Effective date: 25 October 2026 (updated on 27 October 2026: optional helpers in the video maker, sections 2, 5 and 7; on 28 October 2026: the deck score and the weekly tips email for founders, sections 2, 5, 7, 9 and 12; on 29 October 2026: analytics on the founder portal, investors.hugeone.io and deck.hugeone.io, and an email to help founders create a startup, sections 2, 5, 7 and 12; and on 30 October 2026: the HugeOne network, sections 2, 5, 6, 7 and 9)

This policy explains how personal data is used for hugeone.io, founders.hugeone.io, investors.hugeone.io, deck.hugeone.io and free HugeOne app features made available to you. It covers visitors, account holders, app users, investors who join on the web, founders, startup collaborators, organisations and their representatives, people identified or pictured in submissions, prospective users, investors who receive HugeOne’s own investor presentation, business contacts and people who contact us. Descriptions of app processing apply when you use the relevant app features. The current service does not process investments, subscriptions or payments.

Earlier token sales and staking are separate from the current service. This policy does not replace privacy information applicable to those activities or remove participants’ rights. Contact info@hugeone.io for information or a privacy request concerning historical records. Joining the current service does not authorise unrelated reuse of those records.

1 Who is responsible

A.M.K. Ecoleaf Ltd, trading as HugeOne, is the controller of personal data used for the purposes described here. Our Cyprus registration number is HE272640 and our address is 11 Mnasiadou Street, 1065, Nicosia, Cyprus.

For privacy questions or requests, email info@hugeone.io, call +357 99918184 or write to that address. You do not need to use a special form or legal terminology. For help with the app or the founder portal, or to report a problem, email support@hugeone.io.

This policy does not automatically govern another company’s independent use of information. A startup remains responsible for its own decisions to collect and disclose personal data, including data and photos of its team. An organisation that adds a startup or invites colleagues is likewise responsible for the information it provides about them. We are responsible for our own review, hosting, publication and other processing described below.

2 Information we receive

Account information includes your name, email address, account identifier, sign in credentials handled by the authentication service, confirmation and recovery records, roles and access permissions, and the record of your confirmation that you are 18 or older and of your agreement to the Terms and acknowledgement of this policy, with the wording, the versions and the time. The app offers sign in with a code sent to your email address, sign in with Google and, on iPhone, sign in with Apple; accounts that have a password, such as founder portal accounts, can also sign in to the app with their email address and password. On investors.hugeone.io, you sign in with a code sent to your email address. The founder portal offers email and password and sign in with Google. We receive the identity information authorised through the chosen sign in method, which may include your name, email and profile image. Apple may provide a relay email address if you choose its email privacy option. We do not receive your Google or Apple password. App profile records also include the sign in provider and account creation and update timestamps.

Founder submissions may contain company names, locations, websites, logos, descriptions, products, target markets, business models and pricing, funding history and plans, named investors, traction information, questions and answers written by the startup, biographies, roles, LinkedIn links, team member photos, pitch decks, financial documents, legal materials, cap tables and other supporting files. Information about a company can also identify individuals. Do not upload unnecessary personal information or documents you are not authorised to share.

The portal also receives the main introductory video, up to four additional videos, a still picture taken from each video to show before it plays, and other media, milestone titles, proposed outcomes, target dates and planning percentages. The startup’s team can add a cover photo for the startup’s home in the app, from the portal or the app. Funding information is company background and planning data; collecting it does not mean the MVP executes investments or releases funds. Funding information, past funding rounds and a milestone plan are optional, and amounts are recorded in euro. The portal tells founders that HugeOne will use funding information only after it receives its crowdfunding licence (ECSP) from the regulator; until then it is not shown in the app.

If a founder uses HugeOne’s video maker, the video is made in the founder’s browser from the startup’s profile, and nothing is sent to us until the founder chooses to use it. We then record which startup used a video made with HugeOne, who used it and when, so that each startup’s first video made with HugeOne is free.

If the founder asks for them, two optional helpers in the video maker use outside services: an AI service suggests a short opening line from the startup’s name and problem text, and a screenshot service makes a picture of the home page of the startup’s website from its address. Only that text or that address is sent, nothing about the founder’s account, and the founder decides whether to use the result.

If a founder asks for a deck score, the text of the startup’s newest pitch deck, from its first 25 pages, is read in the founder’s browser and sent through our server to an AI service, which returns a score and three suggestions that only the startup’s team sees. We do not keep the deck text, the score or the suggestions; we keep only the time of each use, for 30 days, to apply a daily limit.

Collaboration and review information includes the email addresses of people invited to a startup or organisation, which we use to send them the invitation, membership permissions, application status, submission snapshots, review feedback, internal notes, document check results, the declarations, approvals and consents given in the portal with their version and date, messages exchanged with HugeOne in the portal or the app, the draft reminder emails sent, and activity or administrative audit records. Draft changes may be saved before an application is formally submitted.

If you register or join an organisation account, for example for an incubator, accelerator or university, we receive the organisation’s name, type, website, country, legal name, registration number, registered address, main phone number, contact and billing email addresses, LinkedIn page, short description, logo and certificate of incorporation. We also receive the account owner’s confirmation of authority to act for the organisation and agreement to our review of the certificate, the founder email address the organisation enters for each startup it adds, and the founder’s decision to approve or decline that startup. When an organisation invites founders or staff, we use the email address it gives to send the invitation, and HugeOne can resend or cancel the invitation.

Every founder portal user can give a first and last name, mobile phone number, job title and LinkedIn link on the Your details page. A mobile number is required for people who belong to an organisation. When an organisation’s account owner invites a colleague, the owner gives us the colleague’s email address, name and job title.

If you apply to join the HugeOne network as a partner, a city ambassador or a mentor, we receive the details you give in your application: your name, contact email address, LinkedIn link, city and country and a short biography and, for a partner, the company’s name, logo, industry, services, offer for HugeOne startups, website and the countries it serves, its contact person and the email address for introductions. We record your acceptance of the HugeOne Network Terms with the version and time, and our decision on your application with any reason for declining it. If you are approved, we also keep your profile and each change you make to it, with our decision on the change.

If a founder asks for an introduction to a partner or sends a mentor a request for help, we record the founder, the startup, the partner or mentor, the request and when it was made. If you create an account through a city ambassador’s personal link, we record which link you used.

For social features you use, we process the profile information, videos, updates, comments and interactions you submit, such as follows, likes, reports and blocks, including the reason given for a report. You can report an update, a comment, a whole startup profile or a private chat. If you block a person on comments, we record the block, and the comment concerned reaches us as a report. A founder update can contain text and up to four photos or one video of up to 60 seconds. We also receive support messages, reports, complaints, privacy requests and correspondence. When you email us from the app, the message includes the app version and phone model, which you can remove before sending. Available social features vary by service and release.

If you use Messages in the app, we process the messages you send and receive. An investor can start a private chat with a startup that is live in the app, and the startup’s owner replies for the startup. For each chat we store the messages, which contain text and links only and up to 2,000 characters each, who sent each message and when, when each side last read the chat, whether the investor chose to show their name in that chat, blocks, whether the investor removed the chat from their list, and any report with the reason chosen. Investors can also write to HugeOne in a chat pinned at the top of Messages. We store those messages and our replies, and each message an investor sends us is emailed to our review inbox and to our administrators with the investor’s name and email address.

You can add a profile photo in the app from your photo library or your camera. Until you choose one, the app shows the profile image provided by Google when you sign in with Google, if there is one. If you remove your photo, the app shows a plain icon instead.

The app and investors.hugeone.io ask where you are based and store the country you choose, which you can change later. The app also stores your choice whether to show your name on comments.

If you join on investors.hugeone.io, we receive your email address, your first and last name if you give them, your country and, if you choose to tell us, which description fits you best, the sectors you are interested in and how you heard about HugeOne. We record when you confirmed that you are 18 or older, whether and when you chose to receive news from HugeOne by email, and that you joined on the web. You use the same account in the app.

If you join the waitlist on hugeone.io, we receive the email address you enter in its form, which our website host stores for us. Joining the waitlist does not create a HugeOne account, an investment account or a commitment.

If you agree to receive news from HugeOne, we use your email address to send you our newsletter and keep a record of your choice. If you use the founder portal as a member of a startup team or of an approved organisation, we also use your email address, your first name and the name of your startup or organisation to send you news from HugeOne by email, which you can stop at any time. We may also hold the business contact details of people at incubators, accelerators, universities, startups, investor communities and other organisations, including people we meet at events: their name, role, organisation, website, LinkedIn page and a business email address where it is published, so that we can contact them about HugeOne.

If HugeOne sends you a personal link to its own investor presentation at deck.hugeone.io, we hold your name, your firm, your email address and any internal note an administrator adds. Each time the link is opened, we record when it was first and last open, how long the page was visible, the furthest section reached, whether a phone or a computer was used and the country reported by our hosting network. We do not use cookies for this, we do not record your IP address, and no analytics service receives this information. If you accept analytics on the presentation, Google Analytics receives only a page view, without your name, email address or the code in your link, as described in our Cookie Policy. The presentation says that the link is personal and that HugeOne can see when it is opened.

Technical information can include IP addresses, browser and device details, request timestamps, authentication and security events, error information and the browser storage described in our Cookie Policy. Optional analytics, if enabled, are described separately and require the appropriate consent where applicable.

The app records which startups you follow and when, and the star ratings you submit or update, linked to your account identifier. It uses these records to show your followed startups, select their updates and calculate follower counts and trends. Star ratings are private and are not shown to founders, other users or the public; HugeOne uses them as an internal quality signal, as an average and a count for each startup. Follower counts may appear in startup views; they are not financial assessments.

If you use “I’d fund this” for a startup, we record the amount you indicate, between €10 and €1,000,000, your confirmation that you understand it is not a commitment, when you first made and last changed the indication, how long you had followed the startup at that time, whether you let the startup see your name, and whether and when you withdrew it. We also keep a history of each change. An indication is not an investment, an order or a commitment, and no money is requested, collected or moved.

When you watch a startup’s video in the app, we record which video you watched, when you last watched it and how many times, counting at most one view a minute. The app uses this to show you a video you have not seen yet and to give the startup totals for each of its videos.

If you allow notifications, we store your phone’s notification token, whether the phone uses iOS or Android, when the token was registered and last used, and your setting for each type of notification. We also keep a record of the notifications sent to you so that the app can list them.

We also keep records about how the service is run: an activity log of what startup teams do in the portal, a record of HugeOne’s administrative decisions, a log of the emails we send with the recipient, subject, content data and delivery status, records of account suspensions with the reason and dates and, when an account is deleted, the minimal closure record described in section 9.

App diagnostics can include device and app details, error messages, stack traces and diagnostic identifiers through Firebase Crashlytics. Diagnostic processing is separate from optional usage analytics and must be limited to its disclosed purpose.

Where diagnostic technology requires consent to access or store information on your device, we ask for that consent before the relevant collection. Diagnostic data is used to investigate errors and maintain the service, not to assess investment suitability.

We do not request payment-card or bank-account information to use the free MVP. We do not require routine financial KYC or biometric identification under this policy. Do not upload identification documents or special-category personal data unless we specifically explain a necessary, lawful process first. If we receive unnecessary sensitive information, we will assess whether to remove or restrict it.

3 Where information comes from

We receive information directly from you, from your use of the services, from an identity provider you choose, and from people who invite you or include you in a startup submission. A founder may give us a teammate’s email address, and an organisation may give us a founder’s or a colleague’s email address, name and job title, before that person has an account; we use the email address to send the invitation. We may also receive business contact details from people we meet at events or from public professional sources, such as company websites, LinkedIn pages and business contact databases. Reporters may provide information about other users or content.

If someone adds you as a team member, uploads your photo or names you in a submission, we may receive your professional details and photo without you first creating an account. Section 4 explains how we handle information about people shown on startup profiles. You can contact us to ask what we hold, where it came from, who can see it and whether it can be corrected or removed. Where required, we will provide this privacy information directly within the applicable time limit rather than relying only on the submitter to inform you.

4 People shown on startup profiles

A startup’s profile in the app can show its team members, with their name, role, short biography, LinkedIn link and photo. This information comes from the startup’s founders, not from the person shown, and the person may have no HugeOne account. Before a team member is shown, a founder must confirm “This person agreed to be shown in the HugeOne app with these details and photo, and knows they can ask HugeOne to remove them at any time.” We record who confirmed and when.

Team member details and photos are shown to registered users signed in to the HugeOne app once the profile is published. HugeOne administrators can remove them. They are kept while the startup exists or until they are removed, as explained in section 9.

If you are shown on a startup profile and want your details or photo corrected or removed, email support@hugeone.io. You do not need to contact the startup first.

5 Why we use data and our legal bases

We use a legal basis for each purpose, rather than treating registration as consent to everything.

Providing an individual user’s service. We use account information, authentication records and content or interactions you request us to process, such as your profile photo, to create and operate your account, provide requested features and respond to service requests. The basis is performance of our contract with you, or steps you request before entering that contract, to the extent the processing is necessary for that purpose.

Working with company representatives and teams. We use professional contact details, including those given on the Your details page, invitations, role information and submissions to administer company accounts and coordinate review. Where the contract is with the company rather than the individual, the basis is our legitimate interests in providing the company service, managing authorised access and communicating with its representatives. Those interests are balanced against the individuals’ rights.

Verifying and administering organisations. We use an organisation’s details, its certificate of incorporation and the account owner’s confirmation of authority to check that the organisation exists and that the person registering may act for it, before it can add startups. We use the contact details of the organisation and its people to administer the account and communicate about it, and the billing email to send invoices if organisation fees are introduced. Our team is emailed when an organisation registers, and receives the old and new values when an organisation changes its name, legal name, registration number or address, so that we can check them again. When an organisation adds a startup, we email the founder to ask for approval; if the founder declines, we tell the organisation and our team. The basis is our legitimate interests in verifying organisations and administering their accounts.

The HugeOne network. We use applications to decide whether to admit a partner, city ambassador or mentor, which can include looking at the LinkedIn page and website given, and we email the applicant our decision, with the reason if we decline. We show approved profiles and check each change before it is shown. When a founder asks, we send the founder’s name, email address, startup and request to the partner or mentor concerned. We count the accounts created through each ambassador’s personal link; the ambassador sees only the number, not who signed up. The basis is performance of our contract with the applicant or member, or steps taken at their request before entering it; for introductions and help requests, performance of our contract with the founder who asks for them; and for counting sign ups through a link, our legitimate interests in recognising ambassadors’ work.

Reviewing startup information. We process submissions, feedback, messages exchanged with HugeOne and relevant supporting information to assess whether the required information is present, request corrections and manage applications, including our review of each additional video before it is shown in the app. When a startup is created or sent for review, our team receives an internal email with the startup’s name and the founder’s name and email address, and each message a startup’s team sends us is emailed to our review inbox. We also receive an internal email when an owner approves the publication of a profile after our review, with the startup’s name, the profile version and the founder’s name, and when a profile, update or comment is reported, with the startup’s name, what was reported and the reason given, without naming the person who reported it. These internal emails go to our review inbox and to each HugeOne administrator’s hugeone.io address, never to a personal mailbox, and administrators can switch off these copies. We send draft reminder emails after 3 and 7 days without changes and a final one after 14 days, which founders can switch off. A founder portal account that has confirmed its email address but, 2 days after sign up, is not yet part of any startup or organisation receives one email to help its holder create a startup; it is not repeated. We also send the owner of a startup in draft, asked for changes or live at most one tips email a week, with the startup’s profile strength, the next steps to improve the profile and, for a live startup, its own statistics; it can be switched off in Your details or with the link in each email. The basis is contract where necessary to provide a service to the individual applicant; otherwise it is our legitimate interests in maintaining useful, accurate profiles and a manageable review process. This does not establish a financial KYC or investment screening obligation.

Showing information to its intended audience. We process user posts and approved profile information to provide the publication or interaction requested. This is based on contract for the submitting individual’s requested service. For professional information and photos of other team members, we assess our legitimate interests in presenting authorised, relevant team information against their privacy interests, taking into account the founder’s confirmation described in section 4. Founder permission to publish does not replace the need for a lawful basis for each person’s data.

Recording “I’d fund this” indications. We use your indications to record your interest and let you change or withdraw it at any time, to show the startup the country, amount and date of each current indication, to show on the startup’s profile how many people currently say “I’d fund this”, to understand interest in startups on HugeOne and to tell you when the startup’s round opens on HugeOne. The startup sees your name only if you choose to share it. The basis is performance of our contract with you, for the feature you ask us to provide; sharing your name with the startup is based on your consent, which you can change at any time.

Understanding where users are based. We use the country you give to understand where HugeOne users are, to prepare for rules that may depend on where investors are based, to show founders where their followers come from and the country of each indication, and to show your country next to your comments. The basis is performance of our contract with you for the features that use your country, and our legitimate interests in understanding where HugeOne users are.

Giving founders statistics. We use follows, likes, comments, indications and videos watched to show a startup’s team statistics about its own startup in the app and the portal, such as followers over the last 30 days, followers by country, weekly likes and comments, the country and amount of each indication, and totals for each video. These statistics do not show who followed, liked or watched. The basis is our legitimate interests in helping startups understand the interest in them, using figures that do not identify individual users.

Showing videos you have not seen. We use the record of videos you watched to show you a startup video you have not seen yet. The basis is our legitimate interests in showing you videos you have not seen.

Sending notifications. We use your notification token, your notification settings and the relevant activity to send the notifications you allow, such as updates from startups you follow, replies to your comments, new startups, new private messages and replies from HugeOne and, for founders, comments on their updates, the status of their updates, messages from HugeOne and a weekly summary, and to list them in the app. We also send announcements called News from HugeOne as app notifications to investors, startup teams or everyone, at most one a week and never by email. You can turn each type off in the app’s settings or stop all notifications in your phone’s settings. The basis is your consent, given through your phone’s notification permission and the switches in the app, which you can change at any time.

Safety and service reliability. We use proportionate technical records, reports about updates, comments and startup profiles, blocks, automatic checks of uploaded files, photos and videos, suspension records and audit information to prevent abuse, investigate incidents, moderate content, suspend accounts where necessary and resolve disputes. The basis is our legitimate interests in protecting users and maintaining reliable services, or a legal obligation where a specific law requires processing. We do not describe all safety activity as legally required.

Private messages. We use the messages in a chat, and the records about it, to deliver each message to the other side, show the chat to the two people in it, count unread messages and send the notifications you allow. A message notification shows on your phone who wrote and the beginning of the message; an investor who has not shown their name appears as “an investor”. HugeOne does not read private chats between investors and startups. When one side reports a chat, our administrators can read that chat to decide whether to keep it or close it for both sides. HugeOne does not arrange or take part in any investment discussed in a chat. The basis is contract for the messaging feature you use, and our legitimate interests in keeping users safe when we read a reported chat.

Keeping comments and messages respectful. When you send a comment or a private message, it is checked automatically against our list of words that are not allowed. A comment or message that contains one is not saved, and you are told why so that you can rephrase it. The basis is our legitimate interests in keeping HugeOne free of offensive content and protecting its users.

Helping founders make videos. When a founder asks for an AI suggested opening line or a picture of the startup’s website, we send the startup’s name and problem text, or its website address, to the services named in section 7. The basis is performance of our contract with the founder, who asks for these helpers.

Scoring pitch decks. When a founder asks for a deck score, we send the text of the startup’s pitch deck to the AI service named in section 7. The basis is performance of our contract with the founder, who asks for it.

Running and overseeing the service. HugeOne administrators use an internal area that shows each investor’s details and activity, including name, email address, country, follows, “I’d fund this” indications, ratings, comments and videos watched, together with investors’ messages to HugeOne, private chats that someone reported, the activity log, the record of administrative decisions and the email log. It also lists founder portal accounts without a startup, with the sign up date, whether the email address was confirmed and when the account last signed in. We use these to support users, review and moderate, resend emails that failed to arrive and keep a record of who did what. Administrators can export lists of investors and of “I’d fund this” indications to a spreadsheet for internal use only; exported files are deleted within 30 days. The basis is our legitimate interests in running a secure, accountable service and supporting its users.

Investor accounts on the web. We use the details you give on investors.hugeone.io to create your account, show you relevant startups, understand where investors come from and record that you are eligible and what you agreed to. The basis is performance of our contract with you, and our legitimate interests in understanding where investors come from.

Website waitlist. We use the email address you leave on hugeone.io to record your request and send you launch updates about HugeOne. Our basis is taking steps at your request before providing the service. The form links to this policy, and you can leave the waitlist by emailing info@hugeone.io.

Optional communications and analytics. We use consent for optional promotional communications and optional analytics where consent is required. Investors who join on investors.hugeone.io can tick “Send me news from HugeOne. You can stop them at any time.”, separately from everything else, and only investors who ticked it receive news by email. Members of startup teams and of approved organisations on the founder portal receive news from HugeOne by email as account holders, about HugeOne and the founder portal. A HugeOne administrator writes each news email and sends it to a group; each person receives their own copy with their first name and the name of their startup or organisation. The email shows the administrator’s name, and replies go to that administrator’s email address. The same group receives at most one news email a day. Every news email has an Unsubscribe link that works without signing in, and founder portal users can also switch news off in Your details. If we offer a separate newsletter sign up, it will use an unticked box, “Send me the HugeOne newsletter. You can unsubscribe at any time.”, and a confirmation email; we will name the newsletter tool in this policy before it is used, and we will not measure whether newsletters are opened or clicked without your consent. On hugeone.io, founders.hugeone.io, investors.hugeone.io and deck.hugeone.io, analytics cookies are used only if you accept them on that site, as explained in our Cookie Policy. On founders.hugeone.io, investors.hugeone.io and deck.hugeone.io, analytics counts page views only and never receives your name, email address or account identifiers, and the administrator area is never measured. You can withdraw consent or stop news without losing access to the core service, using the Unsubscribe link in a news email, your account details, the cookie settings on each of these sites or by contacting info@hugeone.io. Necessary account, security, reminder and application status messages are service communications and continue when you stop news.

Business outreach. We may email incubators, accelerators, universities, startups and other professional contacts, including people we meet at events, about HugeOne, using business contact details they gave us or published for business purposes. An AI assistant helps us research public business information and draft first messages, and a member of our team reads and sends each one. We stop if they ask us to. The basis is our legitimate interests in developing HugeOne’s business. We use only business contact details, never private ones. Each first message says who we are, why we are writing and where we found the contact details, links to this policy and lets the person reply “stop”. Where the law of the person’s country requires prior consent for such emails, we do not email them without it and may contact them through a professional network instead.

Our investor presentation. We use the details of investors we choose to contact personally to send them a link to HugeOne’s investor presentation, by an email from HugeOne or from an administrator’s own mailbox, to see whether and how the presentation was viewed and to follow up about HugeOne’s own funding. Every HugeOne administrator is emailed when a link is opened for the first time, and only HugeOne administrators see these details. The basis is our legitimate interests in raising funds for HugeOne from investors we contact personally.

Legal requests and claims. We process relevant records where necessary to comply with an applicable legal obligation, and on the basis of legitimate interests to establish, exercise or defend legal claims. This includes the minimal closure record kept when an account is deleted (section 9). Access and retention are limited to what the purpose requires.

Where we rely on legitimate interests, you may object for reasons relating to your situation. We will assess the objection under applicable law. You may object to direct marketing at any time, without giving a reason.

6 Private information and public content

Founder drafts and private supporting files are accessible within the authorised startup team and HugeOne review workflow, and to providers supporting that workflow as necessary. Internal administrative notes are not automatically visible to the startup team.

Submitting an application or choosing a document label referring to investors does not, by itself, make a private supporting document public. We will explain the intended audience and obtain the authorised representative’s publication instruction before sharing private materials outside the review workflow, unless disclosure is otherwise legally required.

An organisation’s certificate of incorporation can be opened only by HugeOne administrators. We keep it private and do not share it, unless the law requires it. The organisation’s logo is shown to its members and to HugeOne. Colleagues in an organisation see the organisation’s details and each other’s names and job titles. Only HugeOne sees mobile phone numbers. A startup added by an organisation shows “Part of” and the organisation’s name in the app.

Startup profiles, videos and updates are shown only to registered users signed in to the HugeOne app; they are not published on the open web. Updates posted by a startup’s team, and the comments on them, can be read by every signed in user, not only by the startup’s followers. Your comments show “Investor” and your country, for example “Investor · Cyprus”, unless you choose in the app’s settings to show your first name and the initial of your last name, for example “Maria K.”. A startup’s cover photo is shown only to its own team.

For “I’d fund this”, the startup sees the country, amount and date of each current indication, and your name only if you chose to share it. Every app user sees how many people currently say “I’d fund this” for a startup, but not amounts or names. You see all your own indications, including withdrawn ones, under My interests in the app. HugeOne administrators see each indication with your name, email address, country and how long you had followed the startup. Star ratings are seen only by the person who gave them and by HugeOne.

Founders see how many people follow their startup, how that number changed over the last 30 days and where followers are based. A country is named only when at least 3 followers come from it; smaller groups are shown as “Other”, and the startup’s own team is not counted. For each video, the startup sees only the number of views and the number of people who watched, never who watched; views by the startup’s own team and by HugeOne administrators are not counted. HugeOne administrators can see the videos each investor watched.

Only you see your profile photo in the app; founders and other users do not, and your comments still show your country or the name you chose to show. HugeOne administrators can see profile photos and remove them. Team member photos are shown to every app user on the startup’s Team tab, next to the person’s name, role and LinkedIn link, and HugeOne administrators can remove them.

Only HugeOne sees reports, and we never tell the person or startup reported who reported them. The person you block on comments is not told.

A private chat can be read only by the investor and the startup’s owner, and by HugeOne if the chat is reported. Other members of the startup’s team and other users do not see it. The startup sees the investor as “Investor” and their country, for example “Investor · Cyprus”, unless the investor chose to show their name on comments or taps Show my name in that chat, which cannot be undone for that chat. Either side can block the other, and the other side cannot write again in that chat. When you report a chat, the other side is not told who reported it. The person you write to can copy or keep what you write.

Information deliberately published in a startup profile, video, update or comment can be viewed and copied by the registered users who can see it. Because profiles are shown only to signed in users, they are not made available to search engines. Do not post information you intend to keep private. Contact us about an incorrect or unauthorised disclosure.

Approved HugeOne network profiles are public, unlike startup profiles: anyone can see them on founders.hugeone.io, search engines can find them, and partners’ names and logos can also be shown on hugeone.io. The application form shows which details appear on a profile; contact and introduction email addresses and our decisions are not shown.

7 Providers and other recipients

We share information only as needed for the purposes described, including with authorised personnel, your authorised startup or organisation collaborators, the audience of your published content, and providers supplying hosting, authentication, storage, communications, security or support.

When a founder agrees to an introduction or sends a request for help, the partner or mentor concerned receives the founder’s name, email address and startup and the request. They use them under their own responsibility and the HugeOne Network Terms, which allow them to use these details only to reply to that founder about that request.

HugeOne’s database, sign in service and file storage run on our cloud platform provider’s service, which is built on Supabase, with the data stored in the European Union (Amazon Web Services, Ireland). The same provider’s hosting, which runs on Cloudflare’s global network, operates founders.hugeone.io, investors.hugeone.io and deck.hugeone.io, and its email service sends our emails, including our news emails and invitations to our investor presentation. Sign in with Google in the founder portal and in the app uses that provider’s authentication service and Google’s separate identity service. Fonts hosted by Google, used by founders.hugeone.io, investors.hugeone.io, deck.hugeone.io and hugeone.io, cause browser requests to Google that disclose network and browser information, including your IP address, to deliver the font files.

Google Firebase is used only for Firebase Crashlytics, which receives crash reports with details such as device model, system version and app version, and Firebase Cloud Messaging, which delivers app notifications with their title and text, on iPhone through Apple’s push notification service. Apple supplies sign in with Apple on iPhone, and Apple and Google run the App Store, TestFlight and Google Play, through which the app is distributed. Netlify hosts the hugeone.io website and stores the email addresses left in its waitlist form, and GoDaddy manages our domain names without receiving information about users. If you accept analytics cookies on hugeone.io, founders.hugeone.io, investors.hugeone.io or deck.hugeone.io, Google Analytics receives information about your visit, as described in our Cookie Policy. If you choose to watch the video on hugeone.io, it loads from YouTube in its privacy enhanced mode.

Our investor presentation at deck.hugeone.io also loads software libraries from public content delivery networks (jsDelivr and cdnjs), which receive your IP address to deliver the files. We keep business contacts and internal plans in Notion, a workspace service, and use Claude, an AI assistant made by Anthropic, to help research public business information, draft messages and summarise reports about content for our team, who decide on each report; both are based in the United States. An administrator may also send an invitation to our investor presentation from their own email account.

Our team’s email, such as support@hugeone.io and info@hugeone.io, and our internal documents run on Google Workspace. GitHub, a code hosting service, stores our software code and daily backups of our internal files.

When a founder asks for an AI suggested opening line or a deck score, the startup’s name and problem text, or the text of its pitch deck, are sent, through our cloud platform provider’s AI service, to Google’s Gemini AI service, which returns the result. Our provider may keep the request and the result for up to 90 days and does not use them to train its models; Google may keep them for up to 55 days to detect abuse and does not use them to train its models. When a founder asks for a picture of the startup’s website, the website address is sent to Microlink, a service based in Spain, which opens the public home page and returns a picture of it; we do not keep the picture unless the founder uses it in the video.

If we introduce an external file-scanning service that receives uploaded files, we will explain that processing before it begins. File validation does not certify the accuracy of a document’s contents.

Providers acting as processors must process personal data under appropriate instructions and contractual safeguards. Some services, such as a chosen external identity provider, also process information for their own purposes under their own policies. We do not describe every recipient as a processor.

We may disclose relevant information to advisers, courts, regulators or law-enforcement bodies where lawfully required or necessary to address a legal claim. We assess the request and limit disclosure where appropriate. Any business transfer affecting personal data would require appropriate safeguards and information to affected people; it would not justify unrelated use of private submissions.

We do not sell personal data under this MVP service or make private founder documents available to other users merely because they are described as prospective investors.

8 International processing

Our database and stored files are kept in the European Union, in Ireland. Google Firebase, Google Analytics, Apple, Google, Netlify, GoDaddy, GitHub, Notion and Anthropic are services based in the United States, and our hosting provider runs on Cloudflare’s worldwide network. Processing and support access by these providers may therefore take place outside Cyprus and the European Economic Area, where data protection rules can differ. Choosing an external sign in provider also involves that provider’s international services and privacy practices.

Our policy is to permit transfers outside the European Economic Area only where a lawful transfer basis applies. This can be a European Commission adequacy decision covering the recipient, such as the EU and US Data Privacy Framework for certified companies, or appropriate safeguards, such as the Commission’s Standard Contractual Clauses with additional protection where needed. For our providers in the United States we rely on the EU and US Data Privacy Framework where the provider is certified under it, and otherwise on the Standard Contractual Clauses. We do not treat your acceptance of these Terms or this policy as consent to unrestricted international transfers. Contact info@hugeone.io for information about the destinations and safeguards relevant to your data, including how to obtain a copy of applicable safeguards, subject to necessary redactions.

9 Retention and deletion

We retain personal data only for the period justified by the purpose for which it is held. The relevant criteria are the ongoing account or application, the need to preserve a review history, security investigations, applicable legal requirements and the reasonable need to handle an existing or anticipated dispute. Retention is not automatically indefinite because an account has been inactive.

Account and profile information is kept while needed to provide the account or manage an active application. For abandoned drafts, rejected applications and inactive accounts, we assess whether there is a continuing purpose and delete or anonymise information when there is not. Submission snapshots and internal review records are included in this assessment, not treated as exempt from deletion.

Published content is retained while publication remains requested and lawful. Removing a post from the live service may not immediately remove residual backups. Backup data must remain protected and outside ordinary use until it is overwritten or deleted through the applicable backup cycle. Restoring a backup must not undo a valid deletion request.

Follows, star ratings, likes, your country, your name choices, your investor details and your profile photo are kept while your account exists, unless you remove or change them earlier. “I’d fund this” indications are also kept while your account exists; when you withdraw an indication, the startup and other users no longer see it, but we keep it marked as withdrawn, together with the history of changes. The record of videos you watched is kept while your account exists.

Private chats and their messages are kept while both the investor’s account and the startup exist, and a chat is deleted after 2 years without a new message. A chat that was reported is kept for 12 months after our decision on the report. When an investor removes a chat from their list, it is not deleted; the startup can still see it, and it returns to the investor’s list if a new message arrives. An investor’s messages with HugeOne are kept while the account exists.

When you delete a comment, or a startup’s team deletes an update, it disappears from the app at once, but we keep a record of it. We also keep updates and comments hidden by HugeOne. These records are deleted 12 months after the deletion or our decision to hide them. Comments are deleted when their author’s account is closed.

The app lists your notifications for 60 days, and notification records are deleted after 90 days. A phone’s notification token is deleted when you sign out on that phone, when the notification service reports that the token no longer works or when your account is closed.

Some records are kept for a fixed period and then deleted automatically every day: the log of emails we send for 12 months; the activity log of what startup teams do in the portal for 2 years; and the record of HugeOne’s administrative decisions, the administrative audit records and messages exchanged with HugeOne for 6 years. Suspension records are kept until the account is closed. Invitations are kept until they are accepted, cancelled or expire. The 6 year periods follow the limitation period for contract claims in Cyprus.

Records of the use of the deck score, with the startup and the time of each use, are deleted after 30 days.

A startup’s owner can hide it from the app and show it again; hiding deletes nothing. If a startup is deleted before HugeOne ever reviewed it, it is deleted completely, with its files and team member photos. If a startup that was reviewed or live is deleted, it disappears from the app and the portal and its team loses access, but we keep the records of its submissions, declarations and publication approvals, including team member photos, which are no longer shown. We keep these records for 6 years after the deletion, based on our legitimate interests in being able to deal with legal claims. Otherwise, team member photos are kept until the startup removes them.

Organisation details, the certificate of incorporation, the logo and the details of the organisation’s people are kept while the organisation account exists. If an organisation’s owner removes a registration made by mistake, its certificate and logo are deleted. When an organisation account ends, its certificate of incorporation is deleted within 30 days and its other records are kept for 6 years.

Declined applications to the HugeOne network, with our decision and its reason, are deleted 6 months after the decision. A member’s application, profile and the record of changes to it are kept while they are a member; when membership ends, the profile is removed from public pages at once and these records are deleted 6 months later, except the record of the member’s acceptance of the HugeOne Network Terms, which is kept for 6 years. Records of introductions and help requests are deleted 2 years after the request. The record of which personal link an account was created through is deleted 2 years after the account was created, or earlier when the account is deleted.

Investors can delete their account in the app or on investors.hugeone.io. When an account is deleted, we delete your account, profile, investor details, profile photo, country and name choices, follows, star ratings, “I’d fund this” indications and their history, comments, likes, the reports and blocks you made, your private chats with startups and their messages, your messages with HugeOne, the record of videos you watched, your notification settings, your notification records and your phone tokens, subject to the backup cycle described above.

We then keep a minimal closure record for 6 years, after which it is deleted automatically. It shows when the account was opened and closed, whether you or HugeOne closed it, its roles, which versions of the Terms and this policy you accepted and when, whether you agreed to receive news, and your email address only as a one way hash, which cannot be read but can be matched if a dispute arises. The log of accounts closed by HugeOne also keeps email addresses only in this form.

Founders and other startup team members ask us to close their account by emailing support@hugeone.io. Each startup they own passes to the teammate who joined first, who is told by email, stays with its organisation, or is closed. Their follows, ratings and profile photo are removed, their “I’d fund this” indications are withdrawn, their comments are hidden, the messages they wrote in their startup’s private chats stay in those chats, and sign in is refused permanently. Because the startup’s submission, declaration and approval records stay linked to the account, the account itself, including its email address, is kept rather than deleted. An account that is not part of any startup is deleted as described above. We confirm the closure by email. We keep such an account for 6 years after the closure, based on our legitimate interests in being able to deal with legal claims, and then anonymise its email address.

Security logs, access records, support correspondence and complaints are kept only for the justified security, resolution or legal period. We retain a limited record of an opt-out where needed to respect it, rather than continuing to use the address for marketing.

Your choice about news from HugeOne, and about the weekly tips email, is kept with your account. If you unsubscribe or switch news off, we stop sending news and keep your email address with the date and the way you stopped, so that we can respect your choice. The Unsubscribe link in each news email contains a random code that only identifies your email address for this purpose. Each news email you receive is kept in the log of emails we send for 12 months, like our other emails.

Waitlist email addresses are retained while needed to send the launch updates you asked for, and at the latest until 12 months after HugeOne’s public launch. If you leave the waitlist, we stop those updates and delete your address unless there is a separate justified reason to keep it. Business contact details used for outreach are kept while they remain relevant to our contact with that organisation, and we delete them 2 years after our last contact, or at once if the person asks us to stop, keeping only a note not to contact them again.

Records of the openings of a personal link to our investor presentation are deleted 12 months after the last opening. The link itself, with the investor’s name, firm and email address, is kept while we are in contact with that investor and deleted 2 years after our last contact.

We may retain specific information longer if required by law or reasonably needed for a particular legal claim. We will restrict its use accordingly and explain any relevant reason if we cannot fully comply with your request.

10 Security

We use technical and organisational measures appropriate to the information and risks, including authorised access and controls around private files. No online service can guarantee absolute security. We do not claim that all information is end-to-end encrypted or that every uploaded file has received an external malware scan.

HugeOne administrator accounts are created only by an email invitation from another administrator, accepted by signing in with the invited address, and administrative actions are recorded. Legal records such as acceptances, declarations and approvals cannot be edited.

In the app you can protect access with a passcode and, where your phone supports it, Face ID. The passcode is stored only on your phone, in a protected form that cannot be reversed, and is not sent to us. Face ID is checked by your phone; we do not receive your biometric data.

If your account has a password, it is handled by the sign in service and stored only in a protected form that cannot be reversed; HugeOne cannot read it. Keep your password private. You can change or reset it on founders.hugeone.io.

Protect your own credentials and report suspected unauthorised access to info@hugeone.io. We assess incidents and notify affected people and authorities where applicable law requires it.

11 Your rights

Subject to the conditions in applicable law, you may ask to access your personal data, correct it, erase it, restrict its processing, object to processing based on legitimate interests, and receive or transfer qualifying data in a portable format. You can withdraw consent at any time without affecting processing that was lawful before withdrawal.

You can delete an investor account in the app under Profile, Personal details, Close account, or on investors.hugeone.io. Founder accounts are linked to a startup and cannot be closed in the app; founders can ask us to close their account by emailing support@hugeone.io, as described in section 9.

You can make a request at info@hugeone.io. We may request proportionate information to verify identity where reasonably necessary, but will not routinely demand an identity document for every request. Requests are normally free. Any lawful fee or refusal for a manifestly unfounded or excessive request will be explained.

We respond without undue delay and normally within one month. Where the law permits an extension because of complexity or the number of requests, we will tell you within the first month and explain the reasons. We will explain any lawful restriction or refusal and how you can challenge it.

You may complain to the Cyprus Commissioner for Personal Data Protection at https://www.gov.cy/dataprotection/ or, where applicable, the supervisory authority in the country where you live, work or believe an infringement occurred. You do not have to contact us first.

12 Automated processing and required information

The founder portal uses rule based checks of required information and file validation checks. A checklist shows the information required to submit, and a profile strength score shows how much of the optional information is filled in; neither is an investment rating, and the score does not block submitting. Uploaded logos, photos and videos also pass an automatic safety check before they appear in the app. Technical checks may block incomplete submissions or unsafe files, and you can contact us about a problem.

The app’s Updates tab shows updates from the startups you follow, or from every live startup when you choose All startups. You can change what you see by following or unfollowing startups or by switching between the two views. The swipe deck shows first the startups HugeOne has chosen to feature, with a “Featured” label; this placement is HugeOne’s editorial choice and not a recommendation. When a startup has more than one video, the app prefers one you have not watched yet. Follower totals and the number of “I’d fund this” indications are calculated from user activity and do not make an investment decision for you.

Simple rules also decide when the app shows founders tips, for example when no update has been posted for 7 days, which notifications are sent, for example no more than one notification about new startups a day and no more than one announcement a week, when draft reminder emails and the email to help create a startup are sent, and what the founders’ weekly summary and weekly tips email contain. These rules affect only what the app shows or sends. The profile strength in the tips email is worked out automatically from what the profile contains; it only suggests next steps and has no effect on review or publication. The deck score is produced by an AI service only when a founder asks for it; it is shown only to the startup’s team and has no effect on review or publication.

We will explain any new activity-based ranking or materially different automated processing before introducing it. Posting frequency or feed visibility is not a verification of company performance. If an automated check prevents you from proceeding or you wish to challenge a restriction, contact info@hugeone.io to request human review.

Required fields are identified in the relevant form. Without necessary account or application information we may be unable to create an account, allow access or review a submission. Optional information and optional marketing consent are not prerequisites for unrelated core functions.

13 Age and policy changes

Accounts are restricted to people aged 18 or over. Everyone confirms “I am 18 or older, and I agree to the Terms and Conditions and acknowledge the Privacy Policy.” before using the app, the founder portal or investors.hugeone.io.

The services are not intended for accounts held by children. If you believe a child has provided personal data, contact us so we can assess and appropriately address it.

We will update this policy when practices change and show the effective date. Material changes will be brought to your attention as appropriate, and the app and the founder portal may ask you to acknowledge a new version when you next sign in. A policy update alone is not permission to use personal data for an incompatible purpose or a substitute for fresh consent where required.