Legal — Terms, Privacy & DPA

Part 1 — Terms of Service

These Terms of Service ("Terms") govern your access to and use of the Persephone investor intelligence platform (the "Service") provided by Persephone ("Persephone," "we," "us"). By creating an account, subscribing, or otherwise using the Service, you agree to these Terms.

1. The Service

Persephone is a software-as-a-service platform that provides information and analytics to assist founders in identifying and engaging with investment funds. Features may include investor matching, fund and thesis analysis, outreach drafting tools, and related capabilities.

2. Nature of the Service — important

3. Eligibility and accounts

You must be at least 18 years old and have authority to bind the entity (if any) on whose behalf you use the Service. You agree to provide accurate registration information and to keep your credentials confidential. You are responsible for activity under your account.

4. Subscription, fees, and renewal

Paid subscriptions are billed in advance on a monthly or annual basis as selected at checkout. Fees are non-refundable except as required by law or expressly stated. Subscriptions renew automatically unless cancelled before the renewal date. You can cancel at any time from your account settings; cancellation takes effect at the end of the current billing period. We may change pricing on notice; changes apply from the next renewal.

5. Right of withdrawal (consumers in the EU/UK)

Where you are a consumer (acting outside your trade or business) resident in the EU or UK, you have a 14-day right of withdrawal from the date of subscription. By starting to use the Service before the end of this period, you expressly request immediate performance and acknowledge that you will lose your right of withdrawal once the Service has been fully performed. See Part 4 for the full acknowledgement. Most users of Persephone act in a business capacity and the right of withdrawal does not apply to them.

6. User content and conduct

You retain ownership of content you submit ("User Content"). You grant Persephone a worldwide, non-exclusive, royalty-free licence to host, process, transmit, and display User Content as necessary to provide the Service.

You shall not, and shall not permit any third party to:

• Use the Service in violation of any law, including data protection, anti-spam (CAN-SPAM, CASL, EU/UK e-privacy), or securities law;
• Send unsolicited or unlawful communications using the Service or content generated by it;
• Resell, sublicense, or redistribute the Service or its outputs except as expressly permitted;
• Reverse engineer, scrape, or extract data from the Service except as permitted by mandatory law;
• Misrepresent your identity or your startup;
• Upload content infringing the rights of any third party.

7. Outreach features

8. Third-party services and data

The Service incorporates data licensed from third-party providers, including Crunchbase and Apollo, and may integrate with other third-party services at your option (e.g., LinkedIn, your email provider). Your use of those services is governed by their respective terms. Persephone is not responsible for third-party services or the accuracy, completeness, or timeliness of third-party data.

9. Intellectual property

The Service, including all software, designs, models, and content (excluding User Content and licensed third-party data), is owned by Persephone or its licensors. We grant you a limited, non-exclusive, non-transferable, revocable licence to use the Service in accordance with these Terms.

10. Privacy and data protection

Our processing of personal data is described in Part 2 — Privacy Policy. Where you process personal data through the Service as a controller, the Data Processing Addendum (Part 3) applies and is incorporated by reference.

11. Disclaimers

To the maximum extent permitted by law, the Service is provided "as is" and "as available," without warranties of any kind, express, implied, or statutory, including warranties of merchantability, fitness for a particular purpose, non-infringement, accuracy, or uninterrupted operation. Persephone does not warrant that data is accurate, complete, or current, or that you will achieve any particular fundraising outcome.

12. Limitation of liability

To the maximum extent permitted by law:

• Persephone shall not be liable for any indirect, incidental, special, consequential, exemplary, or punitive damages, or for lost profits, lost fundraising opportunities, lost revenue, lost data, or reputational harm, whether in contract, tort, or otherwise, even if advised of the possibility of such damages;
• Persephone's total aggregate liability shall not exceed the fees paid by you to Persephone in the twelve (12) months immediately preceding the event giving rise to the claim, or one hundred euros (€100), whichever is greater.

Nothing in these Terms limits liability that cannot be excluded under applicable law (e.g., for fraud, gross negligence, or death and personal injury caused by negligence).

13. Indemnification

You agree to indemnify and hold harmless Persephone and its affiliates, officers, and employees from any claims, damages, liabilities, and expenses (including reasonable legal fees) arising out of: (a) your use of the Service in violation of these Terms or applicable law; (b) outreach communications you send using or based on the Service; or (c) User Content you submit.

14. Term and termination

These Terms apply for as long as you use the Service. You may terminate your account at any time. We may suspend or terminate your access for material breach, non-payment, or where required by law, with reasonable notice except in cases of misuse or legal necessity. Sections that by their nature should survive termination (including Sections 9, 11–13, and 16) survive.

15. Changes

We may update these Terms from time to time. Material changes will be notified by email or in-app at least 30 days in advance, except where changes are required for legal or security reasons. Continued use after the effective date constitutes acceptance.

16. Governing law and disputes

These Terms are governed by the laws of Italy, excluding conflict-of-laws rules. Disputes are subject to the exclusive jurisdiction of the courts of Milan, Italy, except that consumers retain the protection of the mandatory laws of their country of residence.

17. Miscellaneous

These Terms, together with the Privacy Policy and DPA included in this document, constitute the entire agreement between the parties regarding the Service. If any provision is held unenforceable, the remainder shall remain in effect. No waiver is effective unless in writing. You may not assign these Terms without our consent; we may assign in connection with a corporate transaction.

18. Contact

Persephone. Email: legal@seedpersephone.com.

Part 2 — Privacy Policy

1. Who we are

Persephone ("we," "us," "our") operates the investor intelligence platform at seedpersephone.com (the "Service"). For privacy queries: privacy@seedpersephone.com.

2. Scope

• Visitors to our website;
• Founders and other users who register for the Service ("Users");
• Investors, fund partners, and other professionals whose information appears in the Service as a result of our enrichment processing ("Investor Data Subjects").

3. Personal data we process

3.1 User account data

When you register, we collect: name, business email, company name, role, password (hashed), billing details, and information you voluntarily provide about your startup (sector, stage, traction).

3.2 User-generated content

Information you upload or generate using the Service: target lists, draft outreach, notes, engagement records.

3.3 Connected accounts (LinkedIn, email)

If you connect a third-party account (e.g., LinkedIn, your email provider) via official authentication (OAuth), we access only data made available through that authenticated session, on your instruction, to provide the requested service. We do not scrape these platforms.

3.4 Investor enrichment data

• Fund-level data: name, location, investment thesis, sector and stage focus, portfolio companies, fund size, recent activity.
• Professional contact information: name, role, employer, business email, professional biography, links to publicly published content.

3.5 Usage and technical data

Log data, IP address, device and browser information, cookies, and analytics events.

4. Where we get this data

• From you directly, when you register and use the Service;
• From licensed third-party data providers — specifically Crunchbase and Apollo — under their commercial terms and data protection arrangements;
• From publicly published content authored by or about investment funds;
• From you, where you connect third-party accounts.

We do not scrape LinkedIn or any other platform in violation of that platform's terms of service.

5. Why we process it (and our legal basis)

5.1 Providing the Service

Legal basis: performance of a contract (Article 6(1)(b) GDPR).

5.2 Investor enrichment and matching

Legal basis: legitimate interests (Article 6(1)(f) GDPR). Our legitimate interest is to operate an investor intelligence service that helps founders identify funds whose stated thesis aligns with their startup. We have assessed that this interest is not overridden by the rights of investment professionals because the data concerns individuals in their professional capacity, is sourced from licensed providers and public professional disclosures, processing is limited to fund- and role-related context, we do not generate persistent psychological profiles of named individuals, and any data subject may exercise the rights set out in Section 9.

5.3 Communications with Users

Legal basis: performance of a contract and legitimate interests.

5.4 Marketing

Legal basis: consent or legitimate interests, depending on jurisdiction. You can opt out at any time.

5.5 Legal compliance

Legal basis: compliance with legal obligation (Article 6(1)(c)).

6. Who we share it with

• Sub-processors supporting our infrastructure: hosting, database, email, payments (Stripe), analytics, AI providers. Current list available on request.
• Our licensed data providers (Crunchbase, Apollo) where requests must be routed upstream;
• Professional advisors (lawyers, accountants);
• Authorities where required by law;
• Successors in connection with a corporate transaction.

We do not sell personal data.

7. International transfers

Personal data may be transferred to and processed outside the EEA or UK, including the United States. Where we do, we rely on appropriate safeguards under Articles 44–49 GDPR, including European Commission Standard Contractual Clauses and the UK International Data Transfer Addendum where applicable.

8. How long we keep it

• User account data: for the duration of your account and 12 months thereafter;
• User-generated content: deleted within 30 days of account closure;
• Investor enrichment data: refreshed continuously; individual records removed on request;
• Billing and tax records: 10 years as required by tax law;
• Logs: 12 months.

9. Your rights

Subject to applicable law, you can:

• Access the data we hold about you;
• Request correction;
• Request erasure ("right to be forgotten");
• Restrict processing;
• Object to processing based on legitimate interests, including profiling;
• Receive your data in a portable format;
• Withdraw consent (where processing is based on consent);
• Lodge a complaint with your supervisory authority.

To exercise any right: privacy@seedpersephone.com or use our opt-out form.

10. Security

We use appropriate technical and organisational measures: encryption in transit, access controls, vendor due diligence, incident response procedures.

11. Children

The Service is not directed to anyone under 18 and we do not knowingly collect their data.

12. Changes

We may update this Policy. Material changes will be notified by email or in-app.

13. Contact and supervisory authority

Privacy contact: privacy@seedpersephone.com
Lead supervisory authority: Garante per la protezione dei dati personali (Italy).

Part 3 — Data Processing Addendum

1. Definitions

Capitalised terms not defined here have the meanings in the Terms or in the GDPR. "GDPR" means Regulation (EU) 2016/679; "UK GDPR" means the GDPR as incorporated into UK law; "Data Protection Laws" means the GDPR, UK GDPR, and any other applicable data protection laws.

2. Roles of the parties

For the processing described in Annex 1, Customer acts as Controller and Persephone acts as Processor. Each party complies with its obligations under Data Protection Laws.

This DPA does not address Persephone's processing of personal data as a Controller in its own right (such as processing of investor enrichment data sourced from licensed providers), which is addressed in Part 2 — Privacy Policy.

3. Processing instructions

Persephone processes Customer Personal Data only on documented instructions from the Customer (including the Terms and this DPA), except where required by applicable law. Persephone informs the Customer if, in its opinion, an instruction infringes Data Protection Laws.

4. Confidentiality

Persephone ensures personnel authorised to process Customer Personal Data are bound by appropriate confidentiality obligations.

5. Security measures

Persephone implements appropriate technical and organisational measures (Annex 2) to ensure a level of security appropriate to the risk.

6. Sub-processors

Customer grants Persephone a general authorisation to engage sub-processors. A current list (Annex 3) is available on request. Persephone:

• Imposes data protection obligations on each sub-processor materially equivalent to those in this DPA;
• Remains liable to the Customer for the acts and omissions of its sub-processors;
• Notifies the Customer of any intended addition or replacement at least 30 days in advance, allowing reasonable objection.

7. Data subject rights

Persephone assists the Customer, by appropriate technical and organisational measures and insofar as possible, in fulfilling its obligation to respond to data subject requests.

8. Personal data breach

Persephone notifies the Customer without undue delay (and within 72 hours) after becoming aware of a Personal Data Breach affecting Customer Personal Data, providing reasonable information to enable the Customer to meet its obligations under Articles 33–34 GDPR.

9. Data Protection Impact Assessments

Persephone provides reasonable assistance with data protection impact assessments and prior consultations with supervisory authorities required under Articles 35–36 GDPR.

10. International transfers

Where Persephone or its sub-processors transfer Customer Personal Data outside the EEA or UK, the parties rely on the European Commission Standard Contractual Clauses (Module 2 or 3 as applicable), and the UK International Data Transfer Addendum where applicable, incorporated by reference.

11. Audit

Persephone makes available all information reasonably necessary to demonstrate compliance with this DPA. Customer may, no more than once per year and on at least 30 days' written notice, conduct an audit (or appoint a qualified independent auditor), subject to reasonable confidentiality and security restrictions. Persephone may satisfy this obligation by providing third-party audit reports (e.g., SOC 2, ISO 27001) where available.

12. Return or deletion

Upon termination or expiry of the Terms, Persephone, at the Customer's choice, deletes or returns all Customer Personal Data, unless retention is required by applicable law.

13. Liability

Liability under this DPA is subject to the limitations of liability in the Terms.

14. Order of precedence

In case of conflict between this DPA and the Terms, this DPA prevails on data protection matters.

Annex 1 — Description of processing

Subject matter: provision of the Persephone investor intelligence platform.
Duration: for the term of the Terms.
Nature and purpose: hosting, processing, and analysis of Customer-provided data and Customer-connected third-party account data to deliver the Service.
Categories of data subjects: Customer's personnel; investors and contacts identified by the Customer; the Customer's network connections accessed via Customer-authorised integrations.
Categories of personal data: names, business contact details, professional information, communication content drafted or sent through the Service, engagement data.

Annex 2 — Technical and organisational measures

Persephone implements measures including: encryption of data in transit (TLS) and at rest; role-based access controls; least-privilege principle; logging and monitoring; vendor due diligence and contractual safeguards; secure development practices; incident response procedures; periodic review of measures.

Annex 3 — Sub-processors

Current sub-processors include: Supabase (database & hosting), Stripe (payments), Lovable AI Gateway (AI), Instantly.ai (email outreach), PostHog (analytics). Updated list available on request.

Part 4 — EU/UK Immediate-Performance Acknowledgement

This acknowledgement applies to subscribers who qualify as consumers (acting outside their trade, business, craft or profession) and are resident in the European Union or the United Kingdom. Most Persephone users act in a business capacity and the statutory right of withdrawal does not apply to them; this section is included for completeness and to satisfy the information requirements of EU Directive 2011/83/EU and the UK Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013.

4.1 Statutory right of withdrawal

As a consumer, you normally have a period of fourteen (14) days from the conclusion of the subscription contract during which you may withdraw without giving any reason and without incurring any costs other than those provided for in Article 14(3) of Directive 2011/83/EU.

4.2 Express request for immediate performance

Persephone is a digital service that begins to be supplied immediately upon subscription. By ticking the consent box at checkout and starting to use the Service before the end of the 14-day withdrawal period, you:

• Expressly request that Persephone begins performance of the subscription contract immediately, during the withdrawal period; and
• Acknowledge that you will lose your right of withdrawal once the Service has been fully performed, in accordance with Article 16(a) and Article 16(m) of Directive 2011/83/EU and the equivalent UK regulations.

4.3 What this means in practice

• Your subscription, account, and access to the Service are activated immediately upon successful payment.
• To the extent the Service has been performed (e.g., access has been provided, scans have been generated, outreach drafts have been produced), the corresponding portion of the fee is non-refundable.
• You may still cancel future renewals at any time from your account settings; cancellation takes effect at the end of the current billing period.
• Statutory consumer rights that cannot be excluded by contract under your local law (including remedies for non-conformity of digital content under Directive (EU) 2019/770) are not affected.

4.4 Record of consent

Persephone records the date and time at which you accepted these terms and gave the immediate-performance acknowledgement, together with the version of each document in force at that moment, for audit and compliance purposes.

4.5 Contact

Questions about this acknowledgement or your withdrawal rights: legal@seedpersephone.com.