Privacy Policy

1. Data controller

Doctor Funding is operated by NEW EGI, S.L., with registered address at Calle Consell de Cent 472, Entresuelo 2, 08013 Barcelona, Spain (CIF: B-67915678).

For any privacy-related inquiries, you can reach us at privacy@doctor-funding.com.

2. Data we collect

We collect personal data depending on how you interact with Doctor Funding:

When you register via our website

• Name, email address, and phone number
• IP address (for rate limiting and security)
• reCAPTCHA token (sent to Google for bot protection)

During WhatsApp onboarding (startups)

• Company information: name, description, website, sector, legal structure, year created, employee count
• Financial data: funding stage, amount sought, turnover, growth metrics, runway, burn rate
• Documents: pitch deck, business plan
• Founder information: LinkedIn URL, professional experience

During WhatsApp onboarding (industry experts)

• Professional profile: LinkedIn URL, CV summary
• Investment preferences: sectors, stages, ticket size
• Mentorship history and interests
• Documents: CV, portfolio

Automatically collected data

• WhatsApp messages exchanged during onboarding and support
• Interaction data with our AI assistant

3. Legal basis for processing

We process your personal data on the following legal grounds under the GDPR:

• Consent (Art. 6(1)(a)) — when you submit our registration form and accept this privacy policy
• Contract performance (Art. 6(1)(b)) — to provide our matchmaking and introduction services
• Legitimate interest (Art. 6(1)(f)) — to improve our platform, prevent fraud, and ensure security
• Legal obligation (Art. 6(1)(c)) — to comply with applicable laws and regulations

4. How we use your data

We use your personal data to:

• Onboard you through our AI-assisted WhatsApp conversations
• Match startups with relevant industry experts
• Facilitate introductions between matched parties
• Communicate with you about your account and our services
• Process payments and manage billing
• Improve the quality and relevance of our matching
• Comply with legal obligations

5. Third-party processors

We share your data with the following third-party services, strictly for the purposes described below. We do not sell your personal data.

6. Data storage and security

Your data is stored on Google Cloud Platform infrastructure located in the European Union. We implement appropriate technical and organizational measures to protect your personal data, including encryption in transit and at rest, access controls, and regular security assessments.

7. Data retention

We retain your personal data for as long as necessary to provide our services. Specific retention periods:

• Account data — retained while your account is active and for up to 5 years after closure for legal and financial record-keeping
• WhatsApp conversations — automatically closed after 7 days of inactivity
• LinkedIn profile cache — automatically expires after 90 days
• Authentication data — OTP challenges and sessions are automatically cleaned up on expiry

When data is deleted, it is permanently removed from our systems (hard delete). We do not use soft-delete mechanisms.

8. Your rights under the GDPR

Under the General Data Protection Regulation (GDPR), you have the following rights:

• Right of access (Art. 15) — request a copy of the personal data we hold about you
• Right to rectification (Art. 16) — request correction of inaccurate or incomplete data
• Right to erasure (Art. 17) — request deletion of your personal data ("right to be forgotten")
• Right to restrict processing (Art. 18) — request that we limit the processing of your data
• Right to data portability (Art. 20) — receive your data in a structured, machine-readable format
• Right to object (Art. 21) — object to processing based on legitimate interest
• Rights related to automated decision-making (Art. 22) — our AI assistant supports the onboarding process but does not make decisions that produce legal or similarly significant effects on you

9. How to exercise your rights

To exercise any of your rights, contact us at privacy@doctor-funding.com. We will respond to your request within 30 days. If we need more time, we will inform you of the extension and the reasons for it.

You also have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es) if you believe your data protection rights have been violated.

10. Cookies and tracking

Doctor Funding uses minimal cookies:

• Authentication cookie — an HttpOnly, secure cookie used to maintain your login session. This is a strictly necessary cookie and does not track your activity.
• reCAPTCHA cookies — Google reCAPTCHA v3 may set cookies to distinguish humans from bots when you submit our registration form. See Google's Privacy Policy for details.

We do not use advertising, analytics, or tracking cookies.

11. International data transfers

Our primary data storage is on Google Cloud Platform within the European Union. However, some of our third-party processors (Meta, Tavily) may process data in the United States. Where data is transferred outside the EU/EEA, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission, or reliance on the EU-US Data Privacy Framework where applicable.

12. Children's privacy

Doctor Funding is not intended for individuals under the age of 16. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us at privacy@doctor-funding.com and we will promptly delete it.

13. Changes to this policy

We may update this privacy policy from time to time. We will notify you of significant changes by email or through a notice on our website. The "Last updated" date at the top of this page indicates when the policy was last revised.

14. Contact information

If you have questions about this privacy policy or our data practices, contact us at: