Privacy Policy

We are Equdash Ltd, a private limited company registered in England and Wales under company number 17037081, with our registered office at 50 Vayre Close, Chipping Sodbury, Bristol, England, BS37 6NU.

As required by UK data protection law, we are registered as a ‘controller’ with the Information Commissioner’s Office (ICO), registration number 2038216.

When we talk about ‘personal data’, we mean any data that identifies or can be used to identify you. This does not include data where your identity has been removed (anonymous data).

The personal data we collect about you includes:

• Account data: your name and email address, and your login credentials, managed through our authentication provider.
• Your holdings and investment data: details of your employee share options, SEIS/EIS investments and direct/private equity holdings that you enter yourself or that are extracted from documents you upload — for example, company names, instrument type, key dates (such as grant, issue, vesting or exercise dates), share counts, prices, and scheme details.
• Uploaded documents: the actual files you upload to Equdash (for example share certificates, option agreements, SEIS3/EIS3 certificates and cap table extracts), and any personal or company data contained within them.
• Ask Dash chat data: the messages you send to, and receive from, Equdash’s AI Ask Dash feature.
• Advisor access data: if you grant an advisor access to your account, details of that access and the actions taken on your behalf; if you use Equdash as an advisor, the same in relation to any client accounts you are given access to.
• Technical data: IP address, device information (e.g. type, operating system, browser), and website navigation data (e.g. pages visited, time spent, interactions).
• Communications: any correspondence you send us, for example by email.

We collect your personal data directly from you — when you create an account, upload a document, use the Ask Dash chat feature, or otherwise interact with the Service.

This section explains what we use your personal data for, and the legal grounds we rely on for those purposes.

We use your personal data to:

• Provide and personalise the Service, including extracting and organising the details of your holdings from documents you upload.
• Send you alerts about upcoming milestones and deadlines relating to your holdings (for example, vesting dates or SEIS/EIS 3-year deadlines).
• Generate analytics and improve the Service.
• Fulfil legal or regulatory obligations.

Under UK data protection law there are six legal grounds we may rely upon, the most relevant being where:

• you have given your consent to us using your personal data for specific purposes
• use of your personal data is necessary for us to enter into and perform our contract with you
• use of your personal data is necessary to comply with a legal obligation on us
• use of your personal data is necessary to pursue our legitimate interests, and those interests are not outweighed by your fundamental rights and interests

We may use your personal data for purposes closely related to the above. If we want to use it for anything unrelated, we will let you know in advance.

We do not sell your personal data for marketing purposes, and we never will.

The people who have access to your personal data include:

• Your advisor, if you choose to grant them access to your account. You control this and can revoke it at any time.
• Our staff, who are bound by strict confidentiality and data protection obligations.
• Our technical service providers, who process personal data on our behalf to provide the Service. Currently, these are:
  • Clerk — authentication and account management
  • Supabase — database hosting and secure document storage
  • Anthropic — to power the AI features that read your uploaded documents and the Ask Dash chat (see ‘How we use AI to process your documents’ below)
  • Resend — to send transactional and milestone-alert emails
  • Vercel — hosting

Each of these providers is bound by confidentiality and data protection obligations, and only has the access needed to provide their service to us.

• Regulatory authorities, such as HM Revenue & Customs (the UK tax authority).
• Any actual or potential buyer, of our business.

In the rare situation where we are asked to disclose personal data in response to a legal request or court order, we will take legal advice before making any disclosure, to make sure your rights and interests are properly considered.

When you upload a document, Equdash sends it to Anthropic’s Claude AI to extract the relevant details (such as dates, share counts and prices) so you do not have to type them in by hand. You always review and confirm what is extracted before it is saved to your account. When you use the Ask Dash chat feature, your messages and the relevant holdings or document data are sent to Claude to generate a response.

Anthropic does not use this data to train its models, and does not retain it beyond what is needed to process your request (typically no more than 30 days), unless required by law to keep it for longer.

Some of our technical service providers, including Anthropic, Clerk and Resend, are based in the United States, which means your personal data will be transferred outside the UK and the European Economic Area (EEA). Whenever we transfer your personal data outside the UK or the EEA, we make sure a similar degree of protection applies, including by:

• relying on the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, where appropriate
• ensuring the destination country is recognised by the UK government as providing an adequate level of protection for your personal data

We have put in place appropriate security measures to prevent your personal data being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. Access to your holdings is restricted to you and, where you have explicitly granted access, your chosen advisor — nobody else can see your data by default.

We limit access to your personal data to those staff and technical service providers who need it, based on the principle of ‘least privilege’. They only use your personal data based on our instructions and are required to keep it confidential.

We implement security measures including encryption in transit and at rest, and access controls, to prevent unauthorised access, use or disclosure of your data.

We have procedures in place to deal with any suspected personal data breach, and will notify you and the ICO (or any other relevant regulator) where we are legally required to do so.

We only keep your personal data for as long as necessary in connection with the purposes we collected it for, and to comply with any legal, accounting or reporting requirements. To determine this, we consider the amount, nature and sensitivity of the data, the purposes it was collected for, and the potential risk of harm from continuing to hold it.

We will retain personal data linked to your account for as long as you are a member. If you would like your account and data deleted, email us at Admin@equdash.com and we will action this in line with your rights below.

We will retain personal data relating to milestone-alert emails until you unsubscribe or close your account.

Inactive accounts may be deleted or anonymised after 24 months of inactivity, subject to any legal obligation to retain data for longer.

We may retain any data that does not identify you indefinitely.

Our website uses a small number of cookies. At the moment, we only use strictly necessary cookies — for example, the sign-in cookie set by our authentication provider (Clerk), which keeps you logged in and lets the Service work. We do not currently use analytics, advertising or ‘functionality’ cookies.

If this changes in future — for example, if we add analytics to help us understand how the Service is used — we will update this policy and ask for your consent first, where required. To find out more about cookies generally, see the ICO’s cookie guidance.

Under UK data protection law, you have the following rights in relation to your personal data:

• Access: you have the right to be informed if your personal data is being used, and the right to request a copy of the personal data we hold about you, together with certain information about how we process it.
• Correction: you have the right to ask us to correct any inaccurate or incomplete personal data we hold about you.
• Deletion: you have the right to ask us to delete or remove any personal data we hold about you where there is no good reason for us to keep it, or where you have exercised your right to object.
• Restriction: you have the right to ask us to restrict how we hold your personal data — for example, to confirm its accuracy or our reasons for holding it.
• Objection: you have the right to object to our holding any personal data about you that is based on our legitimate interests. You also have the right to object to our holding your personal data for direct marketing purposes.
• Portability: you have the right to receive, or request that we transfer, a copy of the personal data we hold about you in an electronic format, where our holding it is based on your consent or on performing a contract, and it is processed by automated means.
• Complaints: you have the right to complain to the UK Information Commissioner’s Office (ICO) about how we collect and use your personal data.
• Data Protection Officer / Contact Details: if required under applicable law, we will appoint a Data Protection Officer (DPO). You can contact us about any data protection query at Admin@equdash.com.
• Lawful Basis Mapping: for transparency, we rely on: (a) Contract — to provide our services; (b) Legitimate Interests — to improve and secure our platform; (c) Legal Obligation — to comply with regulatory requirements; (d) Consent — for marketing communications and any non-essential cookies.
• Automated Decision-Making: we do not carry out solely automated decision-making that produces legal or similarly significant effects on you — our AI extraction feature always requires you to review and confirm the results. If this changes, we will update this policy and inform you of your rights.
• Children’s Data: our services are not directed at individuals under the age of 18, and we do not knowingly collect personal data from children. If we become aware that we have collected data from a child without appropriate consent, we will delete it promptly.
• Data Minimisation: we only collect personal data that is adequate, relevant and limited to what is necessary for the purposes it is processed for.
• Data Retention: inactive accounts may be deleted or anonymised after 24 months of inactivity, subject to legal obligations.
• Data Breach Notification: in the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours where required, and notify affected individuals without undue delay.
• International Transfer Safeguards: where personal data is transferred outside the UK, we rely on the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, where appropriate.
• Changes to this Policy: we encourage you to review this policy periodically. The ‘Effective from’ date at the top indicates when it was last updated.

You will not have to pay a fee to exercise any of the above rights, although we may charge a reasonable fee, or refuse to comply with your request, if it is clearly unfounded or excessive. Where this is the case, we will let you know.

To protect the confidentiality of your personal data and other members of our community, we may need to ask you to verify your identity before fulfilling any request relating to your personal data.

If you have any questions or comments about this policy, please email us at Admin@equdash.com.