Privacy Notice

1. Who we are

This Privacy Notice explains how Earth Collective Inc. (“Earth Collective,” “we,” “us,” “our”), a corporation incorporated under the laws of Canada with its principal place of business in the Province of Quebec (Quebec enterprise number (NEQ) 1182080177), collects, uses, shares, and protects personal information when you use the Earth Collective platform and websites (the “Services”).

We are responsible for the personal information described in this notice, except where Section 3 says otherwise. Words with a capital letter that are not defined here have the meaning given in our Terms & Conditions.

This notice is information, not a contract. You are not asked to agree to it. The version shown to you when you signed up is recorded.

2. What we collect

Information you give us:

  • Account information: your name, email address, role (Founder, Advisor, Investor), the Entity you represent and your position in it, and your sign-in method. We do not use passwords: you sign in with a one-time code sent to your email, or with Google or LinkedIn.
  • Profile information: what you add to your profile, such as your photo, biography, location, experience, expertise, and links. Advisors may choose to import their LinkedIn profile.
  • Organization and investment information: pitch materials, team details, traction and impact metrics, financial information, uploaded documents, data room contents, and investment or advisory criteria.
  • Applications: your answers when you apply to join the Platform or a Programme, and the decision on your application.
  • Reviews and assessments: feedback, ratings, readiness scores, levels, notes, and comments that you give or receive, including those produced with AI Features.
  • Payment information: your plan, purchases, credit balance, invoices, and refunds. Card details are collected and held by Stripe; we see only the card brand, the last four digits, and the expiry date. Advisors who receive payouts provide their bank and identity details to Stripe, not to us.
  • Communications: messages and emails you send us, notifications we send you, and posts, suggestions, and votes on the community board.
  • Usage and device information: your IP address, browser and device type, pages visited, and actions taken on the Platform, including records of who opened a data room and when.

Information others give us about you:

  • Your team or firm: a founder or a colleague may add you as a team member, advisor, or contact, or name you in a document or data room they upload.
  • Other Users: advisors, judges, investors, and Programme administrators may write reviews, scores, levels, notes, and comments about your Organization or your work.
  • LinkedIn: if you are an advisor and choose to import your profile, we receive the public information on your LinkedIn profile through our import providers (Section 6).
  • Sign-in providers: if you sign in with Google or LinkedIn, we receive your name and email address from them.

What you must give us. Your name and email address are needed to create an Account, and the questions a form marks as required are needed to submit an application. Everything else is optional; leaving it out may mean a feature, such as matching, cannot work for you.

We do not ask for sensitive information such as health, ethnicity, religion, sexual orientation, or criminal records. Please do not upload it unless a feature specifically asks for it. Some application forms may ask optional questions, for example whether an organization is women-led or youth-led; answering is up to you.

3. If you join through a Programme

Some accelerators, funds, and networks run their Programmes on the Platform. When you apply to or take part in a Programme:

  • Information collected for the Programme’s own purposes, including your application, eligibility and assessment records, judging scores and notes, and cohort records, is handled by us on behalf of the Programme Operator, which is responsible for it. The Programme’s own privacy notice explains how it uses that information, and it is shown to you when you apply.
  • Your Account, profile, documents, and data room remain our responsibility under this notice.
  • The Programme’s administrators can see the applications, profiles, assessments, and data rooms of Organizations in their Programme. Each time they open a data room it is recorded in its access log. They cannot see other Programmes’ data.
  • If you contact us about Programme information, we may pass your request to the Programme Operator.

4. How we use your information

  • To provide the Services: running your Account, showing your profile to the people you choose, handling applications, data rooms, reviews, notifications, and support. Basis: to perform our contract with you.
  • To match you with others (profiling): we compare an Organization’s profile with investors’ and advisors’ criteria and score how well they fit, so each side sees the most relevant matches. Basis: our legitimate interest in connecting Organizations with investors and advisors who fit them, which we have weighed against your rights; matching compares only information you have chosen to give and is never used for advertising. You control it yourself: investor matching starts only when you take a plan that includes it and reach the readiness score, and stops if you archive the pitch or end that plan; advisors see your pitch only while you have it shown to advisors; investors are matched only through mandates they keep switched on. Advisors who want to leave the advisor marketplace, and anyone who wants to object to matching, can contact us (Section 11).
  • To take payments: charging for plans and credits, holding and releasing advisor fees, issuing invoices and refunds, and paying advisors. Basis: contract; legal obligations (tax and accounting).
  • To run AI Features: see Section 5. Basis: contract, when you use a feature; the Programme Operator’s instructions, for Programme assessments.
  • To keep the Platform secure: preventing fraud and abuse, investigating problems, and keeping audit logs. Basis: our legitimate interest in a safe platform; legal obligations.
  • To improve the Services: understanding how features are used, fixing errors, and producing aggregate statistics. We never publish a statistic drawn from fewer than five people or organizations. Basis: our legitimate interest in improving the Services.
  • To communicate with you: service emails about your Account, applications, payments, and changes to our terms. We send product news only where the law allows, and you can unsubscribe at any time. Basis: contract; legitimate interest; your consent where required.
  • To comply with the law: responding to lawful requests and enforcing our terms. Basis: legal obligations.

Where we rely on our legitimate interests, we have weighed them against your rights, and you can object (Section 11). We do not sell your personal information, and we do not use it for advertising.

5. AI Features and automated assessments

  • What we use. Some features send information to OpenAI or Anthropic to produce a result: application assessment, readiness and investability scores, document summaries, drafting and importing profile content, data room suggestions, and the AI coach. Only the information the feature needs is sent.
  • No training. Our providers do not use this information to train their models, and neither do we.
  • How long providers keep it. Both providers keep submitted information for up to 30 days to monitor for abuse, and then delete it. Anthropic may keep content its automated safety systems flag for up to 2 years. Where the AI coach or data room assistant holds a conversation with you, OpenAI keeps that conversation for up to 30 days so it can continue. We do not store your documents with either provider.
  • Automated assessments. Your Organization may be given a level, a readiness score, or an eligibility verdict produced wholly or partly by AI, using criteria set by us or by a Programme Operator. These can decide what you can access, for example admission to a Programme, appearing in the advisor marketplace, or investor matching.
  • Your right to a human review. You can see your level and score on the Platform and ask, through the Platform, for a person to review a decision. The reviewer can grant or restore access the automated result does not give you, or confirm the result, and records a reason. Access granted this way can later be ended, with a reason. If access you already hold is removed, we tell you and give the reason. You can also contact us using Section 12 to ask what information and main factors led to a decision.

6. Who we share it with

  • Other Users, as you choose. Your profile is shown to other Users and, for public content, to visitors. Data room items are shared only with the firms you grant access to. Advisors you engage see the information you share with them.
  • Programme Operators, as described in Section 3.
  • Service providers who process information for us under contract and only on our instructions:
    • Privy (by Stripe): sign-in and identity
    • Laravel Cloud (on Amazon Web Services): application and database hosting
    • Cloudflare R2 (through Laravel Cloud): document, image, and backup storage
    • Stripe: payments and refunds
    • OpenAI and Anthropic: AI Features (Section 5)
    • Postmark: sending email
    • Google Analytics: usage statistics (Section 8)
    • Apify, and HarvestAPI, whose import tool Apify runs: LinkedIn profile import, only when an advisor chooses to use it
    • Hivelighter: an embedded tool, only when you use it
  • Services your browser contacts directly. Some pages load scripts from the content delivery networks jsDelivr, cdnjs (Cloudflare), and unpkg, which receive your IP address and browser details when the page loads. When you press play on a video, it is loaded from YouTube or Vimeo, with thumbnails from vumbnail for Vimeo.
  • Our staff, on a need-to-know basis. To provide support or investigate a problem, authorised staff may view the Platform as you see it; every such session is logged.
  • Legal and safety: where required by law, or to protect the rights and safety of our Users or the public.
  • A business transfer: if Earth Collective is merged, acquired, or sells its assets, subject to this notice continuing to apply to your information.

7. Where your information is processed

The Platform and its database are hosted in London, United Kingdom, on Amazon Web Services through Laravel Cloud. Documents, images, and backups are stored with Cloudflare R2 in data centres in the European Union. Our team works from Canada, and our other service providers operate in the United States and other countries. This means your information is processed outside the province or country where you live, including in places with different privacy laws.

Before we transfer information, we assess the protection it will receive. Where European or UK law applies to your information and it goes to a country without an adequacy decision, such as the United States, we use the European Commission’s standard contractual clauses or the UK International Data Transfer Agreement or Addendum, or a provider’s certification under the EU-US Data Privacy Framework and its UK extension. You can ask us for a copy of the relevant safeguards using Section 12.

8. Cookies and analytics

  • Essential cookies keep you signed in and protect forms from misuse. The Platform does not work without them.
  • Preferences such as a dismissed message or a chosen tab are stored in your browser.
  • Google Analytics helps us understand how the Platform is used, only if you allow it. It receives the pages you visit and your role, with Google's own cookie identifier, but no Earth Collective identifier and not your name or email address.
  • Embedded videos from YouTube and Vimeo may set their own cookies when you play them, only if you allow it.

When you first visit, we ask whether you allow analytics and video cookies. Until you say yes, none are set. You can change your choice at any time from Cookie settings at the bottom of every page.

We do not use advertising or retargeting cookies.

9. How long we keep it

  • Account and profile information: while your Account is open. Closing your Account deactivates it. You can ask us to delete it using Section 12, and we will delete or anonymise your information within 30 days, except what we must keep for the reasons below.
  • Payment records and invoices: for as long as tax and accounting law requires, generally six years.
  • Programme information: as instructed by the Programme Operator.
  • Email delivery logs: 7 days.
  • Security and audit logs (support sessions, data room access, file deletions): for 2 years, or longer while needed for an investigation or a dispute.
  • Error and notification logs: for 1 year, or longer while needed for an investigation or a dispute.
  • Backups: database backups are kept for 30 days. Deleted files are kept for 30 days so they can be restored, and backup copies of files for a further 90 days.

10. Security

We protect your information with measures including encryption in transit, passwordless sign-in, role-based access, private file storage, access logs for data rooms, separation between Programmes, and daily backups. No system is completely secure. If a breach creates a risk of serious harm to you, we will tell you and the relevant authorities as the law requires.

11. Your rights

Depending on where you live, you can ask us to:

  • give you access to your personal information and a copy of it, including in a structured, commonly used format,
  • correct information that is wrong or incomplete,
  • delete your information,
  • restrict how we use your information, for example while a correction you asked for is checked,
  • tell you the information and main factors behind an automated decision, and have a person review it (Section 5),
  • withdraw consent you have given, without affecting what was done before.

Your right to object. Where we use your information on the basis of our legitimate interests, including matching and aggregate statistics, you can object at any time, and we will stop unless we have compelling grounds that override your interests or need the information for a legal claim. You can always object to direct marketing, and we will stop.

Much of your information can be edited directly on the Platform. For anything else, contact us using Section 12. We will confirm your identity and reply within 30 days. For Programme information, we may pass your request to the Programme Operator.

If you are not satisfied with our answer, you can complain to your privacy regulator, for example the Commission d’accès à l’information du Québec (www.cai.gouv.qc.ca), the Office of the Privacy Commissioner of Canada (www.priv.gc.ca), the Office of the Australian Information Commissioner (www.oaic.gov.au), the UK Information Commissioner’s Office (ico.org.uk), or the data protection authority where you live in the European Union.

12. Contact us

Our person in charge of the protection of personal information is Mickael Kanfi, Co-Founder. You can reach them at privacy@earthcollective.io, or by writing to Earth Collective Inc., 3 Kinkora Lane, Pointe-Claire, Quebec H9S 5L4, Canada.

13. Children

The Services are for people aged 18 and over. We do not knowingly collect information from anyone younger. If you believe a minor has given us information, contact us and we will delete it.

14. Changes to this notice

We may update this notice. When we make a material change, we will tell you on the Platform or by email before it takes effect, and the date below will change.

Version 4, effective Oct 5, 2026