Privacy Policy

Lenz is a fundraising workspace for founders, run by [TO CONFIRM: legal name of the person or company that operates Lenz] ("Lenz", "we", "us"). This policy explains what we collect when you use heylenz.app, why, and what you can ask us to do with it.

Lenz is in early access. We will update this page as the product changes, and the date above always shows the latest version.

What we collect

When you join the waitlist. Your email address, and, if you give them, your name, company, fundraising stage and a note. We use these to decide when to invite you and to contact you about Lenz.

When you have an account. Your email address and name. To sign you in we email you a one-time code. We keep a record of your active sessions, including the IP address and browser they came from, so we can keep your account secure.

What you put in your workspace. Investor lists, contact details (such as names, email addresses and LinkedIn profiles), notes, pipeline records, drafts and anything else you add or ask Lenz to create. This content belongs to you. We process it only to provide Lenz to you and the members of your workspace.

If you connect Gmail. See Gmail below.

To prevent abuse. We count sign-in and waitlist attempts to rate-limit them. These counters store a one-way hash of the email address or IP address, not the address itself.

We do not buy personal data, and we do not sell or rent the data we hold.

Gmail

Connecting Gmail is optional. If you connect it, you grant Lenz two Google permissions:

• Read your email (gmail.readonly), so Lenz can find conversations with investors and replies to messages you sent, and keep your pipeline up to date.
• Create and manage drafts (gmail.compose), so Lenz can write drafts in your Gmail and, after you approve one, send it.

Lenz never sends an email you have not approved. We store the access tokens Google gives us encrypted (AES-256-GCM). You can revoke Lenz's access at any time from your Google Account permissions, or ask us to disconnect it and delete the tokens.

Lenz's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• we use Gmail data only to provide the features you see in Lenz;
• we do not use it for advertising, and we do not sell it;
• people at Lenz do not read it, except with your permission, to investigate a security incident, or where the law requires it;
• we do not use it to train general-purpose AI models.

AI features

Some Lenz features use AI models to research investors and draft messages. When you use them, the relevant workspace content, such as the investor details and instructions involved, is sent to our AI provider, Anthropic, to produce the result. Anthropic processes it on our behalf and does not use it to train its models.

Cookies

Lenz sets one cookie: the session cookie that keeps you signed in. It is strictly necessary, so we do not ask for consent to it. We do not use analytics, advertising or tracking cookies, and the public pages of heylenz.app set no cookies at all.

Who processes your data

We use these service providers to run Lenz. Each one processes data only on our instructions.

These providers may process data in the United States and other countries. Where the law requires it, we rely on appropriate safeguards for these transfers, such as the European Commission's Standard Contractual Clauses.

We may also disclose data if the law requires it, or to protect the rights and safety of our users or of Lenz.

How long we keep it

• Waitlist entries: until you ask us to remove yours, or until Lenz stops running the waitlist.
• Account and workspace data: for as long as your account exists. When you ask us to delete your account or a workspace, we delete that data within 30 days, except where the law requires us to keep it longer.
• Gmail tokens: until you revoke access, ask us to disconnect Gmail, or your account is deleted.

Your rights

You can ask us to:

• give you a copy of your personal data;
• correct it;
• delete it;
• stop processing it, or restrict how we process it.

Depending on where you live, for example in the EU, the UK, California or India, the law may give you further rights, including the right to complain to your local data protection authority.

To make a request, email [TO CONFIRM: privacy contact email]. We will reply within 30 days.

Security

Data is encrypted in transit (HTTPS) and at rest by our database provider, and Gmail tokens are also encrypted at the application level. No system is perfectly secure. If a breach affects your data, we will tell you without undue delay.

Children

Lenz is for founders and their teams. It is not meant for anyone under 18, and we do not knowingly collect data from children.

Changes

If we change this policy in a way that matters, we will update the date above and, if you have an account, email you before the change takes effect.

Contact

Questions about this policy: [TO CONFIRM: privacy contact email].