Effective date: 29 October 2026
The controller of personal data processed in connection with the e-ISIN Platform (the “Platform”) is:
e-ISIN Ltd, Company No. 17503394, a company incorporated under the laws of England and Wales
General contact: info@e-isin.com
Data protection contact: info@e-isin.com
Date of incorporation: 6 October 2026
e-ISIN Ltd (“e-ISIN”, “we”, “us”) determines the purposes and means of processing personal data in connection with the operation of the Platform and acts as the data controller.
Users in the European Union may contact e-ISIN directly at the email address above regarding data protection matters.
This Privacy Policy explains how e-ISIN processes the personal data of users of the e-ISIN web and mobile applications, persons acting on behalf of capital recipients, prospective investors, and other persons whose personal data may lawfully be contained in documents or content uploaded to the Platform.
This Privacy Policy applies to functions actually used on the Platform. Functions that are not active in the production version are not treated as ongoing processing merely because technical support for them exists in the system.
Depending on the account type, we may process data provided by the user to create and use an investor profile, configure the profile, participate in surveys, or communicate with a capital recipient.
The Platform maintains an A/B/C “Profile History” indicator. This indicator describes only the history of the profile on the Platform. It is not an assessment of the user’s creditworthiness, quality, experience or regulatory status.
We process data necessary to create and manage an account, create a survey or investment opportunity, communicate, review content and provide ordered services. This may include contact and identification data, company data and information contained in submitted materials.
Documents uploaded to the Platform may contain personal data of persons identified in the documentation, such as the names of directors or other officers, representatives or advisers, or signatures. Uploaded photographs may depict individuals, vehicle registration plates or other identifying elements.
If you use the AI reading of documents (section 7), the full text of the uploaded document – including any personal data of third parties it contains, such as names, signatures, addresses or contact details – is transmitted to our AI provider so that values can be read from it. Personal data in the text of a document is not removed before this transmission. Uploading a document does not by itself start the AI reading; the reading takes place only after you have agreed to the AI functions in the app. Uploaded photographs are checked for anonymity automatically by AI only with your consent (section 7); without it they are reviewed manually by e-ISIN.
A person who provides content to the Platform is responsible for ensuring that they are authorised to provide it and that personal data of third parties is not provided beyond what is necessary for the relevant purpose.
We process the content of messages sent through the Platform, email addresses required to establish direct communication between a capital recipient and a prospective investor, and data contained in communications with user support.
We process technical and audit records necessary for operation, security, account protection, incident handling, recording consents and demonstrating completed operations. The scope of such data is limited to what is necessary for the relevant purpose.
| Purpose | Typical data | Legal basis | Note |
|---|---|---|---|
| Account registration and management | identification, contact, account and authentication data | performance of a contract / steps taken before entering into a contract | registered functions cannot be provided without this data |
| Provision of surveys, investment opportunities and other ordered functions | profile data, content, responses, documents | performance of a contract | processing to the extent necessary to provide the service |
| Direct communication between a capital recipient and a prospective investor | email, message, data necessary to establish contact | performance of a contract; legitimate interests depending on the circumstances | e-ISIN is not a party to any subsequent transaction |
| Security, prevention of misuse and audit | technical logs, audit records, access data | legitimate interests; compliance with a legal obligation where applicable | protection of the Platform and users and evidential integrity of operations |
| Compliance with legal and regulatory obligations | data necessary for the particular obligation | compliance with a legal obligation | scope is determined by applicable law |
| User support | contact data, content of the request, technical data | performance of a contract; legitimate interests | handling requests and technical issues |
| Automatic translation of published surveys and investment opportunities (including an automatic check of the translation) | text of the published content (after its approval and publication by e-ISIN) | performance of a contract (part of the publishing service); legitimate interests in making content available in all Platform languages | no separate AI consent needed – applies only to approved and published content; only through the e-ISIN AI Gateway; transmitted to OpenAI (section 8.3) |
| Alfred chat (answers to your questions about the Platform) | your question, the earlier questions and answers of the same conversation, the screen you are on, your user type and Profile History, Platform rules and price list, and – for a question about a published survey or investment opportunity – its published content, or for a question about your own draft, the data of that draft | your consent to the AI functions (Article 6(1)(a) UK GDPR and, where applicable, EU GDPR); the use of published content as context is part of the publishing service (performance of a contract with the capital recipient) | e-mail addresses, telephone numbers, bank account numbers and personal identification numbers in your question are removed before transmission; answers are checked automatically before they are shown, where needed by a second AI call; transmitted to OpenAI (section 8.3) |
| AI text proposals, hints and checks in the survey and investment-opportunity wizards (titles, section texts, use of capital, field hints, AI check of a draft) | the data of your draft (financial and project data, values you have confirmed from documents, your free text) and the text of the background files you have added to the survey | your consent to the AI functions (Article 6(1)(a) UK GDPR and, where applicable, EU GDPR) | company and project names entered in the form are left out; e-mail addresses, telephone numbers, bank account numbers, ISINs and personal identification numbers are removed from free text; names of persons and addresses in free text or in the text of a file are not removed; results are proposals only and are saved only when you confirm them; transmitted to OpenAI (section 8.3) |
| AI reading of uploaded documents (reading values from PDF, Word, Excel and PowerPoint documents and, for a survey, also from CSV and text files) | the full text of the document, including personal data of third parties contained in it | your consent to the AI functions (Article 6(1)(a) UK GDPR and, where applicable, EU GDPR); for personal data of third parties contained in the document, our legitimate interests and yours in the correct preparation of the content you submit | the text is not redacted before transmission; the values read are proposals that you confirm or change; transmitted to OpenAI (section 8.3) |
| Automatic anonymity check of an uploaded photograph | the uploaded photograph after technical processing | your consent to the AI functions (Article 6(1)(a) UK GDPR and, where applicable, EU GDPR) | without consent the photograph is not transmitted to the AI provider and is reviewed manually by e-ISIN; with consent it is transmitted to OpenAI (section 8.3) solely for this check |
Where consent is required for a particular processing activity, the user will be provided with appropriate information before the processing takes place and will have the opportunity to give or refuse consent. We do not use consent as a universal legal basis where processing is carried out on another legal basis.
The AI functions listed above that are based on consent are used only after you have agreed to them in the app ("I agree" / "Without AI"). Without consent, every field can be completed manually and no content is sent to the AI provider for these functions; uploading a document remains possible. You can withdraw your consent at any time in the app under Settings → AI assistant; withdrawal does not affect the lawfulness of processing carried out before it. A consent given on the registration screens before the account exists is recorded with the account at the first sign-in. Once a survey or investment opportunity has been approved and published by e-ISIN, its published content is part of the publishing service: it is translated automatically into the Platform languages and Alfred may use it as context when answering investors' questions – this does not depend on the AI consent. Drafts, your own inputs, uploaded documents and photographs are sent to the AI provider only with your consent.
Survey responses are non-binding and are used for informational evaluation of the survey. Survey results may be made available to the survey originator to the extent provided by the Platform, including the investor type and Profile History of responding prospective investors.
The A/B/C Profile History is derived from the history of use of the Platform. It is not an automated creditworthiness assessment or a decision that, by itself, produces legal effects concerning the user or similarly significantly affects the user.
Where a prospective investor initiates contact with a capital recipient through the Platform, the Platform may provide the capital recipient with the prospective investor’s message and email address so that the capital recipient can respond. Other contact details of the prospective investor are not automatically disclosed through this function.
Once contact has been established, the capital recipient and the prospective investor may communicate directly. Any further processing of personal data outside the Platform may take place independently in accordance with the legal obligations of the relevant parties.
The Platform may use artificial intelligence support functions referred to as Alfred. All active communication with an external AI provider takes place server-side through the internal e-ISIN AI Gateway; the client application does not communicate directly with the AI provider.
Depending on the functions currently activated, the production version uses the following AI functions, all through the e-ISIN AI Gateway and our AI provider OpenAI (section 8.3):
(a) Alfred chat – answers to questions about the Platform. Transmitted: your question, the earlier turns of the same conversation, the screen you are on, your user type and Profile History, and the Platform rules and price list; for a question about a published survey or investment opportunity, also its published content, and for a question about your own draft, the data of that draft. Before transmission, e-mail addresses, telephone numbers, bank account numbers and personal identification numbers are removed from your question. Answers are checked automatically before they are shown, where needed by a second AI call.
(b) Text proposals, hints and checks in the wizards – proposals of titles and section texts and of the use of capital, hints for individual survey fields and an AI check of a draft investment opportunity. Transmitted: the data of the draft, values you have confirmed from documents, your free text and the text of the background files you have added to a survey. Company and project names entered in the form are left out; e-mail addresses, telephone numbers, bank account numbers, ISINs and personal identification numbers are removed from free text. Names of persons, addresses and company names that appear inside free text or inside the text of a file are not removed.
(c) AI reading of documents – reading values (for example financial figures or issue terms) from uploaded PDF, Word, Excel and PowerPoint documents of a survey or an investment opportunity and, for a survey, also from CSV and text files. Transmitted: the full text of the document, without redaction. For a survey, values that could identify the capital recipient are discarded from the AI's answer before they are stored.
(d) Automatic translation of published surveys and investment opportunities into the Platform languages, with an automatic AI check of each translation. This is part of the publishing service and applies only to content approved and published by e-ISIN.
(e) Illustrative images – generation of an illustrative image; only structured values chosen in the form (such as sector, stage, use of capital, security type and region) are used, never free text or the identity of the user or company.
(f) Anonymity check of uploaded photographs (see below) – only with your consent; without it the photograph is reviewed manually by e-ISIN.
The functions (a) to (c), (e) for content that is not yet published, and (f) are used only with your consent given in the app (section 4); the legal basis is your consent (Article 6(1)(a) UK GDPR and, where applicable, EU GDPR). Published content of an approved survey or investment opportunity is translated (d) and may serve as context for Alfred's answers to investors (a) as part of the publishing service. Results of the AI functions are proposals only; nothing is saved into your survey or investment opportunity until you confirm it. We transmit to the AI provider only the data needed for the specific function.
When generating an illustrative image, structured values necessary to create the image prompt are used; the aim is not to transmit the user’s identity or unnecessary personal data.
For an anonymity check, an uploaded photograph may be transmitted to OpenAI. The photograph may contain individuals or other identifying elements; the purpose of this function is to identify elements that could reveal the identity of a company, project or individual. Photograph metadata that is not necessary for this function is not intended to be transmitted.
AI outputs may contain inaccuracies, and automated support checks do not replace human review where such review is required.
e-ISIN does not use Alfred for automated decision-making that, by itself, produces legal effects concerning a user or similarly significantly affects a user.
We disclose personal data only to the extent necessary to provide the Platform, comply with legal obligations or protect legitimate interests.
Hostinger provides, in particular, server infrastructure, database environment, system email and related technical services. The e-ISIN production server is located in France. In providing these services, Hostinger processes personal data on behalf of e-ISIN to the extent necessary to operate the Platform.
We use Cloudflare R2 to store documents, images and encrypted backups. The production storage is configured with EU jurisdiction. Access to stored files is controlled by the Platform; the storage is not intended to serve as a public source of documents.
We use OpenAI OpCo, LLC (United States) as the external provider of the AI functions described in section 7, through the e-ISIN AI Gateway. OpenAI processes personal data on behalf of e-ISIN as a processor. The data transmitted for each function are listed in section 7; they are limited to what the function needs. OpenAI processes the data in the United States; the transfer mechanism is described in section 9. Text requests and photo checks are sent with storage of the conversation by OpenAI switched off, and data sent through the API is not used to train OpenAI's models unless the customer opts in; e-ISIN has not opted in to training. Under OpenAI's API terms, security and abuse-monitoring logs may be retained for up to 30 days (section 10).
Expo may be used for technical services relating to the mobile application, in particular build/update infrastructure and, if this function is activated, push notifications. Apple processes data in connection with the App Store, TestFlight and the delivery of push notifications through APNs under its own terms. The specific scope depends on the mobile application functions that are activated.
Personal data may be disclosed to public authorities, courts, legal advisers or other professional advisers where such disclosure is required by law or is necessary for the establishment, exercise or defence of legal claims.
HubSpot is not used in the current V1 state of the Platform as an automated recipient of e-ISIN users’ personal data. Any future CRM integration will be assessed separately before activation and this Privacy Policy will be updated as necessary.
The Anthropic API is not an active provider of AI functions in the current production configuration of the Platform. Production personal data of users is not intended to be transmitted to Claude development chats.
Card payments for paid services on the e-ISIN website are processed by Stripe Payments UK Ltd on its hosted payment page. Stripe receives the payment card data directly; e-ISIN does not receive or store the card number. Stripe processes the payment and the related data (name, e-mail address, amount) under its own terms and privacy policy.
e-ISIN Ltd is a company incorporated in England and Wales. Where the EU GDPR applies to processing, transfers of personal data to the United Kingdom may be based on a valid European Commission adequacy decision.
Some technical service providers or their subprocessors may process data outside the United Kingdom or the European Economic Area, in particular in the United States. In such cases, we use the relevant international transfer mechanisms under applicable law, such as adequacy decisions, the Data Privacy Framework, Standard Contractual Clauses and/or the UK Addendum, as appropriate to the particular relationship.
For OpenAI OpCo, LLC (section 8.3), the transfer of personal data to the United States is based on the Standard Contractual Clauses approved by the European Commission together with the UK International Data Transfer Addendum (UK Addendum).
The current contractual and transfer mechanisms applicable to individual providers are maintained in e-ISIN’s internal records.
We retain personal data only for as long as necessary for the purpose for which it was collected and thereafter for any period required by law or reasonably necessary to protect legal claims, security and the evidential integrity of operations.
| Category | Retention rule |
|---|---|
| Account and profile | for the lifetime of the account; after account closure, limited retention only where necessary for legal, security or record-keeping purposes |
| Survey responses and related audit data | for as long as necessary to provide and evidence the relevant service; the specific retention period is determined by the internal retention schedule |
| Messages and contact records | for as long as necessary for the communication function, dispute resolution and evidential purposes; thereafter deletion or anonymisation in accordance with the retention schedule |
| Documents and photographs | for the duration of the service and thereafter as required for contractual, legal and security purposes |
| Text read from uploaded documents and files, and values proposed by AI | the text read from a survey background file (up to 200,000 characters per file) and the values proposed from documents are kept with the survey or investment opportunity for the duration of the service and are deleted together with the file, the survey or the investment opportunity, or with the account |
| Alfred conversations | the questions and answers of an Alfred conversation are used on the Platform for 24 hours so that Alfred can follow the conversation, and are then deleted; the app keeps the conversation on your device until you sign out; questions that Alfred refuses to answer are kept in redacted form for up to 12 months for the review of Alfred's rules |
| Records of the AI consent | each decision ("I agree", "Without AI", withdrawal) with its time, the version of the consent text and the app language, for as long as necessary to evidence the consent |
| Records of acceptance of Terms/Privacy and other compliance records | for as long as necessary to evidence the legal relationship and compliance with legal obligations |
| Security and audit logs | for a limited period appropriate to the security purpose and the internal retention schedule |
| Backups | rotation of approximately 14 daily and 8 weekly backups; deleted data may therefore remain in an encrypted backup for approximately up to 8 weeks and is not ordinarily restored from a backup except as part of system recovery |
| OpenAI security/abuse logs | under the terms of the relevant API service, these may be retained for up to 30 days unless a stricter regime has been approved for the particular service |
Where the law requires a longer retention period, that statutory period applies. At the end of the applicable period, personal data is deleted, anonymised or its further processing is restricted to the purpose for which it must be retained.
We use appropriate technical and organisational measures reflecting the nature of the Platform and the data processed. These include, in particular, access controls, separation of production and staging environments, restricted access to storage, server-side storage of API keys and other secrets, audit records and encrypted backups.
Access to personal data is limited to persons and providers who require it for the relevant purpose. Production personal data of users is not intended to be copied into development AI chats or other unapproved development tools.
Subject to applicable law, you may have, in particular, the right to:
Requests may be sent to info@e-isin.com. Before acting on a request, we may take reasonable steps to verify the identity of the requester.
In the United Kingdom, the competent supervisory authority is the Information Commissioner’s Office (ICO). Where the EU GDPR applies to particular processing, the data subject may also, depending on the circumstances, have the right to contact the competent supervisory authority in the European Union.
Users in the European Union may contact e-ISIN directly at info@e-isin.com regarding data protection matters and may also contact the competent supervisory authority under applicable law.
The Platform is not intended for children. Registered investor and capital-recipient functions are intended for persons authorised to act in their own capacity or on behalf of the relevant legal entity. If we become aware that we have obtained a child’s personal data in breach of applicable law and without an appropriate legal basis, we will take reasonable steps to delete it.
The current V1 architecture of the Platform does not use advertising tracking or third-party analytics or crash-reporting SDKs. If cookies or other technologies that require consent or separate notice under applicable law are introduced in the future, users will be provided with an appropriate choice before such technologies are used and this Privacy Policy will be updated.
We may update this Privacy Policy, in particular where the Platform’s functions, data flows, providers or legal requirements change. The current version will be available through the Platform.
If a change is material, we may notify registered users through the Platform or by electronic communication. Where a new acknowledgement or consent is required under applicable law or because of the nature of the change, the Platform will request it.
The official and legally binding version of this Privacy Policy is the English-language version. Translations into other languages may be provided for convenience. In the event of any difference or inconsistency between the English-language version and a translation, the English-language version shall prevail.
e-ISIN Ltd
Company No. 17503394
Email: info@e-isin.com
User support: support@e-isin.com