Privacy Policy
Last updated: 13 June 2026
1. Who we are
Catalyst Ventures ("Catalyst Ventures", "we", "our" or "us") is a biotech investment-research platform operated by CARTER CONSULTING, the data controller responsible for your personal data under the EU General Data Protection Regulation (Regulation (EU) 2016/679, the "GDPR") and the Irish Data Protection Act 2018.
This policy explains what personal data we collect when you use catalyst-ventures.eu, why we process it, who we share it with, how long we keep it, and the rights you have over it.
Controller: CARTER CONSULTING
Registered address: Dublin, Ireland
Privacy & data-rights contact: privacy@catalyst-ventures.eu
We have not appointed a Data Protection Officer, as we are not required to under Article 37 GDPR. The contact above is monitored for all privacy matters.
2. The personal data we collect
Depending on how you use the platform, we process the following categories of personal data:
| Category | Examples | Source |
|---|---|---|
| Identity & account data | Name, email address, profile image, and your account identifier | You, via our authentication provider (Clerk) when you sign up |
| Research activity data | Watchlist tickers, sentiment votes, comments, feedback and interactions you submit | You, as you use the platform |
| Simulated-portfolio data | Paper-trading holdings and any Trading 212 paper-portfolio data you choose to mirror | You |
| Billing data | Billing address, country, optional EU VAT ID, subscription and payment-status records (card details are handled solely by Stripe — we never see or store your full card number) | You, via our payment processor (Stripe) |
| Technical & usage data | IP-derived approximate location, device/browser information, and first-party product analytics events (e.g. report views, sign-up and checkout steps) | Automatically, as you use the platform |
3. How and why we use your data (purposes & lawful bases)
We only process your personal data where we have a lawful basis to do so under Article 6 GDPR:
| Purpose | Lawful basis |
|---|---|
| Creating and operating your account; providing the research platform and its features | Performance of a contract (Art 6(1)(b)) |
| Generating your personalised watchlist briefs (your watchlist tickers are sent to our AI provider to produce the brief) | Performance of a contract (Art 6(1)(b)) |
| Processing subscriptions, payments and invoicing | Performance of a contract (Art 6(1)(b)); compliance with a legal obligation for tax and accounting records (Art 6(1)(c)) |
| Measuring and improving the product through first-party analytics; securing the platform and preventing abuse | Our legitimate interests in operating, securing and improving the service (Art 6(1)(f)) |
| Sending you optional product and marketing updates (newsletter) | Your consent (Art 6(1)(a)), which you may withdraw at any time |
4. Cookies and similar technologies
We keep storage on your device to the minimum needed to run the service. We use only strictly necessary storage, which does not require your consent:
- Authentication and session storage set by our login provider (Clerk) and by Google Firebase, so you can sign in and stay signed in.
- A small local-storage flag that remembers when you dismiss the on-site disclaimer banner.
We do not use advertising cookies and we do not use third-party analytics or tracking services such as Google Analytics or Google AdSense. Product analytics are captured as first-party events stored in our own database and are not shared with any advertising network. Because we set no non-essential third-party tracking technologies, no cookie-consent banner is required.
5. Who we share your data with
We do not sell your personal data, and we never will. We share it only with the service providers ("processors" and sub-processors) that we rely on to run the platform, each bound by a data-processing agreement:
| Provider | Role | Location | Data involved |
|---|---|---|---|
| Google Firebase (Firestore, Authentication, Hosting, Cloud Functions) | Core data storage & compute | United States | All account and platform data at rest |
| Clerk | Authentication / identity | United States | Email, name, profile image, account identifier |
| Stripe | Payments & subscriptions | United States / EU | Billing address, country, optional VAT ID, payment and subscription records |
| Google (Gemini API) | AI text generation | United States | Your watchlist tickers, sent transiently to generate your briefs (no copy is stored by the provider) |
| DeepSeek | AI text generation for company/market research | People's Republic of China | Public company and market data only — no user-identifying personal data is sent to this provider |
We may also disclose personal data where required by law, to enforce our terms, or to protect the rights, safety and property of our users or ourselves.
6. International data transfers
Our core database and several of our providers are located in the United States, so your personal data is transferred outside the European Economic Area (EEA) and hosted in the US. Where we transfer personal data outside the EEA, we rely on appropriate safeguards under Chapter V GDPR, namely the European Commission's Standard Contractual Clauses incorporated into our providers' data-processing agreements, and — where applicable — the providers' certification under the EU–US Data Privacy Framework.
You can request a copy of the relevant safeguards by contacting us at privacy@catalyst-ventures.eu.
7. How long we keep your data
| Data | Retention |
|---|---|
| Account, profile, watchlist, comments, votes and simulated-portfolio data | For as long as your account is active; deleted when you delete your account (see Section 8) |
| Sentiment scores and written feedback you submit on companies | Automatically deleted 12 months after you submit them |
| In-app notifications (e.g. report-ready and price-alert messages) | Automatically deleted 90 days after they are sent |
| First-party product-analytics events (e.g. page and report views) | Held in pseudonymous form for service improvement and automatically deleted 14 months after the event; not tied to your account after deletion |
| Billing, invoice and tax records | Retained for approximately six years after the transaction to meet Irish tax and accounting obligations, even after account deletion (Art 17(3)(b) GDPR) |
| Newsletter subscription | Until you unsubscribe or ask us to delete it |
8. Your rights
Under the GDPR you have the right to:
- Access the personal data we hold about you, and receive a copy of it;
- Rectify inaccurate or incomplete data;
- Erase your data ("right to be forgotten");
- Restrict or object to our processing;
- Data portability — receive your data in a structured, machine-readable format;
- Withdraw consent at any time, where processing is based on consent.
You can delete your account at any time, which automatically and permanently erases your profile, watchlist, votes, comments, interactions and simulated-portfolio data across our systems, and cancels any active subscription (billing records are retained only as described in Section 7). To exercise any other right, email privacy@catalyst-ventures.eu. We will respond within one month, as required by Article 12(3) GDPR.
9. How we protect your data
We apply appropriate technical and organisational measures to protect your personal data, including encryption in transit, access controls and database security rules that restrict who can read or write each type of record. No method of transmission or storage is completely secure, but we work to protect your data and to address any incident promptly.
10. Children
The platform is intended for adult investors and is not directed at children. We do not knowingly collect personal data from anyone under the age of 18. If you believe a minor has provided us with personal data, please contact us and we will delete it.
11. Automated decision-making
We do not make decisions producing legal or similarly significant effects about you based solely on automated processing. Our AI-generated research and sentiment scores are informational interpretations of public information and are not automated decisions about you.
12. Changes to this policy & how to contact us
We may update this policy from time to time. When we do, we will revise the "Last updated" date above and, for material changes, take reasonable steps to notify you.
For any privacy question or to exercise your rights, contact privacy@catalyst-ventures.eu.
You also have the right to lodge a complaint with your local data-protection authority. Our lead supervisory authority is the Irish Data Protection Commission (dataprotection.ie).