Privacy Policy

Avise (“Avise”, “we”, “us”) provides a deal management and document analysis platform to businesses. You can reach us at hello@pocket-fund.com.

Two different relationships apply, and they carry different obligations:

• Customer content — the documents, financials, deal records and contact details you upload or create in the product. We process this on your instructions as a processor. Your organisation remains the controller of it.
• Account and website data — the information we hold about the individuals who administer or use an account, and about visitors to this website. We are the controller of this.

• Account data — name, work email address, organisation, role and authentication credentials. Passwords are stored only as hashes.
• Customer content — documents you upload, extracted financial data, memos, deal and pipeline records, tasks, and contact records you enter or import.
• Usage and security logs — actions taken in the product, timestamps, IP address, user agent and request identifiers. These populate the audit trail described in section 6.
• Enquiry data — anything you send us through the contact form or by email.

We do not seek out special category personal data and ask that you do not upload it. We do not sell personal data, and we do not share it with advertising networks or data brokers.

• To provide the product — extracting figures from documents you upload, generating analyses and memo drafts, and running the pipeline, data room and contact features.
• To authenticate users, enforce organisation and deal-level access controls, and maintain the audit trail.
• To keep the service secure and reliable — rate limiting, abuse detection, error monitoring and diagnosing faults.
• To bill for the service and to correspond with you about it.
• To meet legal obligations and to establish or defend legal claims.

Where the UK GDPR or EU GDPR applies, we rely on performance of a contract for providing and billing the service, legitimate interests for security, service improvement and business correspondence, and legal obligation where a law requires the processing. Customer content is processed on your documented instructions under a data processing agreement.

Document extraction, analysis and memo drafting work by sending the contents of the documents you upload to named AI sub-processors. We do not claim that your data never leaves our systems, because that is not how the product functions.

• OpenAI — text and vision extraction from documents, analysis generation and memo drafting, under enterprise API terms.
• Microsoft Azure — Azure Document Intelligence, for document layout and table structure.

Under the enterprise terms on which we contract with these providers, customer content is not used to train their models. Output produced by these systems is generated text and figures, and is checked by a verification pass against the source document, but it is not a substitute for professional judgment. No decision producing a legal or similarly significant effect on an individual is made by automated means.

Alongside the AI providers above, we use Supabase for the database, authentication and document storage, and Vercel for application hosting. Each of these providers holds its own SOC 2 Type II certification covering its own platform; those certifications are the providers’ and are not certifications of Avise. Our own certification status is set out on the security page.

We may also disclose data where we are legally required to, and to a successor entity in the event of a merger or acquisition, in which case we will give notice before customer content changes hands. A current list of sub-processors is available on request.

Customer data is hosted in a United States AWS region. There is no customer-selectable region at present. If you are transferring personal data out of the UK, EEA or another restricted jurisdiction, the data processing agreement includes the standard contractual clauses.

Audit log entries are insert-only and retained for two years. Account and customer content are retained for the life of the account and for a short period afterwards to allow for export and reversal of accidental deletion, after which they are removed. Backups age out on their own cycle.

Data is encrypted in transit and at rest. Access is scoped by organisation, by role and by deal team membership, and requests for another organisation’s records return a not-found response so that the existence of a record cannot be probed. The full posture, including what we are not yet certified for, is on the security page.

No system is without risk. If we become aware of a breach affecting your data, we will notify you without undue delay and give you what we know, including what we do not yet know.

Depending on where you live, you may have the right to access a copy of your personal data, correct it, delete it, restrict or object to its processing, receive it in a portable format, and complain to a supervisory authority. To exercise any of these, write to hello@pocket-fund.com.

If your data sits inside a customer’s account, we will normally refer your request to that customer, since they control the content. We support deletion of customer data on request, including documents in storage.

The application uses cookies that are strictly necessary to keep you signed in and to protect the session. This marketing site uses no advertising or cross-site tracking cookies. Where we use analytics to understand which pages are read, it is configured so as not to build profiles of individuals.

The service is sold to businesses and is not directed at anyone under 18. We do not knowingly collect data from children.

We will update this page when our practices change and revise the date at the top. Material changes affecting customer content will be notified to account administrators by email.

Questions about this policy, requests for our data processing agreement, or requests for the current sub-processor list should go to hello@pocket-fund.com, or through the contact page.