1. Introduction

VentureFlow is a custom CRM platform developed for Pack Ventures to manage venture capital deal flow, portfolio companies, and team collaboration. This Privacy Policy explains how we collect, use, store, and protect your information when you use our service.

Pack Ventures is committed to protecting your privacy and ensuring the security of your data. We only collect and process data necessary to provide and improve our CRM services.

2. Information We Collect

2.1 Authentication Information

When you sign in to VentureFlow using Microsoft OAuth 2.0, we collect:

• Your Microsoft account email address
• Your display name
• Your Microsoft Object ID (a unique identifier for your account)

We do not store your Microsoft password. Authentication is handled entirely by Microsoft's trusted identity platform.

2.2 Email Synchronization Data

With your consent, VentureFlow synchronizes emails from your Microsoft Outlook account to link communications with portfolio companies. We collect:

• Email subject lines
• Sender and recipient email addresses and names
• Email timestamps
• Email message IDs (for deduplication)

Email synchronization uses Microsoft Graph API and requires explicit permission during the authentication process.

2.3 CRM Data

Information you enter into VentureFlow, including:

• Company profiles (names, websites, descriptions, funding information)
• Contact information (names, email addresses, LinkedIn profiles)
• Deal pipeline status and notes
• Relationship mappings between contacts and companies

2.4 Usage Information

We collect limited usage data for performance monitoring and error tracking:

• API endpoint access logs
• Database query performance metrics
• Application error logs

3. How We Use Your Information

We use the information we collect to:

• Provide CRM functionality: Manage deal flow, track portfolio companies, and organize communications
• Authenticate users: Verify your identity and manage secure access to the platform
• Synchronize emails: Link email communications with relevant portfolio companies
• Improve our service: Monitor performance, identify bugs, and enhance user experience
• Ensure security: Detect and prevent unauthorized access or misuse

4. How We Store Your Information

4.1 Data Storage

All VentureFlow data is stored in a PostgreSQL database hosted on Microsoft Azure in the United States. We implement industry-standard security measures:

• Encryption in transit: All data transmitted to and from VentureFlow is encrypted using HTTPS/TLS
• Encryption at rest: Database data is encrypted using Azure's encryption services
• Daily backups: Automated daily backups ensure data recovery capability
• Access controls: Database access is restricted to authorized personnel only

4.2 Data Retention

We retain your data for as long as your account is active or as needed to provide services. Session data expires automatically after 7 days of inactivity. Application logs are retained for 30 days for troubleshooting purposes.

5. Who Has Access to Your Information

5.1 Pack Ventures Team Members

VentureFlow is an internal tool for Pack Ventures. Only authenticated Pack Ventures team members can access the CRM platform and its data. Access is controlled through Microsoft OAuth 2.0 authentication.

5.2 Third-Party Services

We use the following third-party services, which may have access to limited data:

• Microsoft Azure: Cloud hosting infrastructure and database services
• Microsoft Graph API: Email synchronization (only with your explicit consent)
• Microsoft OAuth 2.0: User authentication and identity verification

These services are bound by their own privacy policies and industry-standard security practices.

5.3 Data Sharing

We do not sell, rent, or share your personal information with third parties for marketing purposes. We may disclose information only if required by law or to protect our legal rights.

6. Your Rights and Choices

You have the following rights regarding your data:

• Access: You can request access to the personal information we hold about you
• Correction: You can update or correct your information through the CRM interface
• Deletion: You can request deletion of your account and associated data
• Email sync control: You can revoke email synchronization permissions through your Microsoft account settings
• Logout: You can end your session at any time by logging out

To exercise these rights or for data-related inquiries, please contact us using the information below.

7. Security Measures

We implement comprehensive security measures to protect your data:

• HTTPS encryption for all data in transit
• Strict Transport Security (HSTS) to enforce HTTPS connections
• Content Security Policy (CSP) headers to prevent XSS attacks
• X-Frame-Options headers to prevent clickjacking
• Session-based authentication with automatic expiration
• Regular security testing and vulnerability assessments

8. Cookies and Session Management

VentureFlow uses a single session cookie to maintain your authenticated state. This cookie:

• Is created only after successful Microsoft OAuth 2.0 authentication
• Expires after 7 days of inactivity
• Is marked as secure (HTTPS-only) and HTTP-only (not accessible to JavaScript)
• Contains only a session token, not personal information

We do not use tracking cookies or third-party analytics cookies.

9. Children's Privacy

VentureFlow is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us immediately.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal and regulatory reasons. The "Last Updated" date at the top of this policy indicates when it was last revised. We encourage you to review this policy periodically.

Material changes to this policy will be communicated through the VentureFlow platform or via email to registered users.

11. Contact Us