This Privacy Policy ("Policy") describes how invest.lease ("Company," "we," "us," or "our") collects, uses, discloses, and safeguards personal information in connection with your access to and use of the invest.lease platform (the "Platform"). This Policy applies to all users, including those who register via email or authenticate through a third-party social login provider such as Google or LinkedIn. By accessing or using the Platform, you acknowledge that you have read and understood this Policy and consent to the data practices described herein. This Policy forms part of our Terms of Service.
The controller responsible for your personal data is invest.lease S.C.A., a société en commandite par actions with registered office at 31 Boulevard Prince Henri, L-1724 Luxembourg, Grand Duchy of Luxembourg, represented by its general partner FUNDREAL Capital Partners S.à r.l. (the "Controller"). You may contact the Controller in relation to any data protection matter, including to exercise the rights set out in Section 12, at support@invest.lease.
We collect personal information in the following categories:
Where the General Data Protection Regulation (GDPR) or UK GDPR applies, we are required to identify a lawful basis for each processing activity. We rely on the following legal bases:
We process personal information for the following purposes:
Data received from Google APIs, including Google Contacts, is used only for the purposes described in Section 5 and is excluded from the analytics, AI-assisted matching, profiling, and marketing purposes listed above.
Automated Processing and Profiling. We use automated processing, including AI-assisted classification and matching, to organize content and to suggest relevant members, companies, requirements, and market signals. This processing draws on information such as your profile, your CRE Focus (Specialisation, Sector focus, Regional focus, and Strategy focus), your requirements, and your activity on the Platform. The CRE Focus and profile classifications shown on your profile are based on the information you provide and select yourself. This processing is used to improve discovery, relevance, and networking. It does not produce legal effects concerning you or similarly significantly affect you, and we do not make decisions that produce such effects based solely on automated processing without human involvement. You may object to processing carried out on the basis of our legitimate interests, correct your information at any time, and control the visibility of your profile through your settings, as described in Sections 2 and 12. Some of this processing, such as content moderation, post classification, translation, and optional writing assistance, is performed by third-party AI providers acting as our processors (currently OpenAI, Google Cloud Vision, and Google Cloud Translation), as listed in our Sub-Processors List. We use these providers only through their business APIs, under terms that do not permit them to use our data to train their models, and we have disabled data sharing for model training where the provider offers that option. We do not use self-hosted or offline AI models.
We do not sell, rent, or trade personal information to third parties. We may share information with trusted service providers who process data on our behalf under contractual data processing agreements. These providers fall into the following categories:
A current list of the specific sub-processors we engage, together with their function and processing location, is available in our Sub-Processors List, which we update from time to time.
Within the Platform. Messages are shared with the participants of the conversation in which they are sent. Conversations held through a business account may also be viewed by that account's authorized administrators, as described in Section 8.3.
We may also disclose personal information where required by law, court order, or regulatory authority, or where necessary to protect the rights, property, or safety of invest.lease, its users, or the public. Data received from Google APIs is disclosed only as permitted in Section 5.
When you choose to authenticate using Google or LinkedIn, we receive only the profile information you have authorized those platforms to share. When you sign in with Google, we request the openid, email (userinfo.email), and profile (userinfo.profile) scopes, which provide your name, email address, and profile image. We do not access your passwords or any data beyond what is necessary for account creation and authentication. Information received through social login is used exclusively for the purpose of verifying your identity, creating and linking your account, and displaying your name and image on your profile, and is handled in accordance with this Policy.
Data we access. Only if you choose "Import from Google Contacts," we request read-only access to your Google Contacts through the Google People API using the contacts.readonly scope. Through this access we retrieve your contacts' names, email addresses, and profile photos. We do not request or retrieve any other contact fields, and we never create, modify, or delete anything in your Google Contacts.
How we use it. We use this data solely to provide the contacts import feature you requested: to display your contacts to you, to show which of them are already members of the Platform, and to send a Platform invitation to the specific contacts you select. We do not send invitations to contacts you have not selected, and we do not contact your imported contacts for any other purpose.
One-time access. The Google access token obtained for the import is used only to complete that single import. It is not stored or reused, and there is no background synchronization with your Google account. A new import requires you to authorize access again.
Storage and protection. Contact entries with a valid email address are stored as contact records linked to your account only, and are not visible to other users. They are protected by the security measures described in Section 10, including encryption in transit and at rest and role-based access controls.
Sharing. We do not sell Google user data, and we do not share or transfer it to third parties, except (a) to service providers that host and operate the Platform on our behalf under data processing agreements and solely to provide this feature, (b) where necessary to comply with applicable law or to protect against fraud, abuse, or security threats, or (c) as part of a merger, acquisition, or sale of assets, with notice to you.
Restrictions on use. We do not use Google user data to serve advertisements, including retargeting, personalized, or interest-based advertising. We do not use it to build user profiles, for analytics, or for AI-assisted matching or recommendations. We do not use, transfer, or sell Google user data, whether raw, aggregated, anonymized, or derived, to create, train, or improve any artificial intelligence or machine learning model, including foundational or generalized models, whether our own or a third party's. Google user data is never sent to any AI or machine learning service, including the AI providers listed in our Sub-Processors List. We do not allow humans to read this data unless you have given us your express consent to do so for specific data, it is necessary for security purposes such as investigating abuse, it is necessary to comply with applicable law, or the data has been aggregated and anonymized for internal operations.
Retention and deletion. Imported contact records are retained until you remove them from your contact list, until the individual registers on the Platform, or until your own account is deleted, whichever occurs first. You can delete imported contacts at any time from your contact list on the Platform, or ask us to delete them by contacting support@invest.lease. If you are not a Platform user but believe your contact information was imported by another user and would like it removed, you may contact us at the same address.
Revoking access. You can revoke invest.lease's access to your Google account at any time from your Google Account permissions page at https://myaccount.google.com/permissions. Revoking access does not delete contact records already imported; you can delete those as described above.
invest.lease's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
We use cookies, pixel tags, local storage, and similar technologies to operate the Platform, remember your choices, understand how the Platform is used, and measure our marketing. Apart from strictly necessary technologies, none of these are activated until you consent to the corresponding category. Data received from Google APIs is never used by or shared with the analytics or advertising technologies described in this section. We categorize them as follows:
When you first visit the Platform we ask you to accept all optional categories, reject them, or choose each one individually. Rejecting is as straightforward as accepting, and no optional technology is loaded before you choose. Your choice is stored in a first-party cookie for approximately six months, after which we ask again. We will also ask again if the purposes described in this section materially change.
You can review or change your choice at any time by selecting Cookie Settings in the Platform menu, or through your browser settings. When you withdraw consent for a category we stop the corresponding activity and delete the related first-party cookies and local storage where technically possible; information already collected while your consent was in effect is handled as described in this Policy. Withdrawing consent for Functional, Analytics, or Advertising will not affect your access to core features.
We retain personal information for as long as your account remains active or as otherwise required to fulfill the purposes described in this Policy. The following general retention periods apply:
Where retention is no longer required or legally justified, we will securely delete or irreversibly anonymize the data.
This section explains how the messages you exchange on the Platform are protected, who can see them, and what happens to them over time. It supplements Sections 1, 4 and 7.
When you use the Platform as a member of a company's business account, the conversations you hold through that business account form part of the company's records:
Messages you have sent remain part of the conversations of the people you sent them to, who continue to rely on them. When your account is deleted, we delete your personal information, and your messages are shown in their conversations as sent by a deleted user, without your name or photo. Conversations in which no other participant remains are deleted. Messages that form part of a business account's records are kept for that company as set out in Section 7.
invest.lease stores and processes your personal data within the European Economic Area. Certain of our sub-processors (Section 4) may process limited personal data outside the European Economic Area, including in the United States. Where such transfers occur, we apply appropriate safeguards — such as Standard Contractual Clauses approved by the European Commission — to ensure an adequate level of data protection consistent with applicable law.
We implement administrative, technical, and physical safeguards designed to protect your personal information, including data received from Google APIs, against unauthorized access, disclosure, alteration, and destruction. These measures include end-to-end and at-rest encryption, encryption in transit (TLS), role-based access controls, continuous monitoring, and periodic security reviews. Notwithstanding these measures, no data transmission or storage system is entirely secure. Users are encouraged to exercise care when sharing sensitive information and to use strong, unique credentials for their accounts.
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, invest.lease will notify the relevant supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of the breach, in accordance with our obligations under GDPR Article 33. Where the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly without undue delay, describing the nature of the breach, the data affected, the likely consequences, and the measures we have taken or propose to take to address it. In the event of a breach, you may contact us at support@invest.lease.
Subject to applicable law, you may have the right to:
Messages. Messages you have sent also form part of the conversations of the people you sent them to. When we act on a request to erase your data or to delete your account, we delete your personal information, but your messages remain visible to the other participants and are shown as sent by a deleted user (see Section 8.4). We cannot provide the content of end-to-end encrypted messages, which we are unable to read. Requests concerning conversations held through a business account should be addressed to the company holding that account, which is responsible for them; we will assist it in responding.
Residents of the European Union and United Kingdom may exercise these rights under the General Data Protection Regulation (GDPR) or UK GDPR. To submit a privacy request, please contact us at support@invest.lease. We will respond within 30 days, or such shorter period as required by applicable law. We may need to verify your identity before processing your request.
You also have the right to lodge a complaint with a data protection supervisory authority. invest.lease's lead supervisory authority is the Commission nationale pour la protection des données (CNPD) in Luxembourg (www.cnpd.public.lu). You may also lodge a complaint with the supervisory authority in your country of residence or place of work.
The Platform is intended exclusively for use by individuals aged 18 and over. We do not knowingly collect or solicit personal information from anyone under the age of 18. If we become aware that we have inadvertently collected data from a person under 18, we will take prompt steps to delete that information. If you believe a person under 18 has provided us with personal information, please contact us immediately at support@invest.lease.
We reserve the right to update this Privacy Policy at any time to reflect changes in our practices, legal requirements, or Platform features. In the event of a material change, we will provide advance notice via a prominent Platform notification or email to the address associated with your account. Your continued use of the Platform following the effective date of any revised Policy constitutes your acceptance of the updated terms. We will not use data received from Google APIs for a new purpose without first notifying you and, where required, obtaining your consent.
If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact our privacy team at support@invest.lease.