Privacy & GDPR

Who is responsible

The controller for the personal data described here is Artha Networks, operator of the Global Impact Investor Database. Write to privacy@arthanetworks.com for anything on this page. You have the right to complain to your national supervisory authority.

Remove your details — immediately

Use the removal form. It requires no account and no explanation: every record matching the address is deleted within seconds, and the address is added to a suppression list so a later import cannot bring it back. We store a one-way hash of the address for that purpose, never the address itself.

What this database contains

The Global Impact Investor Database holds information about organisations that allocate or seek capital, and about people in their professional capacity at those organisations: name, role, work email, work phone, professional LinkedIn profile and work location. We hold no special-category data, no home addresses and no inferred personal attributes.

Lawful basis

We process this personal data under Article 6(1)(f) of the GDPR — legitimate interest. The interest is connecting capital with the organisations that need it, in a professional context, which is the stated purpose of the roles the people in this database hold. We have carried out a balancing test and consider the impact on the individual to be minimal: the data concerns them only as a professional, is limited to what is necessary, and is never used to contact them by us.

Where the data comes from, and notice under Article 14

We collect most of this data from sources other than the individual: professional convenings and their attendee lists, membership directories of investor networks, publicly available organisational information, partner directories, and direct submissions. We do not buy scraped contact lists.

Article 14 requires that we inform people whose data we obtained indirectly. Contacting every individual would require processing we consider disproportionate, and would itself mean emailing people who have not asked to hear from us — so we rely on the exemption in Article 14(5)(b) and publish this notice instead, kept permanently available, indexed, and linked from every page. The removal form above is the direct consequence of that choice: because we do not write to you, objecting must be effortless.

Your rights

• Access — we will tell you everything we hold about you, and who has revealed your details, from our reveal and change logs.
• Rectification — corrections are applied immediately and prioritised in the enrichment queue.
• Erasure — a removal is a hard delete of the person record plus a suppression entry, so a future import cannot resurrect it. We also notify customers who revealed your details within the previous 12 months. Use the removal form for an immediate result.
• Objection — you may object to processing at any time; because we rely on legitimate interest, an objection results in removal.
• Portability — we will export what we hold about you in a machine-readable form.

Write to privacy@arthanetworks.com. We act within 30 days and usually within two working days.

What we never do

• We never send email to a person in this database to test whether their address works. Verification is SMTP-level and invisible to the recipient.
• We never allow bulk export of contact details. CSV export is organisation-level only; reaching a person is always an individually metered, logged action.
• We never sell or licence contact data to third parties.
• We never send email on a customer’s behalf.

Where the data is processed

The database and authentication run on Supabase infrastructure in the EU. Application hosting (Vercel) and payments (Stripe) involve transfers to the United States, carried out under the European Commission’s Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework. Email verification is performed by ZeroBounce under the same basis.

How it is protected

• Contact records are not readable by any browser session. Every read passes through a server that checks entitlement first, and the underlying tables deny access to anonymous and signed-in roles alike.
• Reaching an individual is a metered, individually logged action. There is no bulk export of contact details, by design.
• All traffic is HTTPS with HSTS; a content security policy and framing restrictions are enforced on every response.
• Access to a record and every change to it are written to an audit log, which is what lets us answer a subject access request precisely.

Customer data

Account data (your email, workspace, lists, saved searches, reveal history, API usage) is processed to provide the service under contract, Article 6(1)(b). It is stored in the EU on Supabase infrastructure. Payment data is handled entirely by Stripe; we store only a customer identifier and subscription status, never card details.

Retention

Organisation and contact records are retained while they remain accurate and relevant, and reviewed on the freshness cycle described in our public coverage and methodology page. Account data is retained for the life of the account and for six years afterwards where required for tax and accounting.

Sub-processors

• Supabase — database and authentication (EU)
• Rate-limiting and abuse prevention store a salted hash of the requesting IP address for up to 24 hours, never the address itself
• Vercel — application hosting
• Stripe — payments
• ZeroBounce — email deliverability verification