Privacy policy

Who we are

Winfred (winfred.co.uk) publishes a structured record of UK startup funding announcements. The site is operated by C8VA Limited, a company registered in England and Wales, which is the controller of the personal data described in this policy for the purposes of UK data protection law.

Data about visitors

We use PostHog for product analytics: page views, interaction events, device and browser information, and approximate location derived from your IP address. We use this to understand how the site is used and to improve it. Our infrastructure also keeps standard server logs (IP address, request path, timestamps) for security and reliability.

If you subscribe to our newsletter, we hold your email address to send it, and nothing else. You can unsubscribe at any time.

Data about account holders

If you create a Winfred account we hold: your email address; your password, stored only as a bcrypt hash (we cannot read it); the companies and investors you follow; your email preferences; a private token for your personal RSS feed URLs; and session records (a session identifier plus the IP address and browser it was created from, kept for account security). We process this data because it's necessary to provide the account you asked for (Article 6(1)(b) UK GDPR).

An account also links your analytics to you: once signed in, the PostHog events described above are associated with your account (your account ID and email address) rather than an anonymous identifier, so we can understand how the features you use are working.

We email account holders in two ways. Service emails — password resets and similar — are part of operating the account and cannot be opted out of while the account exists. Feature emails — alerts when someone you follow raises, and the daily digest of new rounds — are on by default when you create an account and can each be switched off at any time on your settings page; the emails also carry an unsubscribe header your mail client understands.

To delete your account and the data above, ask through the data requests page from the email address on the account.

Data about founders, investors, and companies

Winfred publishes information about people named in funding announcements: names, job titles and roles, employers, short biographies, quotations given to the press, LinkedIn profile links, and photographs. This information is sourced from the public domain: press releases and funding announcements, company websites, and publicly available professional profiles and business information services.

We process this data under legitimate interests (Article 6(1)(f) UK GDPR): maintaining an accurate public record of UK startup funding activity, which the individuals concerned have themselves placed in the public sphere through announcements they participated in. We record what was publicly stated and do not publish private contact details.

If you are featured on Winfred you can ask us to access, correct, redact, or remove your data at any time through our data requests page, or object to the processing altogether. We aim to respond within one month.

Infrastructure and processors

The site is hosted on DigitalOcean, and traffic is proxied through Cloudflare for content delivery and security (Cloudflare therefore processes visitor IP addresses in transit). PostHog processes the analytics described above, and our email provider processes the address and content of the emails we send you. Each processes data on our behalf under their own data processing terms.

Cookies

We use strictly necessary cookies for the operation of the site — including the session cookie that keeps you signed in to your account — and analytics cookies for PostHog. We do not run advertising or sell data to anyone.

Retention

Published funding records are retained as an ongoing archive. Account data is kept while your account exists and deleted when the account is; expired sessions are cleared routinely. Analytics data is retained per our PostHog configuration, and data requests are kept for as long as needed to handle and evidence them.

Your rights

You have the right to access, rectify, erase, restrict, and object to the processing of your personal data, and to data portability. Submit any request through the data requests page. If you are unhappy with our response, you can complain to the Information Commissioner's Office (ico.org.uk).

Changes

We will update this policy as the service evolves and change the date at the top when we do.