Privacy Policy

1. Who is responsible for your data?

The data controller is YC STRATEGIC VENTURES, a French société par actions simplifiée registered with the Paris Trade and Companies Register under number 103 274 072, with its registered office at 229 rue Saint-Honoré, 75001 Paris, France ("Onefive", "we").

This policy covers the onefive.app website and the Onefive platform (accounts, feed, messaging, datarooms, profiles). For any question, or to exercise your rights, write to privacy@onefive.app. We have not appointed a Data Protection Officer, and we are not required to, so your request is handled by the company directly.

2. The data we collect

• Account and profile: email address, password (stored only as a bcrypt hash, never in clear text), first and last name, profile photo, phone number (optional), professional background (optional, including through LinkedIn sync if you trigger it).
• Sign-in with Google, LinkedIn or Apple: if you use one of these services, we receive your email, name and, where provided, photo from them. Your email address is the identity key: it links these sign-ins to a single Onefive account.
• Startup data: information you provide about your company: description, equity and cap table, funding rounds.
• Content: feed posts, private messages, and documents you upload to your datarooms.
• Dataroom access events: when a dataroom is viewed, we record who viewed it, which documents were opened, when, and for how long (see section 4).
• Technical and security data: IP address and browser signature (user-agent) attached to your sign-in sessions, and a browser identifier computed with the FingerprintJS library at signup, used to prevent fraud and abusive account creation.
• Usage data: navigation and usage statistics collected through PostHog; the instance we use is hosted in the European Union (eu.posthog.com).

3. Why, and on what legal basis?

4. Datarooms: viewing is visible to the owner

Datarooms exist to share sensitive documents (deck, cap table, legal documents) in a controlled way. In return, when you view a dataroom that has been shared with you, its owner can see that you opened it, which documents you viewed, and when. If you access a dataroom through an anonymous link, the viewing is recorded without being linked to an account. By viewing a dataroom, you are informed of this tracking.

5. How long do we keep your data?

• Account, profile, content, startup data: for as long as your account is open, then deleted within 30 days of account deletion.
• Private messages: for the life of your account.
• Dataroom documents and access events: for the life of the dataroom and of its owner's account.
• Sessions, IP address, user-agent, FingerprintJS identifier: attached to your sign-in sessions, which expire at most 90 days after they are created.
• Usage data (PostHog): kept for a maximum of 12 months.

Some data may be kept longer where the law requires it (for example for accounting purposes or in case of litigation), for the strictly necessary duration.

6. Who has access to your data? (processors)

We never sell your data. We share it only with the providers that make the service work:

7. Transfers outside the European Union

Several of our providers are US companies. The resulting data transfers are governed by the European Commission's standard contractual clauses and, where applicable, by the provider's certification under the EU–US Data Privacy Framework. You can request a copy of the applicable safeguards at privacy@onefive.app.

8. Your rights

You have the following rights over your data:

• right of access and copy;
• right to rectification;
• right to erasure;
• right to restriction of processing;
• right to portability;
• right to object, in particular to processing based on our legitimate interest;
• right to withdraw your consent at any time, for processing that relies on it;
• right to give instructions on what happens to your data after your death (French Data Protection Act).

To exercise them, write to privacy@onefive.app. We answer within one month. If you are not satisfied with our answer, you can lodge a complaint with the CNIL, the French data protection authority, or with the supervisory authority of your country of residence.

9. Security

All exchanges with our servers are encrypted (HTTPS). Passwords are hashed with bcrypt and never stored in clear text. Session cookies are protected (httpOnly). Access to data is restricted to what is needed to operate the service. No system is infallible: should a data breach put you at risk, we will notify you as the GDPR requires.

10. Minors

Onefive is aimed at a professional audience and is not intended for anyone under 15, the age of digital consent in France. We do not knowingly collect their data, and will delete it if we learn we have.

11. Changes to this policy

We may update this policy. If a change is material, we will inform you by email or through the platform before it takes effect.