Privacy Policy

This Privacy Policy explains how Xenon Capital Advisors LLP ("we", "us", "our", or "XCA") collects, uses, stores, and protects your personal information when you use the Xenon Capital Advisors platform ("Platform") and our services ("Services"). We are committed to protecting your privacy and handling your data responsibly. This policy applies to all users of the Platform, including visitors who use the no-login Guest Deck Score, users who create accounts, and users of any other Service.

We collect information in the following categories: (a) Account & Onboarding Information: When you sign in and complete onboarding, we collect your name, email address (from Google sign-in), LinkedIn URL, designation, startup name, sector, funding stage, funding amount, company context, and co-founder details. If you separately provide a phone number later for outreach, payment, or support, it is used for that requested service. GST number and billing address are collected at the time of your first payment for invoicing and reused for later payments. (b) Google Account Data: When you sign in with Google, we receive your name, email address, and profile picture from Google. We only request the minimum scopes necessary (openid, email, profile) and do not request access to your Gmail, Google Drive, or any other Google services beyond basic profile information. (c) Uploaded Content: Documents you upload to the Platform, including pitch decks (PDF, PPTX), term sheets, financial models, and other supplementary materials. For the no-login Guest Deck Score, we do not ask for your name or email; we collect the deck, selected sector, and optional funding stage only for the duration needed to generate the score. (d) AI Interaction Data: Your conversations with the AI chat interface, slide feedback, revision requests, and content preferences during deck design. (e) Payment Information: Transaction details including Razorpay order IDs, payment status, and amounts. We do not store your credit card numbers, bank account details, or other sensitive payment credentials — these are handled entirely by Razorpay. (f) Usage Data: Information about how you interact with the Platform, including pages visited, features used, and timestamps of activity. This is collected automatically through standard server logs. For Guest Deck Score abuse prevention, we temporarily retain a salted, one-way hash derived from connection and browser signals; we do not retain the raw IP address in the guest-attempt record. We may retain a separate anonymous result record stating whether scoring completed, failed or was abandoned and, where available, the selected sector and funding stage, score and score band, and outreach eligibility. Completed scores may be included in the aggregate empirical distribution shown to subsequent users. That anonymous record does not contain the deck, extracted deck text, name, email, company or raw IP address. (g) VC Outreach Data: Email addresses and contact information of VCs in our database, outreach campaign details, email delivery status, and response tracking data.

We use your information for the following purposes: (a) To provide and operate the Services, including generating AI-powered analyses, deck designs, outreach campaigns, and term sheet reviews. (b) To personalise your experience, including VC matching based on your sector, stage, and funding amount. (c) To process payments and generate GST-compliant invoices using your billing information. (d) To send outreach emails to VCs on your behalf from outreach@xenoncapitaladvisors.com, with you CC'd on all communications. (e) To communicate with you about your account, Services, and important updates via email. (f) To improve the Platform and Services through aggregate, anonymised usage analysis. (g) To comply with legal obligations and enforce our Terms & Conditions.

(a) Your data is stored in a PostgreSQL database hosted on Neon (neon.tech), a cloud database provider with industry-standard security practices. Data is encrypted in transit using TLS and at rest. (b) Uploaded documents used within an account (pitch decks, term sheets) are stored in cloud storage for the relevant project. A Guest Deck Score file is processed separately in dedicated private temporary storage: Xenon does not add it to an account or project, does not create a public file link, and does not share it with investors or other users. The temporary copy is deleted immediately after the scoring attempt completes or fails. If an upload is abandoned before scoring begins, an automated cleanup process ordinarily removes it within one hour and in all cases no later than 24 hours after upload. (c) OAuth tokens for Gmail integration (used in outreach modules) are stored in encrypted form and are only used for the specific purpose you authorised (sending outreach emails or term sheet responses). (d) We implement reasonable technical and organisational measures to protect your data against unauthorised access, alteration, disclosure, or destruction. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security. (e) Your session is maintained via a secure browser cookie (xenon_user_id). This cookie does not contain any personal information beyond a random identifier linked to your account.

We do not sell, rent, or trade your personal information to third parties. We share data only in the following limited circumstances: (a) Payment Processing: Payment information is shared with Razorpay solely for processing transactions. Razorpay's handling of your data is governed by their privacy policy. (b) AI Processing: Your uploaded Content and chat interactions, including the text extracted from a Guest Deck Score upload, are sent to our AI model provider (Anthropic's Claude) solely to generate the output you request. Provider-side handling is governed by our applicable API agreement and the provider's data terms. We do not use Guest Deck Score content to train Xenon models. (c) Email Services: Outreach and follow-up emails are sent through Google Workspace email infrastructure. VC email addresses are validated using Debounce.io, a third-party email verification service. (d) Email Validation: VC email addresses may be checked against third-party verification services to ensure deliverability. Only the email address is shared — no personal user data is transmitted. (e) Legal Requirements: We may disclose your information if required by law, regulation, legal process, or governmental request, or to protect the rights, property, or safety of Xenon Capital Advisors LLP, our users, or the public.

(a) Account data is retained for as long as your account is active. If you request account deletion, we will delete your personal information within 30 days, except where retention is required by law (e.g., invoicing records under GST regulations). (b) Financial records, including invoices and payment records, are retained for a minimum of 8 years in compliance with Indian tax and accounting regulations. (c) Uploaded documents associated with an account may be retained for the duration of the relevant active project and deleted upon project completion or account deletion, whichever comes first. (d) Guest Deck Score uploads are not saved to a founder account, project record, or permanent file store. Xenon deletes the temporary upload immediately after the scoring attempt completes or fails. If the visitor abandons the flow after uploading, automated cleanup ordinarily removes the file within one hour and in all cases no later than 24 hours after upload. The extracted deck text is not retained. Minimal hashed anti-abuse attempt metadata may be retained temporarily for security and fair-use enforcement; it does not contain the deck or allow the raw connection address to be reconstructed. A separate anonymous result record described in Section 2(f) may be retained for aggregate analytics and service improvement. (e) Anonymised and aggregated data that cannot be used to identify you may be retained indefinitely for analytics and service improvement purposes.

Subject to applicable law, you have the following rights regarding your personal data: (a) Access: You may request a copy of the personal information we hold about you. (b) Correction: You may update or correct your onboarding information at any time through the Platform. (c) Deletion: You may request deletion of your account and associated data by contacting support@xenoncapitaladvisors.com. Deletion is subject to our data retention obligations under applicable law. (d) Portability: You may request your data in a structured, machine-readable format. (e) Withdrawal of Consent: You may withdraw your consent for data processing at any time, though this may affect your ability to use certain Services. To exercise any of these rights, please contact us at support@xenoncapitaladvisors.com. We will respond to valid requests within 30 days.

(a) We use the following cookies: - xenon_user_id: A session identifier linking your browser to your account (persistent, 1 year) - xenon_google_profile: A temporary cookie containing your Google profile name and email for onboarding pre-fill (expires in 1 hour) The Guest Deck Score does not require an account cookie. Browser session storage may record that you accepted the upload notice so that it does not have to be repeated during the same browser session. (b) We use browser localStorage to save onboarding form drafts. This data is stored locally on your device, scoped to your user account, and is not transmitted to our servers until you submit the form. (c) We do not use third-party tracking cookies, advertising cookies, or analytics cookies.

The Platform is not intended for use by individuals under 18 years of age. We do not knowingly collect personal information from children. If we become aware that we have inadvertently collected data from a minor, we will take steps to delete such information promptly.

(a) The Platform uses AI to generate analyses, recommendations, and content. These outputs are algorithmic suggestions and are not the result of human judgement. (b) No automated decision with legal or similarly significant effect is made about you solely based on AI processing. All AI-Generated Content is presented for your review and approval before any action is taken. (c) VC matching scores are generated algorithmically based on publicly available criteria (sector, stage, geography, check size). These scores are advisory and do not restrict your ability to customise your outreach.

Your data may be processed by service providers located outside India, including: - Cloud database hosting (Neon, which may use infrastructure in the US or EU) - AI processing (Anthropic, based in the US) - Payment processing (Razorpay, based in India) Where data is transferred internationally, we ensure that appropriate safeguards are in place consistent with applicable data protection laws.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. Material changes will be communicated via the email address associated with your account or through a notice on the Platform. The "Effective Date" at the top of this page indicates when this policy was last updated. We encourage you to review this policy periodically.

In accordance with the Information Technology Act, 2000 and the rules made thereunder, the Grievance Officer for the purpose of this Privacy Policy is: Name: Vijay Krishnamurthy Designation: Managing Partner Email: support@xenoncapitaladvisors.com Address: Bangalore, India The Grievance Officer shall address any complaints or concerns regarding data processing within 30 days of receipt.

This Privacy Policy is governed by the laws of India. Any disputes arising from this policy shall be subject to the exclusive jurisdiction of the courts in Bengaluru, Karnataka, India.

For any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact: Xenon Capital Advisors LLP Bangalore, India Email: support@xenoncapitaladvisors.com