Privacy policy

1. Who we are

New Summer Inc., 3F, Navi Shibuya V, 5-5 Maruyama-cho, Shibuya City, Tokyo, Japan, is the data controller for our website and for the account data of our customers. For the business data a customer stores in its Investryx workspace (companies, contacts, deals, funds, LP records, documents), the customer is the controller and New Summer acts as its processor under our terms of service and, where required, a data processing addendum.

Privacy requests and our Personal Information Protection Manager can be reached at info@investryxai.com or through the contact form at investryxai.com/contact.

2. What we collect

We collect the following categories of personal data.

• Account data: name, work email, job title, workspace and firm name, language preference, authentication identifiers (an internal user id) and, for password sign-in, a salted password hash we never see in clear text.
• Workspace data entered by customers: companies, people and their contact details, interactions and notes, deals, portfolio positions, fund and LP records, capital calls and distributions, documents and reports. This may include personal data of third parties (founders, investors, advisors) that our customers are responsible for lawfully collecting.
• LP portal data: the LP contact’s name, email and language as entered by the fund manager; sign-in events; and an access log of which report documents were viewed or downloaded and when. Downloads of PDF documents are stamped with the downloader’s email and the date. Fund managers disclose this to their investors, and the portal footer states that access is recorded for the fund’s records.
• Enrichment data: publicly available information about companies (website, headquarters, founding year, team size, funding, news, hiring, open-source activity) that we retrieve on request from public sources and AI services. Each field is stored with its source and a confidence level.
• Google Contacts (only if a team member connects their own Google account): names, email addresses, companies, job titles, phone numbers, LinkedIn URLs and contact labels of the people the member selects on a review screen before anything is imported. We request read-only access to contacts; imported people become part of that customer’s shared workspace data, the member can disconnect at any time, and disconnecting revokes our access at Google.
• Google Calendar events (only if a member includes read-only calendar access in their Google connection): the time, title and attendees of events in the member’s own calendar from the last four months and the next month, read only when the member opens the calendar picker on a company record, and stored only for the event they choose to log as a meeting (its identifier, title, time and matched attendees); never descriptions, attachments or other calendars. We do not request access to email (Gmail) in any form.
• Billing data: plan, billing cycle and subscription status; card brand and last four digits, billing address and invoices, processed by our payment provider, Stripe; full card numbers never reach our servers.
• Usage and technical data: IP address, browser and device information, pages visited on our website, and product event logs needed to operate, secure and improve the Service.
• Communications: emails you send us, support requests, and forms submitted on our website.

3. How we use personal data

We use personal data to:

• provide, operate and secure the Service, including authentication by magic link, password or single sign-on;
• run the features you or your fund manager choose to use: enrichment, signals, AI-drafted memos and letters, the agent co-pilot, LP reporting and the LP portal;
• send transactional email: sign-in links, invitations, report notifications, reminders, KPI requests and billing notices;
• bill subscriptions through Stripe and prevent fraud and abuse;
• measure and improve our website and product (see “Cookies and analytics”);
• respond to support and sales enquiries;
• comply with law, enforce our terms and protect our rights and those of our customers.

4. AI processing

Enrichment, research, memo drafting, manager letters, notification drafts and the agent co-pilot are produced with large language models run by an enterprise AI provider inside our own cloud environment. Prompts contain only the workspace data needed for the task. We do not use customer data to train models, and our AI subprocessors are contractually prohibited from doing so. AI output is always labelled, carries a source and confidence where applicable, and remains editable by a human. Nothing produced by AI is sent to investors without a person publishing it.

Google user data and AI (Limited Use). Information we receive from Google APIs — contacts a member imports from Google Contacts and calendar events a member reads or logs through Google Calendar — is never used to develop, improve or train generalised AI or machine-learning models, whether raw, aggregated or derived, and is never transferred to any third-party AI service. The only AI processing in the Service is Google Cloud Vertex AI (Gemini models) running inside our own Google Cloud project under the Google Cloud Data Processing Addendum, which prohibits Google from using our data to train its models; we use no AI aggregators, gateways, model hubs or self-hosted models. Google-derived data reaches that model only when a member explicitly asks for a feature that needs it (for example drafting an intro to an imported contact, or enriching a company created from a contact’s business domain), and only the fields that feature needs.

Documents you upload for term extraction (for example a fund’s limited partnership agreement to prefill the fund’s terms, or an investment’s closing documents — share purchase agreement, SAFE, note, cap table — to prefill the investment’s terms) are processed the same way: read once by Vertex AI inside our own project, never stored, never logged and never used for training; only the values you confirm are saved.

Documents attached in the agent chat are handled differently because the action they belong to is completed afterwards: a PDF you attach is read by Vertex AI inside our own project, kept in your workspace’s private storage for up to 24 hours — readable only by the member who attached it — so the dialog you open from the agent’s card can read it, and then deleted automatically. If you ask the agent to file a document under a company, it is stored with that company’s files like any other upload and the temporary copy is removed. Attached documents are never used for training.

5. Legal bases

Where the GDPR, the UK GDPR or similar laws apply, we rely on: performance of a contract (providing the Service to our customers and their teams); our legitimate interests (securing and improving the Service, preventing abuse, responding to enquiries), balanced against your rights; consent (marketing communications and non-essential cookies, where required); and legal obligations (tax, accounting, responding to lawful requests). Where the Act on the Protection of Personal Information of Japan (APPI) applies, we handle personal information for the purposes stated in this policy and obtain consent where the APPI requires it.

6. Sharing and subprocessors

We do not sell personal data. We share it only with the service providers below, with our customers’ own teams and invited LPs as directed by the customer, with professional advisers, and where the law requires.

• Cloud infrastructure provider (United States): hosting, database, file storage, authentication and AI model processing. Production data is stored in the United States.
• Stripe, Inc.: subscription billing and card payment processing. Stripe collects and stores card numbers under PCI DSS; we receive only the card brand and last four digits, shown in Settings → Billing.
• Transactional email delivery provider (United States): sign-in links, invitations, notifications and reminders.
• Google Analytics 4 (Google LLC): website analytics with IP anonymisation.
• Public data sources and APIs used for enrichment and signals (for example public code repositories, company websites and public filings): we send company identifiers such as a domain name, never personal data about our customers’ contacts.
• Google LLC (Google People API and Google Calendar API), only for members who connect their Google account: we read the contacts the member authorises and, if the member includes calendar access, the events in their own calendar for the window described in section 2; we send nothing about other people in the workspace to Google. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

7. International transfers

New Summer is established in Japan and hosts production data in the United States. Where personal data originating in the EEA, the UK or Switzerland is transferred to countries without an adequacy decision, we rely on the European Commission’s Standard Contractual Clauses or an equivalent mechanism with our subprocessors. Transfers between Japan and the EEA/UK benefit from the mutual adequacy decisions. Customers outside these regions consent to the transfers described here by using the Service.

8. Retention

Account and workspace data is retained for as long as the customer’s workspace exists and for up to 90 days after termination, after which it is deleted or anonymised unless the law requires longer retention. Billing records are kept for the period required by tax and accounting law (seven years in Japan). LP portal access logs are part of the customer’s fund records and follow the workspace retention. Website analytics data is retained for 14 months. Backups are rotated within 35 days.

Google user data. OAuth tokens for a member’s Google connection are stored encrypted and are deleted when the member disconnects in Settings → Integrations (which also revokes our access at Google), when the member is deactivated, or when the workspace is deleted. Contacts the member imported stay in the workspace as ordinary contact records until a member deletes them or the workspace is deleted. Calendar events are not retained beyond the request that displays them, except the single event a member logs as a meeting, which is kept as part of that company’s interaction history under the workspace retention above.

9. Security

Data is encrypted in transit (TLS) and at rest. Each customer’s data is isolated by workspace; access rules and the API enforce that no user can read another firm’s data. Sign-in uses one-time links or passwords with modern hashing; SSO is available on the Institutional plan. Every write made through the agent or by a team member is recorded in an activity feed. Our staff access production data only to operate the Service or on a customer’s request, and such access is logged. No system is perfectly secure; if we learn of a breach affecting your personal data we will notify affected customers and regulators as the law requires.

10. Your rights

We handle personal data in line with Japan’s Act on the Protection of Personal Information (APPI), the EU General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA) and other laws that apply where you live, consistent with the corporate privacy policy of New Summer Inc. Depending on where you live, you may have the right to access, correct, delete or export your personal data, to restrict or object to processing, and to withdraw consent. If you are an LP or a founder whose data was entered by a fund manager, please contact that fund manager first; we will assist them. Requests to us can be sent to info@investryxai.com (Personal Information Protection Manager). You may also lodge a complaint with your local supervisory authority or, in Japan, with the Personal Information Protection Commission.

11. Cookies and analytics

The Service uses strictly necessary cookies and local storage to keep you signed in and remember preferences such as language. Our website uses Google Analytics 4 with IP anonymisation to understand how visitors use it; you can opt out with the Google Analytics opt-out browser add-on or by blocking analytics cookies in your browser. We do not use advertising cookies.

12. Children

The Service is intended for professional use by adults. We do not knowingly collect personal data from children under 16.

13. Changes to this policy

We will post any changes on this page and update the effective date. Material changes will be announced to customers by email or in the product before they take effect.

14. Contact

New Summer Inc. · 3F, Navi Shibuya V, 5-5 Maruyama-cho, Shibuya City, Tokyo, Japan · info@investryxai.com (Personal Information Protection Manager) or the contact form at investryxai.com/contact