Privacy Policy

BVJ Consulting ("BVJ," "we," "us" or "our") provides legal operations services to startups: we organize, administer and maintain corporate records, cap tables, equity documents and data rooms. This Privacy Policy explains how we handle personal information through our website at bvjconsulting.com and its free tools (the "Site"), the BVJ Portal at app.bvjconsulting.com (the "Portal"), the services we perform for clients, and our marketing and other activities described below (together, the "Services").

Notice to users in Europe: if you are in the European Economic Area or the United Kingdom ("Europe"), please also read the section "Notice to users in Europe" below.

Two roles: our own data, and our clients' documents

We handle personal information in two different capacities, and it helps to keep them apart.

• As the business that decides how the data is used. This covers information about you as a visitor, a prospect, a client contact or a Portal user: your name and email, your account, your payments, our communications and how you use the Site. This Privacy Policy applies fully to this information.
• On behalf of a client company. When a company uploads its corporate records to the Portal or gives them to us for a service, those documents contain information about other people: founders, stockholders, employees, advisors and investors. We process that information for the company and on its instructions, to provide the Services to it ("Customer Content"). The company decides what to upload and is responsible for informing the people concerned. If your information appears in a company's records and you want to exercise a right over it, please contact that company; we will help it respond.

Personal information we collect

Information you give us

• Contact and professional data, such as your name, email address, phone number, company, title, and mailing or billing address.
• Account data, such as your Portal login email, password (stored only in hashed form), the company workspaces you belong to and your role in them.
• Communications data, such as the messages you send us by email, LinkedIn or the Site, and the notes we keep of our calls and meetings. If we record or transcribe a call to keep accurate notes, we tell you at the start; you may ask us not to.
• Onboarding and engagement data, such as the information you give us to form or maintain your company: proposed company names, founders and their equity, officers and directors, addresses, and the services you request.
• Transaction data, such as the Packages you buy, invoices and payment status. Card details are collected by Stripe directly; we do not receive or store your full card number.
• Customer Content, such as certificates of incorporation, bylaws, board and stockholder consents, stock purchase and option agreements, 83(b) elections, SAFEs, advisor and employment agreements, cap table exports and other corporate records, and the information extracted from them. These documents can contain names, addresses, signatures, equity holdings, compensation and, in some filings, government identification numbers such as Social Security numbers or taxpayer identification numbers.
• Tool requests, such as the email address and calculator inputs you give us when you ask a Site tool to email you a report or when you send us a request from it.
• Ask BVJ questions, the questions you type into Ask BVJ, the assistant on the Site, and the email address you leave if you ask us to send a question on to us.
• Marketing data, such as your preferences for our emails and newsletters.

Information from other sources

• Platforms you connect, such as Google Drive, when you choose to sync documents with the Portal, and formation or equity platforms (for example Clerky) when you ask us to work on your company there.
• Scheduling and outreach tools, such as the details you enter when booking a call with us through Calendly, and public professional profile information (for example on LinkedIn) when we contact you or you contact us.
• Prospecting services, such as Gojiberry, which provide us with public professional information (name, title, company and profile) about people at companies that may need our services, including companies identified as visiting the Site.
• Referrals, when a partner or client introduces you to us.

Information collected automatically

• Device and usage data on the Site, such as your browser, device type, approximate location derived from your IP address, the pages you view, how long you stay and the site that referred you. We collect this through Google Analytics (see our Cookie Notice).
• Company identification on the Site: our visitor identification provider, Gojiberry, uses your IP address and the pages you view to work out which company a visit likely comes from (see our Cookie Notice).
• Security and log data in the Portal, such as sign-in times, IP addresses, the device you used, and actions taken in a workspace, which we use to keep accounts secure and to keep an access record. The Portal uses only the cookies it needs to sign you in and recognize a trusted device; it does not use advertising or analytics cookies.
• Email delivery data, such as whether an email we sent through our email provider was delivered.

How we use personal information

• To provide the Services: create and secure your account, host your workspace, read and organize your documents, build your cap table, data room and other views, perform the Packages you buy, form or maintain your company through the platforms involved, process payments, and send you service messages such as sign-in codes, status updates and receipts.
• To use AI features: the Portal sends documents and questions to our AI provider to extract terms and answer questions about your records. We do not use Customer Content to train AI models, and our provider processes it under commercial terms that do not permit it to train its models on that content.
• To communicate with you: respond to your questions, follow up on calls, and send proposals and updates.
• To improve the Services: understand how the Site and its tools are used and fix what does not work. We use aggregated or de-identified information for this where we can.
• For marketing: send you articles, newsletters or information about our services if you have asked for them or, where permitted, as an existing client or contact. You can unsubscribe at any time.
• For prospecting: identify companies, including companies whose staff visit the Site, and people in relevant roles there whom our services may help, and contact them on LinkedIn or by email. You can ask us at any time not to contact you this way.
• For compliance and protection: comply with law and legal process, keep business and tax records, prevent fraud and abuse, protect the security of the Services and enforce our terms.

We do not sell personal information, and we do not use it for targeted advertising.

How we share personal information

We share personal information only as follows.

Service providers that help us run the Services, under contracts that require them to protect the information and use it only to provide their services to us:

Platforms you ask us to use, such as Clerky, Carta, Pulley or a registered agent, when your instructions require us to provide your information to them. Their own terms and privacy policies apply.

People you authorize, such as the co-founders, officers, advisors or investors you invite to a workspace, and your lawyers, accountants or other advisors when you ask us to work with them.

Professional advisors of our own, such as lawyers, accountants and insurers, under confidentiality obligations.

Authorities and others, when we believe in good faith that the law, a court order or a legitimate request from a public authority requires it, or to protect the rights, safety or property of our clients, us or others.

Business transferees, if our business is sold, merged or transferred, in which case we will require the recipient to honor this Privacy Policy.

Retention

We keep personal information for as long as we need it for the purposes described above, and then delete or anonymize it.

• Customer Content stays in its company's workspace while the account is open and after it is closed, so that it is there if the company returns, until the company asks us to delete it. We then delete it from the Portal within 30 days, apart from backup copies, which are deleted on their normal schedule and are not otherwise used.
• Account and communications data are kept while we have a relationship with you and for a reasonable period afterwards.
• Invoices and transaction records are kept as long as tax and accounting laws require, generally seven years.
• Marketing data is kept until you unsubscribe, after which we keep only what we need to respect your choice.
• Ask BVJ questions are kept for 90 days, so we can see what founders ask and improve the answers, and then deleted. With each one we keep a one-way code derived from your IP address, used to apply the assistant's limits; we do not keep the address itself.

Your choices

• Your account: you can review and update your account information in the Portal, and write to us to correct anything you cannot change yourself.
• Marketing emails: use the unsubscribe link in any marketing email, or write to us. You will still receive service messages.
• Cookies: see our Cookie Notice.
• Do Not Track and Global Privacy Control: we do not sell or share personal information for advertising, so these signals do not change how we process your information.
• Deletion and export: you can ask us to delete your information or to give you a copy of it, as described below.

Security

We protect personal information with technical and organizational measures appropriate to its sensitivity, including encryption in transit, passwords stored only in hashed form, a second sign-in factor for every Portal account, separation of each company's workspace, and limits on who can access client data. No system is perfectly secure; if we learn of a security incident affecting your information, we will notify you as the law requires.

International transfers

We are based in the United States, and most of our service providers process information in the United States. If you are outside the United States, your information will be transferred to and processed there. See "Notice to users in Europe" for how we protect transfers from Europe.

Children

The Services are for businesses and are not intended for anyone under 18. We do not knowingly collect personal information from children. If you believe we have, please contact us and we will delete it.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time. We will post the new version with its date, and if a change is material we will notify you by email or in the Portal before it takes effect.

How to contact us

BVJ Consulting, 2 Embarcadero Center, San Francisco, California 94111. Email: benjamin@bvjconsulting.com.

U.S. state privacy rights

Depending on where you live, U.S. state privacy laws (such as those of California, Colorado, Connecticut, Virginia, Texas and Oregon) may give you some or all of the following rights, to the extent those laws apply to us:

• Know and access: to know what personal information we have collected about you, where it came from, why we use it and with whom we share it, and to receive a copy.
• Correct: to have inaccurate personal information corrected.
• Delete: to have your personal information deleted, subject to exceptions the law allows, such as records we must keep.
• Opt out: we do not sell personal information, share it for cross-context behavioral advertising, or use it for profiling with legal or similarly significant effects, so there is nothing to opt out of.
• Sensitive personal information: where Customer Content contains government identification numbers, we use them only to provide the Services the client asked for, and not to infer characteristics about anyone.
• Appeal: to appeal our decision on your request, by replying to our response.
• Non-discrimination: we will not treat you differently for exercising these rights.

To make a request, email benjamin@bvjconsulting.com. We will verify your identity, usually by confirming control of the email address associated with your account or our correspondence, before acting on it. You may use an authorized agent, whose authority we may ask you to confirm. If your request concerns Customer Content, we will refer it to, and help, the client company that controls it.

Information practices in the last 12 months

California "Shine the Light." We do not disclose personal information to third parties for their own direct marketing purposes.

Notice to users in Europe

Who is responsible. BVJ is the controller of the personal information described in this Privacy Policy, except Customer Content, for which the client company is the controller and BVJ acts as its processor. Our contact details are in "How to contact us." We provide a data processing addendum to clients who need one.

Our legal bases. We rely on the following legal bases under the GDPR and UK GDPR:

Your rights. If you are in Europe, you may ask us to give you access to your personal information, correct it, delete it, restrict or object to our processing of it, or give you a copy in a portable format, and you may withdraw consent at any time where we rely on it. You may object at any time to the use of your information for prospecting, and we will stop. Email benjamin@bvjconsulting.com. If you are not satisfied with our response, you may complain to the data protection authority where you live; in the United Kingdom, that is the Information Commissioner's Office (ico.org.uk).

No automated decisions. We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.

Transfers out of Europe. When personal information is transferred from Europe to the United States or another country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (and the UK addendum to them) or on our providers' certification under the EU-U.S. Data Privacy Framework and its UK extension, where available. You may ask us for more information about the safeguard used.

This Privacy Policy is adapted from a template prepared and made publicly available by General Legal, PC ("General Legal"). General Legal has not reviewed, and takes no position on, this Privacy Policy or any modification made to its template, and its template does not create an attorney-client relationship with General Legal.