it deletes their account.
• Form messages. We keep messages you send through a form for as long as we need them to reply and follow up. Ask us and we will delete them.
• Payments. If you paid for anything, Stripe keeps the payment records the law requires.
• Protection. Your data sits in an access-controlled database with row-level security, so one account cannot read another’s holdings. We also encrypt direct messages when we store them, and the webhook addresses and access keys of tools founders connect. All traffic uses HTTPS.

These are the providers that handle your data, and what each one does:

• Supabase — stores your account and portfolio data, and manages sign-in.
• Vercel — runs the website and app servers.
• Google — provides Sign in with Google and hosts our support inbox. With your consent, it also runs Google Analytics, which receives the pages you visit. The site’s fonts are served from our own website.
• Anthropic — runs the AI features. When you import a statement, forward a broker email, ask Oli a question or post in a chat room, we send that content to Anthropic to process. It can include your holdings. When an agency you work with asks for an AI note in its workspace, we send Anthropic the records that note is written from: your first name, your startup’s name, your projects with that agency, what you paid it and when, and any review you left it. When an agency asks Oli, Anthropic receives up to five of the newest requests founders shared with agencies in its field: what was needed, when, and the startup’s stage and city.
• Stripe — handles payments and subscriptions, and runs the ID check an investor can ask for (Stripe Identity). When a founder pays an agency’s invoice in Olnest, Stripe takes that payment for the agency. Stripe also runs the identity check an agency’s owner passes before the agency can be paid.
• ElevenLabs — runs the voice call in Pitch practice. It hears your voice to turn it into text and speaks the AI investor’s replies. It keeps the call’s transcript for 30 days and does not record the audio.
• Cloudflare — receives the broker emails you forward to your Olnest address and passes them to us.
• GitHub — keeps a copy of each founder’s startup workspace in a private repository our team uses to run the accelerator, updated every three hours. If you use Olnest as a founder, the copy holds your name and handle, your answers and score, the profile investors see, your evidence claims and our review of them, your pitch practice scores, your plan, your round summary, and when investors saved you or asked for an introduction. It never holds your email address, your evidence files or who those investors are. Delete your account and the next update removes your copy. Earlier versions stay in the repository’s history until we erase them, which we do if you ask.

Market-data providers only see the ticker symbols and similar codes we look up — never who asked. Other Olnest members can see your profile and what you post or send them. Your portfolio stays private unless you make a fund public. Even then, members see only its allocation percentages — never amounts, cost basis or net worth.

We don’t sell your data. Agencies that advertise see only totals (how many founders saw, clicked or asked for a quote), never who you are. We don’t give your data to data brokers or brokerages. We disclose it to anyone else only when the law requires it, or when a founder asks us to: a founder who connects a Slack channel has us post there when an investor asks them for an introduction or to see their data room. The post names the investor and the startup and links to Olnest, and nothing more. When you pay an agency’s invoice, you pay that agency through Stripe, so the agency sees the payment and the receipt email you type there, as any business you pay does. In Olnest it also sees the first name of whoever on your team paid.

• See or correct your data. Most of it you can view and edit in the app. For a copy of your data, or a change you can’t make yourself, email finvestoros@gmail.com or use Settings → Account → Report an issue.
• Delete your account. Settings → Account → Delete my account removes your account and its data straight away. You can also ask us to do it by email.
• Change your cookie choice. Whatever you answered when you first arrived, you can answer again — the same two buttons, as easy to decline as to accept. Declining stops Google Analytics immediately and deletes the cookies it set, so nothing of it is left on your device.Change your cookie choice
• Turn it off everywhere. Google publishes a browser add-on that stops Google Analytics measuring you on any site, including this one: tools.google.com/dlpage/gaoptout. Blocking cookies or using a tracker-blocking browser has the same effect. Nothing about Olnest stops working if you do.

Questions about this notice or your data? Email finvestoros@gmail.com, or use Settings → Account inside the app.

Data protection officer. Our data protection officer is responsible for how we handle personal data. They deal with requests to see, correct or delete it, and with privacy complaints. Email them at finvestoros@gmail.com with “Data protection” in the subject.