Privacy policy.

The controller of your personal data is Venture List. Contact: hi@venturelist.app. We have not appointed a data protection officer; write to the same address for any privacy question.

• Your account. When you create an account we store your email address, when the account was created, and each sign-in session with the IP address and browser name it came from. We use them to sign you in and to keep your launch plan. Legal basis: the agreement between you and us when you create the account (Art. 6(1)(b) GDPR).
• Sign-in links. There is no password. To sign in, we email you a one-time link that works for 15 minutes; the token behind it is stored until it is used or expires. Legal basis: Art. 6(1)(b) GDPR.
• Your launch plan. The places you add, the state of each one (planned, submitted, live), the dates of those changes, the listing URL and the note you type, and when you last opened the plan (for “since your last visit”). Legal basis: Art. 6(1)(b) GDPR.
• The welcome email. Once, when your account is created from the “full list” form: the download link for the Excel file. Legal basis: Art. 6(1)(b) GDPR.
• The monthly email about changes. Only if you switch it on: the box on the account form (recorded once the sign-in link has proven the address) or the switch on your account or launch page. We store the time, the version of the wording you agreed to and the form you used. Legal basis: your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time with the switch on your account page or the unsubscribe link in every email; this does not affect emails sent before.
• Limits against abuse. To stop someone from flooding an inbox with sign-in links, we allow a few links per address every 10 minutes and per IP address per minute. For this we keep a keyed hash of the address and of the IP address (not the address itself) for up to a day. Raw IP addresses are never written to the database for this. Legal basis: our legitimate interest in preventing abuse (Art. 6(1)(f) GDPR).
• Reports about a place. When you use “report a problem”, we store the place, the kind of problem and your note. We ask for no email address; please do not put personal data in the note. The note stays in our database only: it is never published or copied into the public data files of the list. Legal basis: our legitimate interest in keeping the list correct (Art. 6(1)(f) GDPR).
• Cookieless analytics. Vercel Web Analytics and our own daily counts of page views and of clicks on links to listed places. No cookies and no tracking across sites. To count a click only once a day, we store a hash of your IP address and browser name mixed with a secret that changes every day; we delete it the next day. Legal basis: our legitimate interest in knowing which pages and places are useful (Art. 6(1)(f) GDPR).
• Google Analytics. We use Google Analytics 4 to see which pages and places help founders. It collects page views, events such as a click on a link to a listed place, your approximate location (worked out from your IP address), and your device and browser. It sets cookies that hold a random id (section 8). We do not send it your email address or your account id, it stays off on a page opened from a personal link in one of our emails, and its advertising features (Google signals, ad personalization) are switched off. In the EEA, the UK and Switzerland, and when we cannot tell where you are, it loads only after you press “Accept”. Legal basis: your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time under “Cookie settings” at the bottom of every page; this does not affect what was collected before. Everywhere else, Google Analytics loads when you open the site, and you can switch it off under “Cookie settings”.
• Bot protection. When it is switched on, Cloudflare Turnstile checks that a person, not a bot, sends the account form and the problem report. Legal basis: our legitimate interest in keeping the forms free of abuse (Art. 6(1)(f) GDPR).

You can object at any time to processing based on legitimate interest by writing to us.

We use these processors. They act only on our instructions:

• Mailjet: sends the emails (sign-in links, the welcome email, the monthly email).
• Vercel: hosts the site and provides the cookieless Web Analytics.
• Google Ireland Limited: provides Google Analytics, with Google LLC (USA) as its sub-processor. Only while Google Analytics is on for you.
• Turso: hosts the database with your account, your sessions, your launch plan and the consent record.
• Cloudflare Turnstile: the bot check on the forms, only when it is switched on.

We do not sell your data and we do not share it for advertising.

Some processors are based in the United States. Transfers to them rely on the European Commission’s Standard Contractual Clauses (SCCs).

Google Analytics data can reach Google LLC in the United States. That transfer relies on the EU-US Data Privacy Framework and on standard contractual clauses.

• Your account and launch plan: until you delete the account. “Delete my account” on the account page removes the account, the plan, the sessions and the consent record at once; there is no waiting period and no backup copy we keep on purpose.
• Sessions: 30 days after the last use, or when you sign out. Expired sessions and used or expired sign-in tokens are purged by a daily job.
• The keyed hashes for the sign-in limits and the click counts: deleted the next day.
• If you asked for the list by email before accounts existed and never created an account: unless you confirmed the monthly email, a daily job deletes your email address 30 days after the last list email we sent you (or 30 days after you filled in the form, if the email never went out), and also from Mailjet’s contact list. If you confirmed it: until you unsubscribe, then the same 30-day rule applies. When you create an account with the same address, your monthly-email choice moves to the account and the old signup stops getting emails.
• Our own page and click counts: counts per page and per day, kept for about 13 months (400 days). Page-view ids and click hashes are deleted after a day or two. We never store raw IP addresses for analytics.
• Google Analytics: Google keeps the data for up to 14 months.
• Reports about a place: until we have dealt with them.

You have the right to access your data, to have it corrected or deleted, to restrict its processing, to receive it in a portable format, to object to processing based on legitimate interest, and to withdraw your consent at any time. Two of these you can do yourself on the account page: “Download my data” gives you everything we store about you as a JSON file, and “Delete my account” deletes it. For anything else, write to hi@venturelist.app.

You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU country where you live, work or where you think the problem happened.

Only if you want the full list. The guides, the first places of each room and the summary of each check work without an account. An account is needed for the rest of the list, each place’s page, the lines of the changelog, the data files, the Excel file and the launch plan. We make no automated decisions about you.

The site sets these cookies:

• vl.session_token (prefixed __Secure- on https, so __Secure-vl.session_token), only after you sign in. It keeps you signed in, with a short-lived signed copy of your session, vl.session_data (same prefix), so we do not read the database on every page. Signing out or deleting your account on one device can take up to five minutes to reach other devices. It is strictly necessary for the service you asked for, so it needs no consent; it is deleted when you sign out or after 30 days.
• vl.consent, when you press “Accept” or “No thanks”. It remembers your choice about Google Analytics for 180 days, so we do not ask on every page. It holds one word (granted or denied) and is strictly necessary to respect that choice.
• _ga and _ga_<id>, set by Google Analytics and only while Google Analytics is on for you. They hold a random id that tells one browser from another and last up to 2 years. “No thanks” deletes them.

There are no advertising cookies. If you only read the site, signed out and with Google Analytics off, the only cookie it sets is the one that remembers your choice. Change the choice any time: Cookie settings (also at the bottom of every page).

Your browser’s local storage holds small preferences (for example the poster or list view, or that you hid the launch bar for this visit). This data stays on your device.

When this policy changes, we update this page and the date at the top.