This Privacy Policy explains how Origo (“Origo,” “we,” “us,” or “our”), the company that builds and operates the SuperInvestors brand and product, collects, uses, shares, and protects personal data in connection with the SuperInvestors website, applications, investor database, CRM, AI tools, and related services (collectively, the “Service”). It should be read together with our Terms of Use and Cookie Policy.

1. Introduction, Scope & Who We Are

Origo builds and operates SuperInvestors, an AI-first fundraising platform for founders that includes a database of 90,000+ investors, a Kanban CRM pipeline, saved lists, CSV/XLSX export, and AI tools that run on a credit system. For the purposes of the EU/UK General Data Protection Regulation (GDPR), Origo is the “controller” of the personal data described in this Policy.

This Policy distinguishes between two categories of personal data, because we treat them differently:

• (a) Account / customer data — information about you as a user or customer of the Service.
• (b) Investor database data — third-party personal data about investors that we compile from public records and make searchable within the Service.

2. Information We Collect

Information you provide (account / customer data)

• Account & profile: name, email address, password, company or organization name, and role.
• Billing metadata: plan, subscription or Lifetime Deal status, and limited payment metadata (such as the last four digits of a card, billing country, and transaction identifiers) received from our payment processor, Creem. We do not store your full payment-card number; Creem handles card data directly.
• User content: CRM notes, saved lists, pipeline data, and materials you submit to AI features (for example, pitch decks, draft emails, and prompts).
• Support & communications: messages you send us, and your participation in our affiliate, giveaway, or referral programs.

Information collected automatically

When you use the Service we automatically collect device and log data (IP address, browser type, pages viewed, timestamps), usage and analytics data, and information from cookies and similar technologies. For details and choices, see our Cookie Policy.

Investor database data

The investor records in the Service are compiled from public records and third-party sources, including filings with the U.S. Securities and Exchange Commission (such as Form 13F and Forms 3 and 4) and other public or licensed third-party sources. This data may include an investor’s name, firm, role, professional contact details, investment focus, and similar professional information. We process this public-record data and make it searchable so founders can identify and research potential investors. We rely on our legitimate interest (and the public nature of the underlying records) as the lawful basis for this processing, as described in Section 5.

3. How We Use Information

• To provide, operate, and maintain the Service and your account;
• To power AI features (such as Lead Scoring and Email Suggestions) and to administer the credit system;
• To process payments, manage subscriptions and the Lifetime Deal, and administer affiliate, giveaway, and referral programs;
• To provide customer support and respond to your requests;
• To send service and, where permitted, marketing communications (see Section 14);
• To monitor, prevent, and investigate fraud, abuse, scraping, and other violations of our Terms of Use, and to secure and improve the Service;
• To comply with legal obligations and enforce our agreements.

4. AI Processing & Training

Origo does not develop, train, or operate its own AI models; our AI features are powered by third-party AI model providers, and we may select or change the underlying model or provider based on the requirements of a given feature. When you use an AI feature, the inputs you provide (for example, a pitch deck, an email draft, or a prompt) and relevant context are sent to these third-party AI model providers, acting as our sub-processors, to generate the output you requested. We process these inputs only to provide the feature to you.

We do not use your content, prompts, or AI inputs and outputs to train third-party AI models, and we instruct our AI sub-processors not to use your data to train their models. Our AI sub-processors currently include large-language-model providers engaged under data-processing terms that prohibit training on your data. We may use aggregated or de-identified data that does not identify you to monitor and improve the quality of our features. A current list of sub-processors is available on request (see Section 16).

5. Legal Bases for Processing (GDPR)

Where the GDPR applies, we rely on the following legal bases under Article 6:

• Contract — to provide the Service you have signed up for, including account management, AI features, and billing.
• Consent — for certain marketing communications and non-essential cookies, which you may withdraw at any time.
• Legitimate interests — to secure and improve the Service, prevent fraud and abuse, and, importantly, to compile and make searchable the public-record investor data described in Section 2. We consider this proportionate because the data originates from public regulatory filings and other public sources and relates to individuals acting in a professional, investment capacity. You can object to this processing as described in Sections 7 and 8.
• Legal obligation — where processing is necessary to comply with applicable law.

6. How We Share Information

We do not sell your account data. We share personal data only with service providers (sub-processors) acting on our behalf and as otherwise described below:

• Payments: Creem, our payment processor, to handle subscriptions and the Lifetime Deal;
• Hosting & infrastructure: cloud hosting and database providers that store and run the Service;
• Analytics: analytics and product-usage providers;
• Email & communications: email delivery and support tooling;
• AI providers: the AI model sub-processors described in Section 4.

We may also disclose data to comply with law, enforce our Terms of Use, protect our rights and users, or in connection with a merger, acquisition, or sale of assets. A current list of our sub-processors is available on request via the contact in Section 16.

7. Your Privacy Rights

EEA/UK (GDPR). Subject to applicable law, you have the right to access, rectify, erase, restrict, and port your personal data, to object to processing based on legitimate interests, and to withdraw consent. You also have the right to lodge a complaint with your local supervisory authority.

California (CCPA/CPRA). Subject to applicable law, California residents have the right to know what personal information we collect and how it is used, to request deletion, to correct inaccurate information, and to opt out of any “sale” or “sharing” of personal information. We do not sell or share account data in the sense those terms are used under the CPRA, and we will not discriminate against you for exercising your rights.

To exercise any of these rights, contact us using Section 16. We may need to verify your identity before responding.

8. Investors: Access & Removal Requests

If you are an investor whose information appears in our database and you would like to access, correct, or request removal of that information, email us at privacy@superinvestors.app with enough detail for us to locate your record (for example, your name and firm). We will process verified requests in accordance with applicable law. Because some of this information derives from public regulatory filings that remain publicly available at their source, removal from our database does not remove it from those underlying public records.

9. Data Retention

We retain account and customer data for as long as your account is active and as needed to provide the Service, then for a limited period afterward to comply with legal, tax, accounting, and fraud-prevention obligations and to resolve disputes. Investor database data is retained for as long as it remains relevant to the Service and is updated or removed as sources change or upon a valid request. When data is no longer needed, we delete or de-identify it.

10. International Data Transfers

We and our sub-processors may process personal data in countries other than your own, including the United States. Where we transfer personal data out of the EEA or UK, we use appropriate safeguards, such as the European Commission’s Standard Contractual Clauses (SCCs) and equivalent UK mechanisms, together with additional measures where required.

11. Security Measures

We use organizational and technical measures designed to protect personal data, including encryption in transit, access controls, and least-privilege practices. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If we become aware of a breach affecting your personal data, we will notify you and the relevant authorities where required by law.

12. Cookies & Tracking

We use cookies and similar technologies for essential functionality, performance, and analytics. For details about the cookies we use and how to manage them, see our Cookie Policy.

13. Children’s Privacy

The Service is intended for users who are at least 18 years old. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us personal data, contact us and we will delete it.

14. Marketing Communications & Opt-Out

With your consent or as otherwise permitted by law, we may send you marketing emails about the Service. You can opt out at any time using the unsubscribe link in those emails or by contacting us. We will still send you essential service and transactional messages (for example, billing and security notices).

15. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last Updated” date above and, where appropriate, provide additional notice. Your continued use of the Service after changes take effect constitutes acceptance of the revised Policy.

16. Contact & Data Protection

For privacy questions, to exercise your rights, or to reach our data protection contact, email us at privacy@superinvestors.app. This Privacy Policy is governed by the laws of India, and disputes are handled as described in our Terms of Use.

Origo