Privacy Policy

[LEGAL ENTITY NAME], organisation number [NUMBER], at [ADDRESS], is the controller for personal data described in this policy. This policy covers Enprep's public website, accounts, startup workspaces, discovery, feedback, messages, uploads, and service emails.

• Account data: name, email, password hash, email-verification status, profile image, and Google account identifiers if you choose Google sign-in.
• Profile and preferences: role, headline, biography, location, visibility, onboarding answers, theme, and notification choices.
• Venture content: startup name, plans, research, market tools, survey and interview material, brand information, publication status, and files you upload.
• Community data: feedback, conversations, messages, co-founder or fundraising status, and interactions with ventures.
• Technical and usage data: session identifiers, security logs, IP address, device and browser information, pages and features used, approximate location derived from IP, and error or performance diagnostics.
• Communications: support, legal, privacy, and product correspondence you send us.

• Contract: to create and authenticate accounts, save work, provide uploads, messaging, discovery, and requested service communications.
• Legitimate interests: to secure and troubleshoot Enprep, prevent abuse, understand aggregate service performance, and improve product functionality, balanced against your rights.
• Consent: for Google Analytics and its non-essential cookies where consent is required, optional marketing communications, and where you choose to make profile or venture information public. You may withdraw consent at any time.
• Legal obligation: to comply with law, lawful requests, accounting duties, and the establishment or defence of legal claims.

Your profile visibility and each venture's private, feedback, or public setting determine what other users can see. Messages are visible to conversation participants. Recipients may retain or share information you send them, so avoid sharing secrets or unnecessary personal data. Public information may be indexed or copied outside Enprep even after you later change its visibility.

We use service providers acting on our instructions, including our MySQL database and hosting provider, Amazon Web Services for S3 file storage and SES email delivery in eu-west-1 (Ireland), Google for sign-in and consented Google Analytics, and Sentry for application error and performance monitoring. We may also disclose information to professional advisers, authorities when legally required, or a successor in a merger or sale.

Where data is transferred outside the EEA, we use an applicable adequacy decision or safeguards such as the European Commission's Standard Contractual Clauses, together with supplementary measures where required.

Google Analytics helps us understand aggregate use of pages and features. Where required, it will remain disabled until you consent through our cookie controls. You can withdraw that consent at any time. We will configure available data-minimisation and retention controls and will not send passwords, private venture content, or message bodies as analytics event data.

Sentry helps us detect crashes, errors, and performance problems so we can keep Enprep reliable and secure. Error reports may contain technical request context, device details, account or user identifiers, and the steps immediately preceding a failure. We process this on the basis of our legitimate interests, minimise attached personal data, and configure sensitive fields to be filtered. Session Replay is not covered by this version and must not be enabled without updating this policy and applying appropriate masking and consent controls.

We retain account and venture data while your account is active. After a verified deletion request, we delete or anonymise it within a reasonable period, normally 30 days, unless it must be retained for security, disputes, legal obligations, or backup rotation. Security logs and Sentry diagnostics are normally retained for up to 90 days. Google Analytics event retention will be configured to the shortest period that reasonably supports product analysis and documented in the cookie controls. Verification tokens expire automatically. Messages may remain available to other participants as part of their conversation record unless removal is legally required.

Depending on applicable law, you may request access, correction, deletion, restriction, portability, or object to processing based on legitimate interests. You may withdraw consent without affecting earlier lawful processing and object to direct marketing at any time. We may need to verify your identity before acting on a request.

Contact privacy@enprep.com to exercise a right. You may also complain to the Norwegian Data Protection Authority (Datatilsynet) or the supervisory authority where you live or work. We do not currently use personal data for solely automated decisions that produce legal or similarly significant effects.

We use proportionate technical and organisational safeguards, including access controls, hashed passwords, authenticated upload requests, and encrypted network transport. No online service can guarantee absolute security. Enprep is intended for adults and is not directed to children under 18; contact us if you believe a child has provided personal data.

We may update this policy as Enprep changes. We will post the new effective date and provide additional notice when a change materially affects your rights or how we use personal data. Privacy questions and requests can be sent to privacy@enprep.com.