How ElevateVia handles your personal data. Which notice applies depends on where your company is registered — India's Digital Personal Data Protection Act, 2023 (DPDP), the UAE's Federal Decree-Law No. 45 of 2021 (PDPL), or — everywhere else — a GDPR-equivalent baseline this platform applies without claiming to have reviewed every country's specific law. All three notices are below. Notice version 2026.1.
We compute a Confidence Score from documents you upload. Two-thirds of what we score is company information, which this notice does not cover. The rest is personal data, and everything below applies to it.
We never store your numeric credit score (CIBIL or AECB), and we never show investors anything derived from your credit report.
You can withdraw consent for any single document at any time, from your documents page. Withdrawal deletes the file, the extracted data and the scores derived from it.
| What we extract | A score BAND only (STRONG / ADEQUATE / WATCH / THIN_FILE), account age, payment-delay history, defaults, utilisation and enquiry counts. |
| What we never store | Your numeric credit score. Not in our database, not in a log, not in an export, not in an API response. |
| Purpose | To compute pillar D (Founder Financial Conduct) of your Confidence Score — 24% of the score at pre-revenue stage. |
| Who sees it | You and ElevateVia only. Investors are never shown this document, your band, or any credit-derived detail. |
| Where it is processed | Processed only on ElevateVia's own infrastructure. Your credit report is never sent to any third-party AI provider. |
| Legal basis | You obtained this report by exercising your own right of access to your credit information. ElevateVia never requests it from a bureau. |
| Retention | 365 days from upload, or until you withdraw — whichever is first. |
| What we extract | Education detail, years of domain experience, prior founding history, employment continuity and functional coverage. |
| What we never store | Names of advisors, co-founders or referees. We count them; we do not record who they are. |
| Purpose | To compute pillar B (Founder Credibility) of your Confidence Score. |
| Who sees it | Investors see your pillar B score and reason codes, not the document. |
| Where it is processed | Text is sent to Anthropic (United States) to extract structured fields. Identifiers we do not score — PAN, GSTIN, Aadhaar, phone and email — are removed before the document is sent. It is not used to train any model. |
| Legal basis | Your consent, which you can withdraw at any time. |
| Retention | 730 days from upload, or until you withdraw — whichever is first. |
| What we extract | Market sizing, product stage, traction claims and unit economics. |
| What we never store | Named individuals. Advisor and reference counts only. |
| Purpose | To compute pillar A (Venture Proposition) of your Confidence Score. |
| Who sees it | Investors see your pillar A score and reason codes. |
| Where it is processed | Text is sent to Anthropic (United States) to extract structured fields. Identifiers we do not score — PAN, GSTIN, Aadhaar, phone and email — are removed before the document is sent. It is not used to train any model. |
| Legal basis | Your consent, plus a limited licence to store and process the deck for this purpose only. You keep all copyright in it. |
| Retention | 730 days from upload, or until you withdraw — whichever is first. |
| What we extract | Audited revenue, margins, cash, borrowings and the audit opinion. |
| What we never store | Director names or DINs, the auditor's name, firm registration number or UDIN. We record only whether each is present. |
| Purpose | To compute pillar C (Company Financial Health) of your Confidence Score. |
| Who sees it | Investors see your pillar C score and reason codes. |
| Where it is processed | Text is sent to Anthropic (United States) to extract structured fields. Identifiers we do not score — PAN, GSTIN, Aadhaar, phone and email — are removed before the document is sent. It is not used to train any model. |
| Legal basis | Your consent, which you can withdraw at any time. |
| Retention | 730 days from upload, or until you withdraw — whichever is first. |
| What we extract | A score BAND only (EXCELLENT / VERY_GOOD / GOOD / FAIR / POOR), account age, payment-delay history, defaults, utilisation and enquiry counts. |
| What we never store | Your numeric AECB score. Not in our database, not in a log, not in an export, not in an API response. |
| Purpose | To compute pillar D (Founder Financial Conduct) of your Confidence Score. |
| Who sees it | You and ElevateVia only. Investors are never shown this document, your band, or any credit-derived detail. |
| Where it is processed | Processed only on ElevateVia's own infrastructure. Your AECB credit report is never sent to any third-party AI provider. |
| Legal basis | You obtained this report by exercising your own right of access under UAE Federal Law No. 6 of 2010 Concerning Credit Information. ElevateVia never requests it from Al Etihad Credit Bureau directly — it is not on the list of entities AECB reports to. |
| Retention | 365 days from upload, or until you withdraw — whichever is first. |
| What we extract | Education detail, years of domain experience, prior founding history (including outside the UAE), employment continuity and functional coverage. |
| What we never store | Names of advisors, co-founders or referees. We count them; we do not record who they are. Emirates ID and passport numbers are redacted before this document is read by any AI provider. |
| Purpose | To compute pillar B (Founder Credibility) of your Confidence Score. |
| Who sees it | Investors see your pillar B score and reason codes, not the document. |
| Where it is processed | Text is sent to Anthropic (United States) to extract structured fields — a transfer outside the UAE, which the PDPL permits under your explicit consent to this specific transfer (Art.22). Identifiers we do not score — Emirates ID, passport, phone and email — are removed before the document is sent. It is not used to train any model. |
| Legal basis | Your explicit consent (PDPL Art.4/Art.5) — financial and identity details are treated as sensitive personal data and need a specific, not bundled, consent. Withdrawable at any time. |
| Retention | 730 days from upload, or until you withdraw — whichever is first. |
| What we extract | Market sizing, product stage, traction claims and unit economics. |
| What we never store | Named individuals. Advisor and reference counts only. |
| Purpose | To compute pillar A (Venture Proposition) of your Confidence Score. |
| Who sees it | Investors see your pillar A score and reason codes. |
| Where it is processed | Text is sent to Anthropic (United States) to extract structured fields — a transfer outside the UAE, which the PDPL permits under your explicit consent to this specific transfer (Art.22). Identifiers we do not score — Emirates ID, passport, phone and email — are removed before the document is sent. It is not used to train any model. |
| Legal basis | Your consent, plus a limited licence to store and process the deck for this purpose only. You keep all copyright in it. |
| Retention | 730 days from upload, or until you withdraw — whichever is first. |
| What we extract | Audited revenue, margins, cash, borrowings and the audit opinion. |
| What we never store | Director/signatory names, the auditor's name or licence number. We record only whether each is present. |
| Purpose | To compute pillar C (Company Financial Health) of your Confidence Score. |
| Who sees it | Investors see your pillar C score and reason codes. |
| Where it is processed | Text is sent to Anthropic (United States) to extract structured fields — a transfer outside the UAE, which the PDPL permits under your explicit consent to this specific transfer (Art.22). Identifiers we do not score — Emirates ID, passport, phone and email — are removed before the document is sent. It is not used to train any model. |
| Legal basis | Your explicit consent (PDPL Art.4/Art.5) — financial data is a sensitive category. Withdrawable at any time. |
| Retention | 730 days from upload, or until you withdraw — whichever is first. |
This platform has not individually reviewed the law of every country a founder or company might be registered in. Rather than guess which one applies, this notice applies a strict common baseline — purpose limitation, explicit consent, band-only credit storage, right to erasure — regardless of which specific country's law actually governs it.
| What we extract | A score BAND only (EXCEPTIONAL / VERY_GOOD / GOOD / FAIR / POOR), account age, payment-delay history, defaults, utilisation and inquiry counts. |
| What we never store | Your numeric credit score. Not in our database, not in a log, not in an export, not in an API response. |
| Purpose | To compute pillar D (Founder Financial Conduct) of your Confidence Score. |
| Who sees it | You and ElevateVia only. Investors are never shown this document, your band, or any credit-derived detail. |
| Where it is processed | Processed only on ElevateVia's own infrastructure. Your credit report is never sent to any third-party AI provider. |
| Legal basis | Your explicit consent. This platform has not individually reviewed the credit-reporting law of every country, so this is treated as sensitive personal data everywhere, not only where a specific statute requires it. You obtained this report by exercising your own right of access to your own credit information; ElevateVia never requests it from a bureau on your behalf. |
| Retention | 365 days from upload, or until you withdraw — whichever is first. |
| What we extract | Education detail, years of domain experience, prior founding history, employment continuity and functional coverage. |
| What we never store | Names of advisors, co-founders or referees. We count them; we do not record who they are. National ID and passport numbers are redacted before this document is read by any AI provider. |
| Purpose | To compute pillar B (Founder Credibility) of your Confidence Score. |
| Who sees it | Investors see your pillar B score and reason codes, not the document. |
| Where it is processed | Text is sent to Anthropic (United States) to extract structured fields — a cross-border transfer, which you are separately asked to consent to. Identifiers we do not score — national ID numbers, passport numbers, phone and email — are removed before the document is sent. It is not used to train any model. |
| Legal basis | Your explicit consent, which you can withdraw at any time. Treated as personal data under a GDPR-equivalent baseline regardless of which country's law actually governs it. |
| Retention | 730 days from upload, or until you withdraw — whichever is first. |
| What we extract | Market sizing, product stage, traction claims and unit economics. |
| What we never store | Named individuals beyond the founders themselves. Advisor and reference counts only. |
| Purpose | To compute pillar A (Venture Proposition) of your Confidence Score. |
| Who sees it | Investors see your pillar A score and reason codes. |
| Where it is processed | Text is sent to Anthropic (United States) to extract structured fields — a cross-border transfer, which you are separately asked to consent to. Identifiers we do not score — national ID numbers, passport numbers, phone and email — are removed before the document is sent. It is not used to train any model. |
| Legal basis | Your consent, plus a limited licence to store and process the deck for this purpose only. You keep all copyright in it. |
| Retention | 730 days from upload, or until you withdraw — whichever is first. |
| What we extract | Audited revenue, margins, cash, borrowings and the audit opinion, under whichever reporting standard the report itself uses. |
| What we never store | Director/signatory names, the auditor's name or registration reference. We record only whether each is present. |
| Purpose | To compute pillar C (Company Financial Health) of your Confidence Score. |
| Who sees it | Investors see your pillar C score and reason codes. |
| Where it is processed | Text is sent to Anthropic (United States) to extract structured fields — a cross-border transfer, which you are separately asked to consent to. Identifiers we do not score — national ID numbers, passport numbers, phone and email — are removed before the document is sent. It is not used to train any model. |
| Legal basis | Your explicit consent — financial data is treated as a sensitive category under the GDPR-equivalent baseline this notice applies. Withdrawable at any time. |
| Retention | 730 days from upload, or until you withdraw — whichever is first. |
You may access, correct, or erase your personal data, and nominate another person to exercise these rights on your behalf. Use your documents page, or contact us.
Contact: privacy@elevatevia.com
If we do not resolve your complaint: India-registered companies may complain to the Data Protection Board of India; UAE-registered companies may complain to the UAE Data Office; companies registered elsewhere may have their own country's data-protection authority to complain to, which this platform has not individually identified for every country.