Privacy Policy — Maelstrom AI

In short: We collect what you tell us and what we need to run matching. Your intent is shown to people in complementary positions — that's the product. We never sell your personal information. We never see your card details. AI providers process your intake conversation but do not train on it.

1. Who is responsible

Maelstrom AI Technologies, Inc., of 300 Creek View Road, Newark, DE 19711, is the controller of personal data processed through Maelstrom AI. Contact us at admin@maelstrom.it.com or 630-649-9958 (Text Only).

Where you buy a subscription, Paddle.com Market Limited acts as merchant of record and is an independent controller of the payment data it collects. See Paddle's privacy policy.

2. What we collect

Category	What it includes	Where it comes from
Account	Email address, name, headline, plan, verification status	You
Intent content	Your position, the counterparty you seek, industries, regions, deal size, stage, timeline, dealbreakers, and free-text descriptions	You, via the intake conversation or forms
Matching activity	Introductions offered, accepts and declines, matches formed, meetings marked booked, feedback ratings	Generated by your use
Messages	Content of match threads	You and your counterparty
Rooms	Rooms you create or join, room names, membership	You
Integrations	Scheduling and video links you add	You
Calendar availability	If you connect a calendar: free/busy blocks only — the start and end times you are unavailable. We do not request or receive event titles, descriptions, attendees, locations, or attachments.	Google Calendar or Microsoft 365, with your authorization
Calendar and call-app credentials	An OAuth refresh token for each provider you connect (Google, Microsoft or Zoom), the permissions granted, and the account's email address. Tokens are encrypted at rest and never sent to your browser.	Your calendar or call provider
Profile	Bio, location, website, profile picture, banner, accent colour, and your profile visibility setting. For organizations: company name, logo, banner, colours, and bio.	You, or your organization's administrator where profiles are centrally managed
Identity verification	If you verify your identity: the status of the check, our provider's reference for it, and a one-way salted hash used only to detect the same person registering twice. We never receive or store your document image, ID number, date of birth, or address — the provider performs the check and returns a result.	Our identity verification provider
Scheduling	Your timezone, weekly available hours, buffer, notice and horizon settings, your reschedule notice and limit preferences, blocked dates, and the meetings you propose or confirm through Maelstrom (time, duration, and the match it belongs to).	You
Contacts you import	Names, and optionally emails, companies, roles, notes and tags for people you already track. These people are not Maelstrom members and are never contacted. No account is created for them, they never enter matching, and the records are visible only to you. You can export or delete them at any time. If an imported contact later deletes a Maelstrom account you had linked them to, the link is removed.	You, by import
Files you attach	Documents you attach to a conversation or deal room, along with the filename, type and size. Only you and that counterpart can open them (and, if either of you is a firm, the colleagues working that deal, see section 11). We validate the type and check the contents match it, but we do not scan for malware. Removing a file deletes it from our storage; we cannot recall a copy already downloaded.	You
File views	Each time someone opens a file shared in a match: which file, who opened it, and when. Shown to the person who shared the file.	Generated when a file is opened
Confidentiality agreements (NDAs)	If an intent requires an NDA: the NDA text its owner chose (or our standard text), and for each acceptance, who accepted, a fingerprint of the exact text accepted, when, and the network address and browser description it was accepted from, as evidence of the agreement.	You, and the person accepting
Notification preferences	How often you want each kind of message, and any quiet hours you set. Messages held for a digest are stored until sent and deleted two weeks after.	You
Your notes about others	Private notes, tags, follow-up reminders and stage labels you attach to a counterpart. These are visible only to you. They are never shown to the person they concern, are not searchable by them, and do not appear in their data export — just as their notes about you never appear in yours.	You
Sessions	For each device you are signed in on: a coarse description ("Chrome on macOS"), the first two parts of the network address, and when it was last active. We do not collect a device fingerprint. You can view and end sessions at any time.	Generated when you sign in
Account recovery	If you set them up: a second email address (confirmed from that inbox, shown to you only in masked form) and recovery codes, which are stored hashed — we cannot read them. We also keep a record of recovery attempts on your account, successful or not, which you can view.	You, from account settings
Error diagnostics	When something breaks we record what failed and where. Contents are scrubbed before storage — credentials, tokens, and email addresses are removed, and message contents are never included. These are deleted after 30 days.	Generated on failure
Email delivery records	For each message we send you: the address, which template, whether it was delivered, and any error. If mail to you hard-bounces or you mark us as spam, we record the address on a suppression list and stop sending to it.	Generated when we email you
Aggregate product metrics	Counts of how many people reach each stage — signing up, stating an intent, being introduced, meeting. These rows contain no identifiers: a stage name, a week, and a number. They cannot be traced to any individual, and we do not use a third-party analytics service.	Derived in aggregate
Local drafts	Text you have typed but not submitted is kept on your own device so it survives losing signal. It is not sent to us until you submit it, and is discarded after three days.	You, as you type
Match outcomes	Whether you found an introduction worthwhile, and if not, which of a fixed set of reasons applied. This is never shown to the other party, who is not told you were asked. We use it in aggregate to improve which introductions we make.	You, when asked after a meeting
Invitations	If you invite someone, we store the address you entered, which intent it relates to, any note you wrote, and whether it was opened, joined, or declined. If you are invited, we hold that address only until the invitation expires or you decline. Declining adds the address to a permanent do-not-invite list, which is the minimum data needed to honour that choice.	The person inviting; and you, if you decline
Demand watches	If you ask to be told when a counterpart appears, we store the email address you gave, the position you hold, and any industry or region filters you typed. No account is created. We email you once, when a match appears; the record is then closed, and it is deleted automatically after six months if nobody appears. You can stop it at any time from the link in the email, without signing in.	You, from the discovery box
Connected apps	Which third-party applications you have authorised, the permissions you granted, when you granted them, and when the app last used its access. Access tokens are stored as hashes.	You, when you approve an app
API usage	If you use the Developer API: your keys (stored as hashes, never the secret), the endpoints you called, when, and how many units they consumed. Webhook endpoints you register and the delivery status of events sent to them.	Generated by your API use
Presence and reliability	When you last used Maelstrom, how many meetings you attended, and how many confirmed no-shows are recorded against you. Used to rank matches and to pause the intents of absent accounts.	Generated by your use, and by counterparties reporting whether a meeting happened
Relationship state	Whether you have archived or pinned a counterpart, and when a relationship was last active.	You, and your activity in the conversation
Notifications	Alerts generated for you — relationships going quiet, meetings needing confirmation — and whether they have been read or emailed.	Generated by the platform
Meeting holds	Short-lived records of times shown to you, so the same slot is not offered in two conversations at once. They expire automatically.	Generated by your use
Reports	Reports you file: the category, your description, who it concerns, and the conversation it relates to. Reports are retained even if an account is later deleted.	You
Vouches and saved searches	Vouches you give or receive, and the saved searches you create.	You
Company verification	Your email domain, your verification step and the method used; for domain verification, the record we asked you to publish. For a registered company: the legal name, registration number and jurisdiction you submit, your role and any register link you add, and what the public register returned about that company (its registered name and status). Your role and link are deleted once a decision is made.	You, public DNS, and the public company register
Company profile and mandate	If you are raising or selling: the profile you add to an intent (revenue, EBITDA and growth bands, ownership, stage, timeline, use of funds). If you are a firm: your mandate (cheque size, stages, sectors, regions, deal types, ownership, revenue and EBITDA ranges, hold period). If you are raising a fund: the fund's number in its series, vintage, strategy, target and hard cap, minimum and GP commitment, closes, terms, and the track record you state. If you invest in funds: the strategies, fund sizes and commitments you look for.	You
Firm account	Your firm's name, type, website and domain, assets-under-management band, headquarters and description, and whether the firm is verified.	The firm's owner
Team seats	For each colleague in a firm: their email address, role (owner, admin or member), who invited them, and when they were invited and joined. Invitation links are stored only as one-way hashes and expire after 14 days.	The firm's owner or an admin, and the colleague
Deal pipeline and team notes	A firm's stage, owner and next step for each deal, and notes its team writes on a deal. These are visible only to that firm's team, never to the counterpart.	The firm's team
Co-investment offers	If a firm offers part of a deal it leads to other firms: its description of the deal, the allocation, minimum ticket and deadline, which firms it was offered to, and each firm's answer, amount and note.	The firms involved
Single sign-on settings	If a firm signs in through its identity provider: the provider, its issuer address, the client ID, and the client secret, encrypted at rest and never sent back to a browser; when it was last used; and, for each sign-in attempt in progress, short-lived one-time values that are deleted when the sign-in completes or within minutes. From the provider we use only the email address it confirms; we do not store the token it sends.	The firm's owner, and the firm's identity provider
CRM connection	If a firm connects its DealCloud site or its Affinity account: the DealCloud site address and client ID, and the API key for either (the key encrypted at rest and never sent back to a browser), which fields or list deals are written to, and which DealCloud entry or Affinity organisation each deal became.	The firm's owner
Audit log	For a firm: who at the firm did what and when (for example, signed in, moved a deal, answered an introduction, exported deals, opened a file), with the network address it came from and a short description. It records actions, never the content of notes, messages or files.	Generated by the firm's team
Push notifications	If you turn on notifications for a device: the address your browser's push service gives us for that device, the keys used to encrypt messages to it, and a coarse browser description.	Your browser, with your permission
Shared pages and referrals	If you publish an intent as a public page: the public summary you write for it and its link. If someone signs up through your link, which account the link belonged to.	You, and the person signing up
Organization	Organization name, domain, your role, membership	You or your organization's administrator
Technical	IP address, browser and device information, timestamps, error logs	Automatically, when you use the site
Billing	Subscription plan, status, seat count, and the fact of payment. We never receive or store card numbers or bank details — Paddle handles those.	Paddle

We do not ask for special category data (such as health, religion, or political opinions). Please don't put any into your intents or messages.

3. How we use it

To operate matching: scoring your intent against complementary intents, offering introductions, and opening threads when both sides accept;
To run the AI intake conversation and generate introduction briefs and match explanations;
To enforce plan limits and weekly quotas, and to provide organization pipeline views;
To operate rooms and room-scoped searches;
To compute mutual availability and propose meeting times in both parties' timezones;
To investigate reports and keep the platform safe;
To notify you when a counterparty matching a saved search joins, and when a relationship is going quiet or about to be archived;
To rank matches by how active and reliable a counterparty is, so introductions are not wasted on accounts nobody is using;
To pause the intents of accounts that have been inactive for an extended period, and to resume them automatically on return;
To propose meeting times that are free on both parties' calendars, where both have connected one;
To establish and display your company's verification step, including checking a registration against the public register, and to weight it modestly in match ranking;
To run firm accounts: shared deal pipelines, team notes, sourcing analytics, single sign-on, the audit log and the retention settings a firm chooses;
To produce the files you ask for, such as exports for HubSpot, Salesforce, DealCloud or Affinity;
To search the public web for companies that fit an intent when nobody in the network does yet;
To send service email and, if you turn them on, push notifications: sign-in codes, introduction notifications, a weekly summary, and important account notices;
To improve match quality, including using your feedback ratings to tune scoring for you;
To keep the platform safe: detecting fraud, abuse, spam, quota evasion, and impersonation;
To meet legal, tax, and accounting obligations.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. There is no advertising on Maelstrom.

4. Legal bases (EEA/UK)

Contract — running your account, matching, messaging, and billing.
Legitimate interests — securing the platform, preventing fraud and abuse, improving match quality, and basic service analytics. We balance these against your rights.
Consent — optional integrations and any marketing email, which you can withdraw at any time.
Legal obligation — tax, accounting, and lawful requests.

5. What other users can see

This is the part worth reading carefully, because sharing is the product.

Before a match: when our system identifies someone as a complementary counterparty, they are shown your intent's headline, summary, position, and the criteria that matched, plus any company profile or mandate you added, your company's verification step (for example "Registered company"), whether you have passed an ID check, whether you require an NDA, and for a firm its type and whether it is verified. If the intent is set to anonymous, your name and headline are withheld until you both accept — but the text you wrote is still shown, so keep identifying details out of it if you are cloaking.
After a match: both parties see each other's name, headline, company, verification status, and any scheduling or video links you have added. If your company is registered with us, they see its legal name, registration number and jurisdiction, which are public on the register. If you required an NDA, they see whether you have accepted theirs and you see whether they have accepted yours; if you share files, you see who opened them and when.
Within a firm: everyone on a firm's team sees the firm's introductions, mandates, deal pipeline and team notes. The owner and admins also see the team list and the audit log, which includes each colleague's sign-ins and the network address they came from. If you join a firm, its owner can remove you.
Co-investment offers: if a firm you matched with leads your round, it may offer part of it to other verified firms whose mandate fits. If it chooses to, the offer includes your company's sectors, regions and screening profile; it never includes your company's name. A firm that is offered a co-investment sees the leading firm's name. The leading firm sees another firm's name only once that firm says it is interested; a firm that passes is never named.
On a public page: if you publish an intent as a page, anyone with the link sees its position, headline and the public summary you wrote for it, never your name, company or email.
In a room: members can see the roster — who is in the room and what position they hold.
In a programme (a room an accelerator, fund, adviser, community or event runs): the organiser, and the admins of the organiser's firm, see your name and headline, when you joined, and counts of the introductions, matches and meetings you have through the programme, plus any outcomes you report to it. They never see who you met or what was said. You can keep your numbers private (you then count only in the programme's totals), and you can choose to be listed by name on the programme's public page; you are not listed unless you choose to be. If the organiser invited you, they also see the address they invited.
With an adviser: if a business owner joins Maelstrom through an adviser's client book, counterparts see "Represented by" the adviser (never the owner's name) before accepting. If the adviser reviews introductions, then when you and the owner both accept, the adviser sees your name, headline, firm and what you are looking for before deciding whether names are exchanged; you are told this on the introduction. A declined introduction simply expires; neither side is told why. The adviser's NDA may apply before the owner's files open.
On a demo day: if you choose to show your teaser in a programme, investors the organiser gives a time-limited pass see your intent's position, headline, summary, profile and verification, never your name or contact details, and can ask to be introduced. You answer the request like any introduction. The organiser sees which investors hold passes and how many introductions each asked for; a pass is emailed to an address the organiser provides and works only for that address.
Mentors and peers in a programme: if you offer to mentor, members of that programme see your name, headline, topics and your note, and can ask you for a session with a note of their own. If you accept, you and the member each see the other's email address; if you don't, they are told only that you're not available. If you opt in to peer pairing, the member you are paired with sees your name, headline and email address, and the topics you share. The organiser sees who mentors, how many requests each received and accepted, and how many peer pairs were made and said they met, never the notes.
Programme events: the organiser sees who in the programme said they are going and who checked in, and how many introductions and matches were made at the event, never between whom. Once you check in, other people checked in see what you are looking for (your intent's position and headline), not your name, and you can be matched with them; introductions made there are marked with the event. You get a reminder the day before an event you said you'd go to, and one note afterwards.
A programme's Slack channel and automations: an organiser can have programme updates posted to a Slack channel they choose. A channel is seen by more people than the organiser, so posts carry less: you are named (with your headline) when you join only if you chose to be listed on the programme's page; outcomes are posted without a name or amount; events and peer rounds as counts. An organiser can also send programme activity to their own tools (for example Zapier or Make): this carries what their workspace already shows them, such as your name and headline when you join, your address if they invited you, an outcome you report (without your name if you keep your numbers private), and that you checked in at an event. Those tools are the organiser's own.
Sponsored seats: an organiser who buys member seats can cover your Pro plan while you are in their programme. The organiser sees whether your seat is sponsored; they are not told whether you pay for a plan yourself. Your account page says which programme covers your plan.
Partner credit: if you start paying for your own plan within a year of joining a programme, we record that the programme brought you, so its organiser can be paid a share under a written partner agreement. The organiser sees only counts (how many members they brought now pay, and on which plans), never your name or what you pay.
Within an organization: administrators see counts of your active intents, pending introductions, matches, and meetings booked. They do not see your message contents.
On your profile: your name, headline, bio, picture, banner, location, website, and verification badges are visible to anyone who views your profile — unless you set your profile to private, in which case a "this profile is private" screen is shown instead.
If you belong to an organization: your name, headline, and title appear on your company's public profile alongside your colleagues. A private company profile hides the member list entirely.
Declines are private. If you decline an introduction, the other party is not told.

6. AI processing

We use Anthropic's API to power the intake interviewer, the site assistant, and introduction briefs. When you use those features, the relevant text — your messages and your intent content — is sent to Anthropic for processing and the response is returned to us.

Anthropic acts as our processor under its commercial terms and does not use data submitted through its API to train its models. We do not send Anthropic your payment data.

If you would rather not have your text processed by an AI provider, you can skip the conversational intake and enter your intent through the structured form fields instead, and simply not use the assistant.

7. Automated decision-making

Match scoring is automated. It ranks and filters potential counterparties based on the criteria you and they have stated.

It does not produce legal or similarly significant effects on its own, because no introduction happens without your explicit acceptance and theirs. Scoring decides what you are shown, not what you agree to. You can state additional intents, adjust your criteria, or ask us to review your matching at admin@maelstrom.it.com, where a person will look at it.

8. Calendar and call connections

Connecting a calendar (Google or Microsoft) or Zoom is optional and you can disconnect at any time.

What we ask for. On Google: free/busy access (calendar.freebusy) and access to events Maelstrom itself creates (calendar.events.owned), which cannot read your other events. On Microsoft: Calendars.ReadWrite, because Microsoft offers no narrower permission for adding an event; this technically allows reading other events, which we do not do, and the connect screen says so before you choose. On Zoom: permission to create meetings.
What we read. Opaque blocks of unavailable time over a rolling horizon. We keep only start and end times, and do not learn who you are meeting, what about, or where.
What we write. When a meeting is confirmed, we add it to your connected calendar, with a Google Meet, Microsoft Teams or Zoom link where you have one. Events are created without attendees, so the other person's email address never enters your calendar; each side gets its own copy.
What a counterparty sees. Only the specific proposed times and the meeting link, and only after you choose to propose them. They never see your calendar or your busy blocks.
Credentials. Refresh tokens are encrypted with AES-256-GCM before storage. Disconnecting deletes the stored token; you can also revoke access directly in your Google account, Microsoft account or Zoom's app settings.

9. Identity verification and duplicate prevention

Verifying your identity is optional to browse, and required before you can interact with other users (accepting an introduction, messaging, joining a room, or booking a meeting). When you verify, a specialist provider performs the check — capturing and assessing your government ID and, where applicable, a selfie and liveness check — and returns to us only the outcome and a reference. Your document never reaches Maelstrom's systems and we hold no copy.

We additionally record that a check was started, against your account and the date, purely so we can monitor our own usage against our provider's allowance. That record contains nothing about you beyond your account id.

To enforce one account per verified person, we store a one-way salted hash derived from the provider's identity reference. That hash cannot be reversed into your name, document, or number; it only allows us to notice that an identity already exists on the platform and refuse a second account. This is how we keep the network free of duplicate and throwaway accounts, which is what makes an introduction here worth opening.

The provider is currently Didit. It processes your document under its own privacy policy and retention schedule. If we change providers we will update this policy.

10. Company verification

Company verification records what a member has demonstrated about the company they represent:

Work email — your address is on a company domain rather than a consumer or disposable mail provider. Assessed from the address itself; no additional data collected.
Company domain verified — you published a DNS TXT record containing a value we issued. We read only public DNS for your domain.
Registered company — you give your company's legal name, registration number and jurisdiction, and we check them against the public company register: UK Companies House for UK companies, and OpenCorporates for most other registers, including US states. We send the register only the registration number and jurisdiction. If the register shows an active company under that name, and the name fits your verified domain, it is approved automatically; otherwise a person at Maelstrom checks it. We keep the legal name, number and jurisdiction, which are public on the register; your role and any link you added are deleted once a decision is made.

Your step is shown to counterparties on introductions, without your name, and is a small input to match ranking. It is capped so that it can influence the order of results but cannot on its own create a match that your stated criteria do not support.

To be explicit, because it matters: verification confirms control of an inbox or a domain, and that a company with that name is on a public register. It is not a background check, credit check, or any assessment of solvency, authority, or honesty. Our Terms say the same thing at greater length. Checking a person's identity is separate, and described in section 9.

11. Firm accounts, teams and deal rooms

An investment firm or adviser can hold a firm account. Its owner controls the firm's profile, mandates and settings, and can invite colleagues as admins (who also manage the team and answer introductions for the firm) or members (who work the deal pipeline). An invitation works only for the address it was sent to. A colleague may also join automatically when they sign in through the firm's identity provider, if the firm has turned that on.

The firm is the business customer for the data its team creates in Maelstrom: its pipeline, team notes, mandates and audit log. Colleagues see the firm's shared work, as described in section 5; conversations with counterparts stay with the account that matched.

In a deal room, an intent's owner may require the other side to accept an NDA before files open. We record the acceptance as described in section 2, as evidence of agreement. Our standard NDA is provided for convenience and is not legal advice.

When you export deals for a CRM, the file contains only what you can already see on screen. It never contains anyone's email address. Once downloaded, the file is yours to keep and is outside our control.

A firm can also connect its own DealCloud site or Affinity account. Maelstrom then writes the firm's deals there and keeps them up to date: for each match, what the firm already sees on screen (the counterpart's name and company, their intent, profile or fund, the stage, owner and next step), never an email address. Stage changes the firm makes in DealCloud, or to the Status field in Affinity, are read back to its board. In Affinity, a deal's company is matched to an existing organisation by its verified web domain or exact name, or created if there is none, and the deal is added as a note. DealCloud and Affinity are the firm's own systems, and the data held there is governed by the firm's agreement with Intapp or Affinity.

12. Single sign-on, the audit log and retention for firms

Single sign-on. A firm can sign in through its identity provider (such as Okta, Microsoft Entra ID or Google Workspace) for its verified domain. When you sign in this way, your provider confirms your email address to us; we check that confirmation and then sign you in as we would with an emailed code. If your firm requires single sign-on, you cannot sign in with an emailed code, and your firm's provider decides whether you can sign in at all.

Audit log. For firms, we record actions taken by the firm's team, as described in section 2, so the firm can see who did what. The owner and admins can read and download it. It cannot be edited.

Retention chosen by the firm. A firm's owner chooses how long the firm keeps its audit log (one to seven years; two by default), its team notes, and closed or passed deals on its pipeline. Older records are deleted automatically within the hour. Conversations and shared files belong to both sides of a match, so one side's setting does not delete them.

13. Public pages, web search and notifications

Public intent pages and cohorts. You can publish an intent as a page anyone can open, showing only what is described in section 5. Unpublishing it, or pausing the intent, takes the page down. A public cohort page shows its name, the organiser's description, and how many members hold each position, with small groups combined so nobody can be identified. A programme's page can also show its brand and the names and headlines of members who chose to be listed (never someone whose profile is private).

Programme invitations. An organiser can give us email addresses to invite people to their programme. We send each address one invitation on the organiser's behalf and keep the address, and whether the invitation was used, for the organiser's records. The organiser is responsible for having a reason to contact the people they invite. We do not tell the organiser whether an address already has a Maelstrom account, and we send nothing further to someone who ignores the invitation.

Searching the web for companies. When nobody in the network fits your intent yet, you can ask us to search the public web for companies that do. We send our search provider a description of the company you are looking for, built from your intent's position, headline, the start of its summary, industries and regions, with email addresses and phone numbers removed. We never send your name, your company or your email. Results are public company web pages; nobody is contacted.

Push notifications. If you turn on notifications for a device, messages are sent through your browser's push service (for example Google, Mozilla or Apple), encrypted so that the push service cannot read them. You can turn them off in your account or your browser at any time.

With other users, as described in section 5. Otherwise, only with service providers who process data on our behalf:

Provider	Purpose	Data
Render	Runs the Maelstrom API	All account, intent, match, message and firm data, as it is processed
Neon	Database hosting (PostgreSQL)	All account, intent, match, message and firm data, as stored
Netlify	Website hosting and serverless functions, including Netlify Blobs for subscription records	Technical data, request logs, entitlement records
Cloudflare (R2)	File storage for attachments and profile images	Files you upload
Resend	Sending email	Your email address and the content of the email
Anthropic	AI intake, assistant, introduction briefs	Conversation and intent text
Paddle	Merchant of record — payments, invoicing, tax	Payment and billing data, email
Didit	Government ID verification, if you choose to verify	Your document and selfie, processed by them; we receive only the result
Google	Calendar and Google Meet, if you connect Google Calendar	OAuth token, availability queries, the meetings we add
Microsoft	Calendar and Teams, if you connect Microsoft	OAuth token, availability queries, the meetings we add
Zoom	Meeting links, if you connect Zoom	OAuth token, the meetings we create
Companies House, OpenCorporates	Checking a company registration, when you ask us to	The registration number and jurisdiction
Exa (or Tavily)	Searching the public web for companies, when you ask us to	A description of the company you are looking for, without your name, company or contact details
Browser push services	Delivering notifications, if you turn them on	An encrypted notification they cannot read
Sentry	Error reports, when switched on	Scrubbed diagnostics, as described in section 2
Upstash	Fallback storage for subscription records, only if configured	Email, plan, subscription status

A firm's own identity provider (for example Okta, Microsoft Entra ID or Google Workspace) and its own CRM (DealCloud or Affinity, if it connects one) are chosen and controlled by that firm, not by us; they receive what is needed to sign its colleagues in, or the firm's deals as described in section 11.

We may also disclose data where required by law, to enforce our Terms, to protect the rights and safety of users, or in connection with a merger or acquisition — in which case we will tell you before your data becomes subject to a different privacy policy.

15. International transfers

We operate from the United States and our providers may process data in the United States, the European Union, and elsewhere. Where data leaves the EEA or UK, transfers rely on Standard Contractual Clauses or another lawful transfer mechanism operated by the relevant provider.

16. How long we keep it

Account and intents — while your account is active. Archived intents are kept so your match history stays coherent; you can delete them.
Messages — for the life of the match, so both parties keep their conversation. Deleting your account removes your account from it; the counterparty's copy of the exchange may remain visible to them.
Account deletion — we delete or irreversibly anonymize your personal data within 30 days of your request, except where we must keep records.
Billing records — retained by us and by Paddle as long as tax and accounting law requires, typically six to seven years.
Calendar tokens — until you disconnect or delete your account, then removed immediately. Availability data is computed on demand and not stored.
Verification records — while your account is active, so your badge persists. Tier 3 review evidence is kept for the duration of the account plus any period required to evidence the decision.
Identity verification — the outcome and duplicate-prevention hash are kept while your account is active. Documents are held by the provider under its own schedule, not by us.
API usage records — 13 months, so you can audit a full year of consumption and we can resolve a billing question.
Scheduling settings and meetings — while your account is active; deleted with it. Meeting holds expire within minutes and are not retained.
Reports — retained after account deletion, detached from the accounts involved. A safety record that disappears when its subject deletes their account is not a safety record.
Security and abuse logs — up to 12 months; sign-in records, 90 days.
Firm audit logs, team notes and closed deals — as long as the firm's owner chooses (section 12); the audit log is kept for at least a year.
Company verification — the registered company's legal name, number and jurisdiction while your account is active; a request nobody decided expires after 30 days.
NDA acceptances and file views — for the life of the match, so both parties keep the record.
Single sign-on attempts — minutes; firm invitations, 14 days unless accepted.

17. Invitations

Members may invite people to Maelstrom. An invitation is tied to a specific intent and shows the recipient what the sender is seeking; it never reveals the sender's contact details. Invitations are limited per member per week.

Declining is permanent and applies across the whole platform. Once an address declines, no member can invite it again. We retain the address solely to honour that, and we do not confirm to anyone whether a given address has declined.

Members must only invite people they have a genuine reason to contact. Using invitations for bulk or unsolicited marketing is a breach of these Terms and may result in suspension.

18. Being told when a counterpart appears

You can ask us to email you when someone holding a complementary position joins, without creating an account. We use the address for that single notification and nothing else — it is not added to a newsletter or any other list, and it is not used for advertising.

We send one email when a match appears, after which the watch closes. If no match appears within six months, the record is deleted automatically. Every email carries a one-click link to stop it, which requires no sign-in. We do not confirm to anyone else whether a given address is registered.

19. Inactivity and relationship archiving

Relationships. A conversation with no contact for 30 days is moved to your archive. This is not deletion: the conversation, meetings, and the record of why you matched are all kept, and either party can restore it at any time. You are notified before it happens, and you can mark any relationship as kept so that it never archives. Anything with a meeting booked is protected automatically.

Accounts. If you do not use Maelstrom for 60 days, your active intents are paused so that they do not consume other members' weekly introduction allowance. Signing in resumes them automatically. We do not delete inactive accounts, and inactivity never removes your data.

Connected apps. An app receives event notifications only for users who have authorised it, and only for events covered by the permissions each of those users approved. When you authorise a third-party app, it can read and act on the data covered by the permissions you approved, as you. That data leaves our systems and is handled under that developer's own privacy policy. Revoking an app stops future access immediately but does not compel the developer to delete what they already received — ask them directly. You can see and revoke every connected app from your dashboard.

Pausing. You may pause your account at any time. Pausing stops new introductions and pauses your intents; it deletes nothing, and inactivity-based archiving does not run while you are paused. Your existing counterparts are told that you have paused and roughly for how long, so that they are not left waiting. Security and billing messages continue.

Deletion of relationship records. When an account is deleted, the matches it was part of are removed, and the private notes, tags, reminders and stage labels other members had attached to those relationships are removed with them rather than being retained without context.

Access to your data. You can download everything we hold about you at any time from account settings, as a machine-readable file and a readable summary. A small number of things are withheld and the file states each one and the reason: reports other members have filed about you, because disclosing them would identify the reporter and make reporting unsafe; the other party's response to an introduction, because declines are silent by design; and your identity hash, which is a one-way value that is not readable and means nothing outside our systems.

Email suppression. If a message to you permanently fails, or you report one as spam, we add your address to a suppression list and stop emailing it. This protects other members' mail from being classified as spam alongside ours. Contact us and we will remove it.

Rate limits. We limit how often sign-in links can be requested for an address, to prevent your inbox being used to harass you.

Adjustments from your feedback. Where several of your outcome answers point at the same cause, we may propose a specific change to your intent's criteria. We never apply such a change without your explicit agreement, and every change you accept is listed for you along with what it was based on.

Intent freshness. Where an intent has not been edited or confirmed for 90 days we ask whether it is still current, and if we receive no response we pause it at 120 days. Pausing does not delete anything, and confirming the intent resumes matching immediately. The age of an intent also has a small, capped effect on ranking.

Connections in common. Where you and a counterparty share a connection — someone who has vouched for you both, or a counterpart you have both matched with — we may tell each of you that an overlap exists. We never disclose who the shared person is, and we suppress the signal entirely where the size of your own network would make that person identifiable. This is not a reference and implies nothing about anyone's conduct.

Ranking. How recently you have used the platform, and whether meetings you agreed to went ahead, affect where you appear in other members' matches. These adjust ranking only; they never prevent you from being matched, and their effect is capped.

Attendance. After a meeting, both parties may record whether it happened. A reported no-show is only recorded against someone once the dispute window has passed without them disputing it. A disputed report is never counted.

Compensation. Where a no-show is confirmed, the introduction that produced the meeting is credited back to the party who attended. Credits are added to that member's weekly allowance, are granted at most once per meeting, and do not expire.

20. Deleting your account

You can delete your account from your dashboard by confirming your email address. When you do:

Your profile, intents, availability, saved searches, vouches, room memberships, and calendar connection are removed.
Your messages are replaced with a placeholder rather than erased from the thread, so the person you spoke with keeps a coherent record of a conversation they were part of.
Matches you formed remain, with your intent content emptied, for the same reason.
Scheduled meetings are cancelled.
Reports and the duplicate-prevention hash are retained. Deleting these would let a suspended account return, and would erase safety records belonging to people who reported them. The hash identifies nobody on its own.
Billing records are retained by us and by Paddle for as long as tax law requires.

Organization owners must transfer ownership before deleting, so an organization is never left without one.

21. Your rights

Depending on where you live, you may have the right to access your data, correct it, delete it, take a portable copy, restrict or object to processing, and withdraw consent. If you are in the EEA or UK you may also complain to your local supervisory authority.

If you are a California resident, you have rights under the CCPA/CPRA to know, delete, correct, and opt out of sale or sharing. We do not sell or share personal information as those terms are defined, so there is nothing to opt out of, and we will not discriminate against you for exercising any right.

To exercise any right, email admin@maelstrom.it.com. We will respond within the time the applicable law requires — generally 30 days — and we may need to verify your identity first, usually by confirming control of your account email.

22. Cookies and local storage

We do not use advertising or cross-site tracking cookies. We use browser local storage and session storage to keep you signed in, hold your session state, and carry a room invite code through sign-in. Blocking this storage will prevent the application from working.

23. Security

We use HTTPS throughout, passwordless sign-in with short-lived single-use codes stored only as hashes, optional single sign-on for firms, signed and replay-protected billing webhooks, server-side enforcement of subscription entitlements, OAuth with PKCE and single-use state for calendar connections and single sign-on, and AES-256-GCM encryption of calendar tokens and single sign-on secrets at rest. Access to production data is limited to those who need it. Our security page describes this in more detail, including what is not yet in place.

No system is perfectly secure. If we become aware of a breach affecting your personal data, we will notify you and the relevant regulators where the law requires it.

24. Children

Maelstrom is for business use by adults and is not directed at anyone under 18. We do not knowingly collect data from children. If you believe a child has given us data, contact admin@maelstrom.it.com and we will delete it.

25. Changes

This policy will expand as Maelstrom adds features — new integrations, calendar connections, and verification methods each bring new data. We will post updates here with a new version number and effective date, and give notice by email or in-app before material changes take effect.

26. Contact

Maelstrom AI Technologies, Inc.
300 Creek View Road, Newark, DE 19711
Email: admin@maelstrom.it.com
Phone: 630-649-9958 (Text Only)

Version history

4.0 — 31 October 2026 — Brought the policy up to date with the service. Added firm accounts, team seats, deal pipelines, team notes, NDA acceptances and file-view records; company verification against public registers (replacing "verification tiers", and removing the Google Workspace / Microsoft 365 route to Tier 2, which the service no longer offers); single sign-on, the firm audit log and firm-chosen retention; company profiles, mandates and fund profiles; co-investment offers between firms; CRM exports and the live DealCloud and Affinity connections; public intent and cohort pages and referrals; programmes (what organisers see, invitations, listing and outcomes), advisers' client books, demo-day passes, mentors and peer pairing, events and check-in, programme Slack posts and automations, sponsored seats and partner credit; web company search; and push notifications. Corrected the calendar section to describe the permissions actually requested (including Microsoft's Calendars.ReadWrite), event writing, and Zoom, Meet and Teams links. Updated the list of providers to those actually used (Render, Neon, Cloudflare R2, Resend, Didit, Zoom, Companies House, OpenCorporates, Exa or Tavily, push services, Sentry) and removed DigitalOcean, which is not used.
3.0 — 8 September 2026 — Added file attachments, notification preferences, and account pausing, including what pausing does and does not do.
2.9 — 7 September 2026 — Added private relationship notes, which are never disclosed to their subject, and session records.
2.8 — 7 September 2026 — Documented the right of access: what a data export contains, and what is withheld and why.
2.7 — 7 September 2026 — Added account recovery data and scrubbed error diagnostics, and stated the 30-day limit on the latter.
2.6 — 7 September 2026 — Added email delivery records and the suppression list, and aggregate product metrics that contain no identifiers.
2.5 — 7 September 2026 — Added locally-stored drafts and feedback-driven criteria adjustments, which are always proposed rather than applied.
2.4 — 5 September 2026 — Added match outcome feedback, and stated that it is never disclosed to the counterparty.
2.3 — 5 September 2026 — Added intent freshness checks and connections-in-common signalling, including when that signal is suppressed.
2.2 — 5 September 2026 — Added invitations: what is stored, and the permanent platform-wide do-not-invite list.
2.1 — 5 September 2026 — Added demand watches: what is stored when a non-user asks to be notified, and how long it is kept.
2.0 — 2 September 2026 — Added the app directory, app-scoped event delivery, and the per-app share of API allowance.
1.9 — 2 September 2026 — Added OAuth connected apps: what is stored, and the fact that data reaching an app is governed by that developer's own policy.
1.8 — 2 September 2026 — Added Developer API usage records, keys, and webhook endpoints.
1.7 — 1 September 2026 — Added introduction credits granted as compensation for confirmed no-shows.
1.6 — 1 September 2026 — Added presence and reliability data, relationship state and archiving, notifications, and how inactivity affects intents and ranking.
1.5 — 1 September 2026 — Added reschedule notice and limit preferences to the scheduling data described above.
1.4 — 1 September 2026 — Added opt-in calendar event writing (and what read-only access cannot do), short-lived meeting holds, and the identity-check usage record.
1.3 — 31 August 2026 — Added scheduling data (timezone, availability, meetings), reports, vouches, and saved searches; documented account deletion in detail, including what is deliberately retained.
1.2 — 29 August 2026 — Added profile and organization profile data, centrally managed member profiles, identity verification through a third-party provider (including what we never receive), and the duplicate-account hash.
1.1 — 29 August 2026 — Added calendar connections (free/busy scope, token encryption, what counterparties see) and verification tiers (DNS challenge, OAuth hosted domain, what a badge does and does not mean). Added Google and Microsoft as sub-processors.
1.0 — 29 August 2026 — Initial publication. Covers account and intent data, matching activity, rooms, AI processing by Anthropic, automated decision-making, and Paddle billing.