Privacy Notice

1. Who we are

Inceptist Ltd is a company registered in England and Wales under company number 17376945. Its registered office is 20 Tawny Close, Feltham, England, TW13 7LH.

Inceptist Ltd is the controller of the personal information described in this notice.

Privacy contact: Emeka Okaforudeji, Director and Privacy Lead

Email: theinceptist@gmail.com

The Privacy Lead role is not a designation as a statutory Data Protection Officer.

2. What Inceptist does

Inceptist is a venture-formation and execution platform. It allows people and organisations to propose ventures, participate in them, record contributions, agree governance and economic terms, submit evidence, and maintain an ordered record of resulting platform positions.

Account registration is open. Registration creates an account identity only. Admission to a venture or organisation, eligibility, verification and access to particular features or jurisdictions are separate controls and may require an application, invitation or approval.

A position, Share, allocation, Charter or other record shown by Inceptist has the meaning given to it by the platform and the relevant venture terms. It does not, by itself, prove legal ownership of shares in a registered company, a security or another external asset.

3. Personal information we use

Account and authentication information

We use information such as your email address, authentication credentials, account status and sign-in information to create and secure your account and provide access to the service.

Lawful basis: performance of a contract with you and our legitimate interests in securing the service.

Passwords are handled by our authentication provider and are not stored by Inceptist in readable form.

Profile information

We use the display name, handle and other profile details you choose to provide so that you can be identified appropriately within the service and by people with whom you participate.

Lawful basis: performance of a contract.

Identity and organisation information

Where a venture, organisation or participation rule requires it, we may use information such as legal name, country of residence or registration, address, organisation name, registration reference and information showing your authority to act for an organisation.

Lawful basis: performance of a contract and our legitimate interests in identifying participants, protecting platform integrity and determining whether participation conditions are satisfied.

Verification information

If identity, organisation, sanctions or similar checks are enabled for a particular use case, we may record the provider used, the status and outcome of the check, timestamps and limited reasons or review information. We aim to record the verification evidence needed for the decision rather than copies of underlying identity documents unless there is a specific reason to retain them.

Lawful basis: our legitimate interests in protecting participants and platform integrity, and legal obligation where a specific law requires the processing.

A verification provider's result does not by itself determine whether a person may participate. Inceptist applies the relevant participation rules separately.

Venture, contribution and governance information

We use information about ventures you create or join, contributions you offer or deliver, evidence you submit, terms and Charters you accept, governance actions you take, decisions you make and platform positions that result.

Lawful basis: performance of a contract and our legitimate interests in maintaining accurate, auditable venture and economic records.

Offering or delivering a contribution does not automatically create ownership. Platform-recorded ownership changes only through the authoritative process defined by the venture and the service.

Audit and security information

We keep records of important actions, security events and administrative activity so that we can protect accounts, investigate problems and demonstrate what happened.

Lawful basis: our legitimate interests in security, accountability, fraud prevention and system integrity, and legal obligation where applicable.

Notifications and communications

We process messages, notifications and service communications needed to operate your account and ventures.

Lawful basis: performance of a contract and our legitimate interests in operating the service.

Error and diagnostic information

We may receive technical error and limited performance information when the service fails or behaves unexpectedly. We configure diagnostic services to minimise personal information and do not use error reports for advertising.

Lawful basis: our legitimate interests in maintaining a reliable and secure service.

Product research

If you voluntarily participate in a usability study or other research activity, we will give you a specific participant notice explaining what information will be collected, why it will be used and the choices available to you.

Required and optional information

We identify information that is required for an account, admission, verification or a particular venture action or feature. If you do not provide required information, we may be unable to create the account, admit or verify you, complete the action or provide the affected feature. Optional information is voluntary; not providing it affects only the function for which it was requested.

4. Information we do not seek to collect

We do not use personal information for third-party advertising and we do not sell personal information.

We do not ordinarily ask you to provide special-category information or criminal-offence information through the service. Do not submit such information unless Inceptist specifically asks for it for a stated purpose and explains the relevant protections.

At present, Inceptist does not use solely automated decision-making that produces legal or similarly significant effects about you.

5. Who receives personal information

We use service providers to operate Inceptist. Current core providers include:

• Supabase for database, authentication and stored application data;
• Vercel for application hosting and delivery;
• Sentry for technical error and performance monitoring; and
• Google for the consumer Gmail service used for privacy and service correspondence.

Supabase, Vercel and Sentry may use approved subprocessors. They process relevant service information under their contractual and data-protection obligations and under our instructions where they act as processors.

The Gmail account used for correspondence is a consumer Google service. We do not describe it as a Google Workspace processor arrangement. Google handles information associated with that service under its applicable terms and privacy policy.

We may also disclose information where required by law, to protect legal rights, to investigate misuse or security incidents, or as part of a corporate transaction where lawful safeguards are applied.

6. International transfers

Some of our service providers or their subprocessors may process personal information outside the United Kingdom.

Where UK data-protection law requires safeguards for a restricted transfer, we use an applicable lawful mechanism, such as UK adequacy regulations or approved contractual safeguards, including the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, as appropriate.

You may contact the Privacy Lead for information about the safeguards relevant to your information.

7. How long we keep information

We keep personal information only for as long as reasonably necessary for the purpose for which it is used, taking account of contractual, security, dispute, evidential and legal requirements.

Account and profile information: while your account remains active. After closure, we retain only what is still needed to complete closure, protect accounts and the service, resolve a dispute, meet a legal obligation or preserve a necessary authoritative record. We delete or de-identify the remaining information when those purposes no longer apply.

Identity and verification information: while required for an active participation relationship and afterwards only for as long as needed to evidence the relevant decision, protect platform integrity, meet a legal obligation or establish, exercise or defend legal claims. We periodically review whether the identifying information is still necessary.

Notifications and ordinary service communications: for as long as needed to deliver, manage and evidence the relevant service or communication, and longer only where the information is required for a live dispute, security matter, authoritative record or legal obligation.

Security and audit information: for the period reasonably necessary to protect the service, investigate incidents and demonstrate consequential actions. We periodically review this information and delete or de-identify it when it is no longer needed.

Technical error and performance information: according to the configured diagnostic-service retention period and only for as long as reasonably necessary to investigate reliability, performance or security issues.

Venture and economic event history: some authoritative event records are deliberately append-only. They may be retained for the life of the relevant venture and longer where necessary to preserve the integrity of participant rights, evidence transactions, comply with law or establish, exercise or defend legal claims. We do not treat append-only architecture as a blanket justification for keeping unnecessary identifying information indefinitely.

8. Append-only records and deletion

Some Inceptist records are designed so that a completed economic or governance event is not silently rewritten or removed. Corrections are recorded as later events rather than altering the historical event.

This protects the integrity of records relied on by more than one participant.

If you ask us to erase your personal information, we will assess the request against the purposes for which the information is held and the rights of other people. We will erase or de-identify information where the law requires us to do so.

Where an event record must be retained, we will consider whether identifying information can be separated, reduced or de-identified while preserving the integrity of the event history.

The right to erasure is not absolute. We may retain information where continued processing is necessary for a legal obligation, for establishing, exercising or defending legal claims, or where another applicable exemption applies.

9. Your rights

Depending on the circumstances and the lawful basis we rely on, you may have rights to:

• access your personal information;
• correct inaccurate information;
• request erasure;
• restrict processing;
• object to processing based on legitimate interests;
• receive qualifying information in a portable format where the legal requirements for data portability apply; and
• withdraw consent where we rely on consent.

To exercise a right, contact theinceptist@gmail.com.

We normally respond to rights requests without undue delay and within one month. Where the law permits an extension because a request is complex or multiple requests have been made, we will tell you within the initial response period.

10. Data-protection complaints

You can make a data-protection complaint to us by emailing theinceptist@gmail.com. Please explain what you think has gone wrong and provide any information that will help us investigate.

We will acknowledge receipt within 30 days, investigate and respond without undue delay, keep you informed about progress where appropriate, and tell you the outcome.

You may also complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint/. You do not have to complete our complaints process before contacting the ICO.

11. Security

We use technical and organisational controls appropriate to the service, including access controls, environment separation, encrypted connections, audit mechanisms and restricted administrative access.

No online service can guarantee absolute security. If we identify a personal-data breach, we will assess and respond to it in accordance with applicable law.

12. Cookies and similar technologies

We use technologies that are necessary to authenticate users, maintain secure sessions and operate the service.

We do not use advertising cookies.

If we introduce non-essential analytics, advertising or other technologies that require consent, we will provide the required information and choice before they are used.

13. Changes to this notice

We may update this notice as Inceptist changes. The current version will show its effective date. If a change materially affects how we use your personal information, we will provide appropriate notice.