Privacy Policy
1. Data Controller
Carpath Labs (hereinafter "we," "us," or "the Company") is the data controller responsible for processing your personal data.
Cluj-Napoca, Romania
2. What Data We Collect
From the Pitch-Deck Submission Form
When you submit a pitch deck, we collect:
Technical Data
We automatically collect the following technical information:
- IP address — used for rate-limiting, abuse prevention, and security purposes via Cloudflare Turnstile.
- Session cookies — first-party cookies to maintain your session on the website.
- CSRF token — a security cookie to prevent cross-site request forgery attacks.
- Submission timestamp — the date and time of your submission.
Note: We do not use analytics trackers (Google Analytics, Mixpanel, etc.) or marketing cookies on this website.
3. Purpose and Legal Basis for Processing
Pitch Submission Processing
Purpose: To receive, evaluate, and discuss pitch decks from founders for potential engagement with the Carpath Labs network.
As part of evaluation, a submitted deck may be processed by an AI sub-processor (currently Anthropic) to generate an internal, informational screening summary. This is a decision-support tool only — it does not make decisions about you, and every submission is reviewed by a human (see Automated Decision-Making, Article 22, below). Our current sub-processors are listed below and may change; we update this policy when they do.
Legal Basis: Your explicit consent via submission (a required consent checkbox on the form), and our legitimate interest in operating the Carpath Labs network and evaluating new potential connections.
Rate-Limiting and Security
Purpose: To prevent spam, fraud, and abuse; to maintain the security and integrity of the website.
Legal Basis: Our legitimate interest in protecting our systems and users from malicious activity.
Session Management
Purpose: To maintain your session and provide a functional website experience.
Legal Basis: Necessary for the proper functioning of the service.
Lawful Basis Summary
Under GDPR Article 6, the lawful bases we rely on are: newsletter subscription — consent (Art. 6(1)(a)), withdrawable at any time via the unsubscribe link in any email; pitch handling, security, and rate-limiting — legitimate interest (Art. 6(1)(f)). We do not process special-category data under GDPR Article 9.
4. Data Processors and Sharing
Cloudflare Turnstile
We use Cloudflare Turnstile for anti-abuse and anti-bot verification on our pitch submission form. Cloudflare processes your IP address and browser data to verify that you are not a bot. Cloudflare is a Data Processor on our behalf. For details on Cloudflare's data handling, please review Cloudflare's Privacy Policy.
Turnstile runs in invisible mode on this site (no interaction or challenge is shown to you). As required by Cloudflare for invisible mode, we reference the Cloudflare Turnstile Privacy Addendum, which describes the data Cloudflare collects and processes through Turnstile: https://www.cloudflare.com/application-services/terms/turnstile-privacy-addendum/
Internal Carpath Labs Members
Your pitch deck, contact information, and submission details are forwarded to a private Telegram group of authorized Carpath Labs members for review and discussion. These members are bound by confidentiality obligations. By submitting your pitch, you consent to this internal sharing.
Important: Telegram is a third-party messaging platform. While we use it for secure internal communication, Telegram has its own privacy practices and data retention policies. We recommend reviewing Telegram's Privacy Policy if you have concerns about your data's storage on their platform.
Hosting and Infrastructure
Your submission data is stored on our hosting infrastructure. We use industry-standard security practices to protect your data.
Anthropic & Resend
Anthropic (US) processes text on our behalf for AI-powered analysis in two contexts: (1) article and source text for the Carpath Signal newsletter pipeline, and (2) submitted pitch decks, to generate an internal screening summary for our review. Anthropic acts as a data processor; per their API terms, submitted data is not used to train their models.
Resend (US) is our transactional email processor, used to deliver newsletter emails to subscribers. Both Anthropic and Resend are sub-processors engaged under Data Processing Agreements.
No Other Third Parties
We do not sell, rent, or share your data with marketers, analytics providers, or unrelated third parties. Sharing is limited to the processors and internal members listed above.
5. Data Retention
We retain your submitted data for as long as necessary to fulfill the purposes outlined in this policy.
After the retention period, we will securely delete or anonymize your personal data unless we are required by law to retain it.
6. Your Rights Under GDPR
Right of Access (Article 15)
You have the right to request a copy of the personal data we hold about you, including the format and sources of that data.
Right to Rectification (Article 16)
You may request that we correct or update any inaccurate or incomplete personal data.
Right to Erasure (Article 17)
You have the right to request deletion of your personal data under certain circumstances (e.g., if the data is no longer necessary, or if you withdraw consent).
Right to Restrict Processing (Article 18)
You may request that we limit how we use your data while we address a dispute or verify accuracy.
Right to Data Portability (Article 20)
You may request your data in a portable, machine-readable format so that you can transfer it to another controller.
Right to Object (Article 21)
You may object to the processing of your data for legitimate interest purposes.
Rights Related to Automated Decision-Making (Article 22)
You have rights regarding decisions made solely by automated means. Carpath Labs does not use fully automated decision-making without human review.
How to Exercise Your Rights
To exercise any of these rights, please contact us using the details provided in the "Contact Us" section below. We will respond within 30 calendar days in accordance with GDPR Article 12.
7. International Data Transfers
Your data is primarily processed and stored within Romania (EU). Data is transferred to Anthropic (US) for AI content analysis — both the Carpath Signal newsletter pipeline and pitch-deck screening — and to Resend (US) for email delivery. These transfers are made in accordance with GDPR Chapter 5, relying on Standard Contractual Clauses (SCCs) as the appropriate safeguard.
9. Data Security
We employ industry-standard security measures to protect your personal data, including:
- HTTPS encryption for all data in transit.
- Access controls and authentication for our systems.
- Regular security audits and monitoring.
- Secure storage of uploaded files.
However, no security measure is 100% effective. While we strive to protect your data, we cannot guarantee absolute security against all threats.
10. Children's Privacy
Carpath Labs is not directed at or intended for individuals under 16 years of age. We do not knowingly collect personal data from minors. If we become aware that a minor has submitted data, we will take steps to delete it promptly. Please contact us if you believe a child's data has been collected.
11. Changes to This Privacy Policy
We may update this Privacy Policy to reflect changes in our practices, technology, legal requirements, or other factors. We will post the updated policy on this page and update the "Last updated" date. For material changes, we may provide additional notice.
Your continued use of Carpath Labs following changes constitutes acceptance of the updated policy.
12. Contact Us
If you have questions about this Privacy Policy, wish to exercise your GDPR rights, or need to report a data protection concern, please contact us at:
Response time: We aim to respond to all requests within 30 calendar days in accordance with GDPR requirements.