Privacy Policy

AI Dataroom is a secure investor dataroom and fundraising workspace operated by Metalplant PBC, 213 North Market Street, Suite 1046, Wilmington, DE 19801(“AI Dataroom”, “we”, “us”). Companies use it to share documents with investors, answer investor questions, and keep a record of their fundraising.

Two kinds of people use AI Dataroom. Company members (owners, admins and team members) sign in to run their company's room. Investors and other recipients open a company's portal or a shared link. A company decides what information about its investors it adds to AI Dataroom and who can see its documents. We process that information to provide the service to that company.

• Account information. Name, email address and password for people who sign up or accept an invitation, and their company memberships and roles. Passwords are handled by our authentication provider, Supabase Auth, and are not stored by us in readable form.
• Company and investor records. Information a company enters or imports about its investors and contacts: names, email addresses, firms, pipeline stages, notes, tasks, and email conversations the company adds to its CRM.
• Documents and content. Files a company uploads (with their earlier versions), company updates, financial models, and the shared questions and answers a company curates.
• Activity.Which documents a person opens, how long they spend on each, downloads, and the questions they ask the AI with its answers and citations. Activity is shown to the company that shared the documents. For shared links we also record the email address entered at the link's email gate, the IP address and the browser user agent. Company actions are written to an append-only audit log.
• Billing information.Subscription status and a Stripe customer reference. We send the billing email address and company name to Stripe. Card details are entered on Stripe's checkout page and are never received or stored by AI Dataroom.
• AI provider keys.If a company stores its own OpenRouter API key, we keep it encrypted and use it only for that company's AI requests.
• Google account data. If a company connects a Gmail mailbox, we receive the limited Google user data described in Google user data.
• Technical data. IP addresses and request headers, used to limit abuse and keep the service secure.

Cookies and browser storage

We use cookies only to run the service. We do not use third-party analytics or advertising cookies.

• Sign-in session cookies set by Supabase Auth.
• Preference cookies: the selected company workspace, an admin's investor-preview mode, and when portal notifications were last seen.
• A signed viewer-session cookie for each shared link a visitor opens. It lets the company that shared the link see the activity on that link.
• A short-lived security cookie that ties a Gmail connection request to the browser that started it.
• Browser local storage for the color theme, the sidebar layout, and recovery of an interrupted upload.

• To provide the service: sign-in, document sharing, the investor portal, the CRM, and replies sent from a connected mailbox.
• To show each company the activity on its own documents and links.
• To answer questions with AI from the documents the person asking is allowed to see.
• To bill subscriptions through Stripe.
• To secure the service, prevent abuse, and investigate problems.
• To respond to support requests and to comply with the law.

We do not sell personal information, and we do not use it for advertising.

AI features (investor questions and answers, document search, and reply drafting) send the relevant text to AI models through OpenRouter. Every request asks OpenRouter to route only to zero-data-retention endpoints and denies data collection. Claude models are served on Amazon Bedrock and GPT models on Microsoft Azure. The embeddings used for document search are also routed this way.

A company may use its own OpenRouter key. Its requests use the same zero-data-retention routing; only the account that pays changes.

We do not use customer data to train AI models, and we route only to providers that do not train on it. Providers may still run automated abuse screening in real time and retain content only where the law requires it or their safety systems flag it.

A company owner or admin can connect a Gmail mailbox in Settings > Mailboxes so that replies approved in AI Dataroom are sent from that Gmail address. This section explains exactly what that connection uses.

What we request

• openid and email: to confirm which Google account was connected. We store the Google account's stable identifier and its verified email address, and we refuse the connection unless that address matches the mailbox.
• https://www.googleapis.com/auth/gmail.send: to send replies that a signed-in member of the company approved by clicking Send.

We do not ask for permission to read, search, change or delete messages in your Gmail account, and the Gmail connection does not read your mailbox. If we later offer read access to Gmail, we will update this policy before we request that access, and Google will ask you to grant it separately.

How we use it

• A reply is sent only after a signed-in user approves it by clicking Send. Nothing is sent automatically.
• Each sent reply is recorded as CRM activity in the company's workspace, together with the message and thread identifiers Gmail returns.
• Google user data is used only to provide this sending feature. It is not sold, not used for advertising, and not used to create, train or improve AI or machine learning models.
• People do not read Google user data except with your permission (for example, a support request you make), for security purposes such as investigating abuse, or to comply with the law.

How we store it

• Google's refresh token is encrypted by our application with AES-256-GCM, using a key that is separate from our other keys. The encryption is bound to the company, mailbox, user and Google account, so the token cannot be used for any other connection.
• Access tokens are not stored. A short-lived access token is obtained when a reply is sent and kept in memory only.
• Google user data is stored in our database in the United States, which is also encrypted at rest by our hosting provider.

Sharing

Google user data is not shared with third parties except the service providers that host AI Dataroom (listed under Sharing and subprocessors), and only to run this feature, for security, or to comply with the law.

Data received from Google APIs is not sent to AI models. If a member asks the AI to draft a reply, the request contains the conversation stored in the company's CRM and the investor's CRM details, and it goes through the zero-data-retention routing described in AI processing. The draft only fills the reply box; a person still has to click Send.

Retention, disconnecting and revoking access

• The encrypted refresh token is kept until the mailbox is disconnected, reconnected, or Google ends access. Then the stored token is destroyed.
• The temporary data used during the Google sign-in step expires after 10 minutes and is deleted automatically.
• To disconnect, open Settings > Mailboxes, choose the mailbox, and click Disconnect. Disconnecting revokes AI Dataroom's access at Google (unless another connection in AI Dataroom uses the same Google account, in which case the stored token is destroyed instead), cancels replies waiting for approval, and lets you delete the mail stored from that mailbox. Deleting is the default. A few records tied to a cancelled or unfinished send can be kept, and the page shows how many.
• You can also revoke access at any time at myaccount.google.com/permissions. AI Dataroom then stops sending from that mailbox and asks for a reconnect.

Mail you forward or BCC to AI Dataroom

An owner or admin can also create a private capture address for a mailbox, then forward investor mail to it with a Gmail filter or add it as BCC. That mail reaches us as ordinary email through our inbound email provider, Resend, not through Google's APIs, and only the messages you choose to send there are received.

• Each message waits for an owner or admin to review it. Accepting files it into the company's CRM inbox; rejecting deletes its content. Messages nobody reviews are deleted after 14 days.
• We keep the sender, recipients, subject, date, plain text and message identifiers, and the names of attachments. Attachment files and HTML are not stored.
• Turning capture off stops the address. Disconnecting the mailbox with deletion also deletes all mail captured for it.

Limited Use

AI Dataroom's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Read the Google API Services User Data Policy and the Google Workspace API User Data and Developer Policy.

Information in a company's room is visible to that company's members and to the investors and link recipients the company grants access. We share information with these service providers, only to run AI Dataroom:

• Supabase: database, authentication and file storage, hosted in the United States (AWS us-east-1).
• Vercel: application hosting, in its Washington, D.C. region (iad1).
• Stripe: subscription billing and payments.
• OpenRouter: AI request routing, to Amazon Bedrock and Microsoft Azure, with zero data retention as described in AI processing.
• Google: the Gmail API, only when a company connects a mailbox.
• Resend: receiving mail sent to a mailbox's capture address, only when a company turns capture on.

We may also disclose information when the law requires it, to protect the security of the service and its users, or as part of a merger or sale of the business. For Google user data, such a transfer happens only with your prior consent.

• Account, company, investor and document data is kept while the company uses AI Dataroom. Company admins can delete documents, share links and other content in the app.
• To delete an account or a whole company, contact us at hello@ai-dataroom.com.
• Google user data is kept and deleted as described in Google user data.
• The audit log is append-only and is kept as the company's record of activity.
• We do not currently keep separate database backups, so deleted data is removed from the database when it is deleted. If we add backups, we will update this policy with how long deleted data can remain in them.

• Every database table enforces company isolation with row-level security.
• Connections use HTTPS, and stored documents and database rows are encrypted at rest by our hosting provider.
• Gmail refresh tokens and company AI keys are additionally encrypted by our application.
• Invitation tokens are stored only as hashes, work once, and expire.
• Company actions are recorded in an append-only audit log.

No system is perfectly secure. If you find a security problem, please tell us at hello@ai-dataroom.com.

Depending on where you live, you may have the right to access, correct, export or delete your personal information, or to object to or restrict how it is used. To make a request, email hello@ai-dataroom.com. If your information is in a company's room, for example as an investor, we may pass your request to that company, because it controls that information.

You can disconnect Gmail at any time in Settings > Mailboxes or at myaccount.google.com/permissions.

AI Dataroom is a business service. It is not directed to children, and we do not knowingly collect personal information from anyone under 16.

We will post any change on this page and update the effective date. Before we use information in a new way, including any new use of Google user data, we will update this policy and, where required, ask for your consent.

Metalplant PBC, 213 North Market Street, Suite 1046, Wilmington, DE 19801. Email hello@ai-dataroom.com.