Privacy Policy

1. Scope

This policy explains what Govy Inc. (“Govy”) collects, why, and your choices. It covers the Govy website and the application at app.govy.tech. For most workspace content, the customer company is the data controller and Govy is a processor acting on its instructions.

2. What we collect

• Account data: your email, display name, hashed authentication credentials, and the company workspaces and roles you belong to.
• Workspace content you enter: cap-table records, stakeholders and their contact details, fundraising instruments, board and shareholder resolutions, documents, and the append-only event log of these actions.
• Usage & engagement: data-room access is logged per recipient (opens, documents viewed, and time per page) so companies can see investor engagement. Basic technical logs (IP, timestamps, error traces) are kept for security and reliability.
• We do not sell personal data, and we do not use your workspace content to train AI models.

3. Why we process it

To provide and secure the Service, authenticate you, send transactional email (sign-in links, signature and approval requests, board and data-room notifications), process subscriptions, prevent abuse, and comply with law. Our legal bases include performance of our contract with you, our legitimate interest in operating a secure service, and consent where required.

4. Sub-processors

We share data only with vendors that help us run the Service, under contractual data-protection terms:

• Supabase — database, authentication, and file storage (hosted in the EU, Frankfurt region).
• Vercel — application and website hosting / content delivery.
• Resend — transactional email delivery.
• Google Drive — where a workspace connects it, data-room files stay in the company's own Drive; Govy streams them on demand and stores no copy.
• Lemon Squeezy — merchant of record for subscription payments; card details are handled by them, not stored by Govy.

5. Where data lives & how long

Primary data is stored in the EU (Supabase, Frankfurt). We retain workspace data for as long as the workspace exists. When a workspace or account is deleted from within the product, its data is removed from the live database; residual copies in encrypted backups age out on the backup rotation schedule. One record is kept intentionally after deletion: the hashed company email domain, solely to enforce the one-free-trial rule — never used for marketing.

6. Your rights

Depending on where you live (including under GDPR and similar laws), you may have rights to access, correct, export, or delete your personal data, and to object to or restrict certain processing. You can export a workspace's full ledger and delete your account or workspace directly in the product. For other requests, contact privacy@govy.tech; where Govy is a processor, we will route requests to the relevant company controller.

7. Security

Access to workspace data is enforced by row-level security scoped to your company; roles further limit who can write sensitive records. Connections are encrypted in transit, stored secrets (such as Google refresh tokens) are encrypted at rest, and administrative access is limited and logged. No system is perfectly secure; we will notify affected customers of a material breach as required by law.

8. Cookies

The app uses only essential storage needed to keep you signed in and remember your active workspace and theme. If we introduce analytics or marketing cookies, we will present a consent choice first.

9. Children

The Service is for businesses and is not directed to anyone under 18.

10. Changes & contact

We will post changes here and, for material changes, give notice by email or in-product. Questions or requests: privacy@govy.tech · Govy Inc.