Privacy Policy — Comatch

1. Scope and Applicability

This Policy applies to individuals who use Comatch worldwide, including users in:

• The European Union and European Economic Area (EU/EEA)
• The United Kingdom (UK)
• The United States (all states)
• Hong Kong (SAR)
• Other international jurisdictions where Comatch is available

We aim to handle personal data in a manner consistent with applicable data protection laws, including:

• GDPR — EU/EEA General Data Protection Regulation
• UK GDPR and the Data Protection Act 2018 — United Kingdom
• CCPA / CPRA and other U.S. state comprehensive privacy laws (e.g., Virginia, Colorado, Connecticut, Texas, and others in effect)
• PDPO — Hong Kong Personal Data (Privacy) Ordinance
• Other applicable laws such as the LGPD (Brazil), PIPEDA and Quebec's Law 25 (Canada), the FADP (Switzerland), and the Privacy Act (Australia)

Where we use artificial intelligence to interact with you or to support matching, we also comply with applicable AI transparency requirements, including the EU AI Act.

2. What Information We Collect

a. Information You Provide

• Profile Data: Name, email, phone number, city/country, LinkedIn / GitHub / portfolio links, industry interests, and skillsets
• Startup Preferences: Co-founder preferences, startup stage, industry, and goals
• User-Generated Content: Messages, bios, pitches, founder agreements, and feedback
• Account and Verification Data: Login credentials and information you provide to verify your identity or eligibility

b. Information We Collect Automatically

• Device Information: IP address, browser type, operating system, and device identifiers
• Usage Data: Pages visited, features used, and actions taken on the Platform
• Location Data: Approximate location (where permitted by your device settings)
• Cookies and Similar Technologies: See Section 4

c. Information from Third-Party Integrations

If you sign up or connect via LinkedIn, GitHub, Google, WeChat, or similar services, we receive basic account and public profile information as permitted by that service and your settings.

d. Sensitive Personal Information

Comatch does not require sensitive personal information (such as racial or ethnic origin, religious beliefs, health data, sexual orientation, or precise geolocation) to provide its services. We ask that you do not include such information in your profile or messages. If you choose to share it, you consent to our processing it for the purpose for which you provided it, and you may withdraw that consent at any time.

3. How We Use Your Information

We use your personal data to:

• Match you with compatible co-founders and collaborators
• Provide AI-based recommendations and improve match quality
• Operate, maintain, personalize, and improve the Platform
• Communicate platform updates, features, security notices, and (where permitted) partnership offers
• Monitor Platform safety and detect, prevent, or investigate fraud, abuse, or misuse
• Comply with legal obligations and enforce our terms

We do not use your personal data to train third-party generative AI models, and we do not sell your data (see Sections 5 and 7).

4. Cookies and Tracking Technologies

We use cookies and similar technologies to keep you logged in, remember preferences, measure performance, and understand how the Platform is used.

• Essential cookies are required for the Platform to function.
• Analytics and functional cookies are used only with your consent where required by law.

You can manage cookies through your browser settings and, where applicable, through our in-product cookie banner or preference center. We honor recognized universal opt-out signals, including the Global Privacy Control (GPC), as a valid opt-out of the sale/sharing of personal information and of targeted advertising in jurisdictions that require it.

5. Artificial Intelligence, Automated Decision-Making, and Profiling

Comatch uses algorithmic and AI-based systems to suggest potential co-founder matches and to personalize your experience. We want to be transparent about this:

• You are informed when you are interacting with automated systems or AI-generated recommendations.
• Our matching suggestions are decision-support tools, not final or binding decisions. You decide whom to contact, connect, or partner with.
• We do not use solely automated processing to make decisions that produce legal or similarly significant effects about you without a lawful basis and appropriate safeguards.
• Where automated processing or profiling is used, you have the right to request meaningful information about the logic involved, to object to or opt out of such profiling, and to request human review where applicable under your local law.

To exercise these rights, contact us at contact@comatch.ai.

6. Legal Bases for Processing (EU/EEA, UK, and similar regimes)

Where the GDPR, UK GDPR, or comparable laws apply, we rely on one or more of the following legal bases:

• Consent — e.g., for non-essential cookies or optional communications
• Performance of a contract — to provide the matching services you request
• Legitimate interests — e.g., to keep the Platform secure, prevent fraud, and improve our services, balanced against your rights
• Legal obligation — to comply with applicable laws

You may withdraw consent at any time without affecting processing carried out before withdrawal.

7. How We Share Information

We do not sell your personal data, and we do not "share" it for cross-context behavioral advertising as those terms are defined under U.S. state privacy laws.

We may disclose your data to:

• Service providers / processors acting on our behalf under contract (e.g., cloud hosting, AI infrastructure, analytics, customer support), who may only use it to provide services to us
• Other users, limited to the profile and content you choose to make visible for matching purposes
• Third-party integrations you connect, subject to their terms
• Law enforcement or regulators, only when legally required or to protect rights, safety, and security
• Partners (e.g., accelerators, incubators) only with your explicit consent
• Successors in the event of a merger, acquisition, financing, or sale of assets, subject to this Policy

8. International Data Transfers

Comatch may store and process data in jurisdictions other than where you live. Where we transfer personal data internationally, we use appropriate safeguards, such as:

• EU Standard Contractual Clauses (SCCs) and the UK International Data Transfer Addendum / IDTA
• Transfers to jurisdictions recognized as providing an adequate level of protection
• Data minimization and additional technical and organizational measures where needed

You may request more information about these safeguards at contact@comatch.ai.

9. Data Retention

We retain personal data only as long as necessary to fulfill the purposes described in this Policy or to comply with legal, accounting, or reporting requirements. Inactive accounts may be anonymized or deleted after 24 months. When data is no longer needed, we delete or anonymize it.

10. Your Privacy Rights

Your rights depend on where you live. We will not discriminate against you for exercising any of them.

Users in the EU/EEA, UK, and similar regimes (GDPR / UK GDPR)

You have the right to: access, rectify, erase, restrict, and object to processing; data portability; withdraw consent; not be subject to certain automated decision-making; and lodge a complaint with your local supervisory authority.

Users in California, USA (CCPA / CPRA)

You have the right to: know and access the personal information we collect; correct inaccurate information; delete personal information; opt out of the sale or sharing of personal information; limit the use and disclosure of sensitive personal information; and non-discrimination for exercising these rights.

Users in other U.S. states (e.g., Virginia, Colorado, Connecticut, Texas, and others)

You have the right to: confirm whether we process your data and access it; correct inaccuracies; delete your data; obtain a portable copy; and opt out of the sale of personal data, targeted advertising, and certain profiling. You also have the right to appeal a denied request; if we deny your appeal, you may contact your state attorney general.

Other jurisdictions

If you are in another jurisdiction (e.g., Brazil, Canada, Switzerland, Australia, Hong Kong), you may have similar rights under your local law, and we will honor them as applicable.

How to Exercise Your Rights

Email contact@comatch.ai with your request. We may need to verify your identity before responding. You may use an authorized agent where the law permits. We respond within the timeframes required by applicable law.

11. Security Measures

We implement industry-standard technical and organizational safeguards, including:

• Encryption of sensitive data in transit and at rest
• Access controls and audit logging
• Regular penetration testing and security reviews
• Data access limited to authorized personnel on a need-to-know basis

No system is perfectly secure, but we work to protect your data and to notify you and relevant authorities of any breach affecting your personal data as required by applicable law.

12. Children's Privacy

Comatch is not intended for individuals under 18. We do not knowingly collect personal data from minors. If we learn that we have collected data from someone under 18, we will delete it.

13. Changes to This Policy

We may update this Policy as laws or our services evolve. When we make significant changes, we will notify users via the app or email and update the "Last Updated" date above.

14. Contact Us

If you have questions or requests regarding this Privacy Policy, reach us at:

• Email: contact@comatch.ai
• Data Controller: Comatch AI