Legal

Privacy policy

This version is dated 27 October 2026 and replaces the version of 21 October 2026. Questions about it go to privacy@ikonetu.com.

1. Who we are

IkonetU Technology Limited runs the IkonetU website and app. In this policy, “IkonetU”, “we” and “us” mean that company. We decide how and why your personal data is used, so we are its controller under UK data protection law.

Controller: IkonetU Technology Limited
Company number: 17110122, registered in England and Wales
Registered office: Maisonette 3, 23 Watkins Road, Leicester, United Kingdom
Privacy contact: privacy@ikonetu.com
General contact: info@ikonetu.com

We have not appointed a data protection officer. Our privacy contact answers every question about personal data and every request to use your rights, at privacy@ikonetu.com.

This policy covers visitors to the website, founders who create a profile, investors who create an account, people whose details a founder includes in a profile or in evidence, and anyone who writes to us.

2. The personal data we hold

The table lists every kind of personal data that IkonetU holds, and where each kind comes from.

Data	What it includes	Where it comes from
Sign-in details	Your email address, and a record of each sign-in with its time, your IP address and the description your browser gives of itself. IkonetU does not offer sign-in by phone yet.	You give your email address. Your browser supplies the rest when you sign in.
Founder profile	Your name, country and city, a short biography, the university, college or institution you study at or graduated from, your student or graduate status, and when you confirmed being a student founder. Your venture's name, sector, stage, country and description, the amount you are raising and what for, and its registration number, website and social media addresses if you add them.	You give it.
Pitch	Your pitch video, which shows your face and carries your voice, and the transcript you type for it.	You give it.
Evidence	The documents, images and links you add as evidence, and the summary you write for each. Evidence can include identity documents such as a passport or a national identity card, proof of address, academic records, company records, financial records, bank statements and customer information. It also includes statements you make about yourself or your venture, such as having named a next of kin.	You give it. A reviewer may also compare it with a public register or another source that it names.
Review records	Each reviewer's decision on a piece of evidence, the status it gives, the date, the public note and the reason recorded.	IkonetU reviewers make them.
IkonetU Score	Your score, its league, the points in each of its eleven areas, and a monthly record of these.	We calculate it from your evidence.
Activity	A record of each step of progress on your venture: publishing your profile, adding or replacing your pitch, setting out what you are raising, evidence that is approved, and introductions you accept.	The app records it as you make progress.
Investor profile	Your name, investor type, fund or firm, website or LinkedIn address, where you are based, the sectors, stages and countries you invest in, your typical cheque size and what you look for. Your confirmation that your investor type describes you, and our decision to approve or decline your account.	You give it. IkonetU admins record the decision.
Introductions and messages	Each request for an introduction and its note, the founder's answer, and the messages in the conversation that follows.	The founder and the investor give them.
Your choices	Your answers to the optional questions at sign-up, your confirmation that you are 18 or older, and the version of this policy you read, each with its date.	You give them.
Moderation and safety records	Reports, our decisions on them, suspensions and their reasons, profiles hidden from investors and why, and a log of what each IkonetU reviewer and admin changed.	Users and IkonetU staff create them.
Messages to us	What you write to us by email, and our replies.	You give them.
Technical records	Records of each request to the app, which can include your IP address, the address requested and the time.	Your browser supplies them.
People a founder names	The names and details of team members, customers, referees, a next of kin and other people that a founder includes in a profile, a pitch or evidence.	The founder gives them.

We do not ask for information about your health, religion, ethnic origin, political opinions, trade union membership, sex life or sexual orientation, or for any criminal record. Please leave such information out of your profile and your evidence. Identity documents and pitch videos show your face, and we do not use them to identify you by automated means such as face recognition.

The website uses no analytics, so we do not track which pages you visit or what you click.

3. Why we use it and our lawful basis

UK data protection law allows us to use personal data only when we have a lawful basis. The table gives the basis for each use.

Purpose	Lawful basis
Signing you in and keeping your account secure	Contract. We need it to give you the account you asked for.
Showing your founder profile to approved investors once you publish it, and your venture's activity to founders and approved investors	Contract. Showing your profile and its activity is the service you ask for when you publish it.
Reviewing the evidence you add	Contract. When you add evidence, you ask us to review it.
Calculating your IkonetU Score and showing it to you	Contract. The score is part of the service we give founders.
Checking and approving investor accounts, and keeping the statements that UK investors give	Legitimate interests. We let only genuine investors see founders' information, and we keep the evidence that UK law expects of us.
Introductions and conversations	Contract. We need it to pass requests and messages between you and the other user.
Handling reports, moderating content, suspending accounts and keeping the staff log	Legitimate interests in keeping users safe and the service honest, and legal obligation where the Online Safety Act 2023 requires it.
Answering your messages and requests	Legitimate interests in answering you, and legal obligation when you use a data protection right.
Protecting IkonetU and its users from fraud, misuse and attacks	Legitimate interests in keeping the service secure.
Showing information about people a founder names	Legitimate interests. Founders and investors need to see a venture's real team, customers and references, and we limit what is shown to that purpose.
Using a founder's pitch in IkonetU's own marketing	Consent, which the founder gives separately and can withdraw.
Keeping records and dealing with legal claims	Legal obligation, and legitimate interests in establishing and defending our legal position.

Where we rely on legitimate interests, we have weighed our interests against yours, and you can object, as section 8 explains. Where we rely on consent, you can withdraw it at any time by writing to privacy@ikonetu.com. Withdrawing consent does not affect what we did before.

At sign-up we ask whether you would like notifications about your evidence and introductions. IkonetU does not send them yet, and we keep your answer for when it does. Supabase sends the emails that carry your sign-in link or code, on our behalf. We do not send marketing email, and we will ask for your consent before we send any.

4. The IkonetU Score and the readiness self-check

The IkonetU Score is a number from 0 to 1,000. The app calculates it automatically from the evidence on a founder's profile, using a published set of rules that gives points for each kind of evidence in eleven areas. Evidence counts once a reviewer approves it, and some statements count as soon as the founder makes them. The score places a founder in one of four leagues: Early, Rising, Investable and Elite.

Data protection law calls this profiling. Only the founder and IkonetU staff see the score. Investors do not see it, and investor search sorts founders by company name, never by score. We do not use the score to make any decision about you. People decide on evidence, on investor accounts and on moderation.

You can ask us how your score was worked out, ask a person to review a status that affects it, and object to the profiling, by writing to privacy@ikonetu.com.

The readiness self-check on the website runs in your browser. It needs no account, and it neither sends nor saves your answers.

5. Who sees your data

Approved investors see a published founder profile: the pitch, the profile details, the amount being raised, the summaries and statuses of the evidence, and the venture's activity. They do not see the documents behind the evidence, the IkonetU Score, or a founder's email address or phone number.
Founders and approved investors see the activity feed. It names each published venture with its sector and country, and says what happened: the profile was published, a pitch was added or replaced, the founder set out what they are raising, a piece of evidence was approved by a reviewer or backed by an outside source, or the founder accepted an introduction. It describes the investor in an introduction by type only, such as an angel investor, and never by name or firm. It never shows the IkonetU Score, the documents behind evidence, a founder's own words or the messages of a conversation. A venture leaves the feed while its profile is hidden.
A founder sees the name, investor type and firm of an investor who asks for an introduction. Once the founder accepts, both of them see the messages in their conversation.
IkonetU reviewers see evidence and its documents in order to review it. IkonetU admins see accounts, profiles and records in order to run and moderate the service. Documents open only through links that expire after five minutes.
Supabase holds our database, our sign-in service and the files you upload, and sends sign-in emails. Render runs the app and keeps records of requests to it. Each of them acts only on our instructions, under a data processing agreement with us.
Our professional advisers, such as lawyers and accountants, see personal data when we need their advice, and they owe us a duty of confidence.
The police, regulators, courts and other authorities receive personal data when the law requires it, or when it is needed to prevent fraud or to protect someone's safety.
A buyer of IkonetU's business or its assets would receive personal data, and would have to use it in line with this policy.

We do not sell personal data, and we do not share it with advertisers.

6. Where your data is stored and when it leaves the UK

Your data is stored in London, in the United Kingdom. The app that reads it runs on Render's servers in Frankfurt, Germany, which is in the European Economic Area. UK law treats the European Economic Area as protecting personal data adequately, so no further safeguard is needed for that.

Supabase and Render are companies based in the United States. If either of them reaches your data from outside the UK or the European Economic Area, for example to give technical support, the safeguards in its data processing agreement with us apply.

Founders and investors outside the UK send their data to us in the United Kingdom when they use IkonetU. We protect that data under UK data protection law and this policy, and we meet the conditions that the law of their country sets for sending personal data abroad.

An investor who receives information through IkonetU may be in another country. Each investor is responsible for that information under the law that applies to the investor and under our investor terms.

7. How long we keep it

We keep personal data only as long as we need it. At the end of each period below, we delete the data or remove everything that identifies you.

Data	How long we keep it
Account and sign-in details	While your account is open, and for one year after it closes.
Records of each sign-in, with IP addresses	One year from the sign-in.
Founder profile, activity and IkonetU Score	While your profile exists, and for one year after it is deleted.
Pitch video	While it is on your profile. The app deletes the video when you replace or remove it. We delete the current video within one year after your profile is deleted.
Evidence files, including identity documents	While the evidence is on your profile. We delete them within 30 days after your account closes.
Review records and evidence statuses	While the evidence is on your profile, and for one year after your account closes.
Investor profile and our decision on it, and any UK investor statement	While your account is open, and for one year after it closes.
Introductions and messages	While either account is open, and for one year after the second account closes.
Your choices and consents	While your account is open, and for six years after it closes, so that we can show what you agreed to.
Reports, moderation decisions and the staff log	Six years after the decision.
Messages to us	One year after the matter is closed, or six years if it concerns a complaint or a legal claim.
Technical records of requests	Render keeps them for a limited period that its service sets, and we do not copy them elsewhere.
Legal and accounting records	As long as the law requires.

Deleted data can remain in our providers' backups until those backups are overwritten in their normal cycle. Nobody uses data from a backup except to restore the service.

8. Your rights

You have these rights over your personal data:

You can ask for a copy of the personal data we hold about you.
You can ask us to correct data that is wrong or incomplete.
You can ask us to delete your data. We will, unless we need to keep part of it for a reason this policy gives, such as a legal claim.
You can ask us to stop using your data while we deal with a complaint about it.
You can object to any use that relies on legitimate interests, including the profiling behind the IkonetU Score.
You can ask for the data you gave us in a common electronic format, to keep or to pass to someone else.
You can withdraw any consent you gave.
You have the right not to be subject to a decision made solely by automated means that has a legal or similarly significant effect on you. We do not make such decisions.

Write to privacy@ikonetu.com from the email address on your account. We may ask you to confirm who you are. We answer within one month. If a request is complex, or if you send several, we may take up to two more months, and we will tell you why within the first month. We do not charge for a request unless it is clearly unfounded or excessive.

If you live outside the UK, the data protection law of your country may give you further rights, and you can use them by writing to us in the same way.

If you are unhappy with how we use your data, please tell us first so that we can put it right. You can also complain to a data protection regulator:

In the United Kingdom, the Information Commissioner's Office, at ico.org.uk.
In another country, its data protection authority. In Nigeria, for example, that is the Nigeria Data Protection Commission, in Ghana the Data Protection Commission and in Kenya the Office of the Data Protection Commissioner.

9. How we protect your data

You sign in with a one-time link or code sent to your email address, so there is no password to steal or reuse.
The cookies that hold your sign-in cannot be read by scripts on the page, and your browser sends them only over secure connections.
All traffic to the app is encrypted in transit.
Pitches and evidence files sit in private storage. They open only through links that expire, after one hour for a pitch and five minutes for a document.
The database checks each request against the account that makes it, so one user cannot read another user's private records.
Reviewers and admins have only the access their role needs, and the app records what each of them changes.

Keep the email account you sign in with secure, because anyone who controls it can sign in as you.

If a breach puts personal data at risk, we will tell the Information Commissioner's Office within 72 hours of learning of it, and any other regulator whose law requires notice. If the breach is likely to put you at high risk, we will tell you without undue delay what happened and what you can do.

10. Children

IkonetU is for people aged 18 or over. Sign-up asks each person to confirm that they are 18 or older. If we learn that a person under 18 has an account, we close it and delete its data.

11. Changes to this policy

We post each new version of this policy here with its date. If a change affects how we use your data in a way you would not expect, we will tell you by email or in the app before the change takes effect.

The cookie policy explains what IkonetU stores on your device.