Privacy Policy

1. Controller

Patrick Jaritz (EmployedByAI)
Breitenfurter Straße 376, 1230 Vienna, Austria
Email: contact@simvc.app

2. What data we process

• Account data: email address, name, password (hashed).
• Pitch-deck contents: decks and related materials you upload. These may contain confidential business information. By default they remain visible only within your account; a limited share card or blind-screen panel is created only by your explicit action.
• Run data: generated investor cohorts and simulation results (pass reasons, diligence dossier, partner-meeting drill).
• Panel data: if you ask external people for an assessment via an invitation link, we process the free-text label you assign to the invited person and their responses. SimVC does not store an email address for the invited person for this invitation.
• Design-partner requests: if you submit the SimVC Intelligence request form at /for-funds, we process the fund or firm, your role, work email, and any deal you mention, solely to assess your fund for the private validation program and to reply. These are emailed to the SimVC team; they are not shared with founders and never enter the pilot workspace.
• Contact form: if you write to us via /contact, we process your name, email address, the topic you chose and your message solely to answer you. The message is stored and delivered to the SimVC team by email; it is not shared with third parties and never sent to an AI model.
• Payment data: handled via Stripe; full card details are not stored by us.
• Analytics data: pseudonymous usage events (PostHog) to improve the service.
• Technical data: IP address, timestamps, log and error data (Sentry) for security and troubleshooting.

3. Purposes and legal bases

Performance of a contract (Art. 6(1)(b) GDPR) to provide the service; legitimate interest (lit. f) for security, fraud prevention and troubleshooting; your consent (lit. a) for the optional product analytics with PostHog; legal obligation (lit. c) for tax and commercial retention.

4. Processors and third parties

Uploaded pitch-deck contents are transmitted for the simulation to OpenRouter and the model providers set for the respective run — both the extracted text and rendered images of individual slides that are read by machine. New simulation runs request Zero Data Retention from OpenRouter routing and exclude endpoints that collect data; OpenRouter still stores technical metadata such as token count, model, latency and timestamp. A direct technical fallback path is permitted only for OpenAI model routes. Do not submit content you do not want processed externally.

5. Retention period

Account data until the account is deleted; billing data in accordance with statutory retention periods (in Austria generally 7 years); deck and run data until you or your account delete them; contact-form messages until handled and for thirty days after, at most twelve months from receipt (deleting your account removes the personal reference immediately, also from messages you sent while signed out). Deletion removes the data from the active system. Content already transmitted to OpenRouter, OpenAI, Anthropic or Google cannot be retroactively recalled by SimVC from the provider. Database backups may contain deleted rows until their technical retention expires; if a backup is restored, the deletion must be carried out again on the restored data set.

6. Your rights

You have the right to access, rectification, erasure, restriction, data portability and objection, as well as the right to lodge a complaint with the Austrian Data Protection Authority (dsb.gv.at). Contact for requests: contact@simvc.app.

7. Cookies and analytics

We set technically necessary cookies (login/session) without consent; without them, login does not work. For product analytics we use PostHog (EU hosting) — only after your explicit consent via the notice on your first visit. Before this consent, PostHog is not loaded and no analytics cookie is set. What is transmitted are pseudonymous usage events and your account ID — not your email address and not your name. No third-party advertising or marketing cookies are used. You can withdraw your choice at any time by clearing the website data (localStorage) in your browser.

In addition, we use Umami for cookieless traffic measurement. Umami sets no cookies, stores no personal data and builds no cross-device profiles — it records anonymous page views and individual product events (such as a sign-up or a button click). Because no personal data is processed, this requires no consent; Umami runs independently of PostHog and is not governed by the consent notice.