Privacy Policy

What we hold depends on the role you play in a raise.

Everyone with an account

• Your name, email address, phone number and job title, and a profile photo if you add one.
• The organisation you belong to (an advisory firm or a company), and your role in it.
• Sign-in details: a password we store only as a salted hash, or a sign-in link sent to your email, and any multi-factor authentication you enrol in.

Investors

• The details a share register must carry: your legal name or entity name, entity type, address, and the names of trustees, directors or other signatories where you invest through an entity.
• Investor qualification evidence, typically an accountant’s certificate under section 708 of the Corporations Act, including the certificate file itself, its date and who verified it.
• Commitments, subscription amounts, signatures and executed agreements, and payment status.
• Questions you ask a company through the platform, and the answers.
• The companies you follow from their public page. Following shares your name and email with that company, and the page says so before you follow; every email it sends has a link to stop.

Companies and advisers

• Company details including ABN or ACN, officers, share classes and the register itself.
• Adviser licensing details (an AFSL or authorised representative number) where an adviser runs a raise.
• Documents you upload to a dataroom or a company vault, and the notes and terms you write.
• The bank account a company gives investors to pay into, which is shown to its investors in their payment instructions.
• Billing details for a company’s plan: the billing contact, the plan and its invoices. Card details are entered on Stripe’s own page and held by Stripe; we never see or store a card number.

Collected automatically

• An audit trail of activity in a raise: which document was opened, by whom, when, from which IP address and browser. This is a feature of the product, and every party to a raise is told it exists.
• Who has opened a company’s profile, when, and how often. The company and the adviser running its raise can see this; the profile says so at the top of the page.
• Server logs and error reports, which may include your IP address, the page you were on and, once you are signed in, which account you are.
• Cookies needed to keep you signed in and remember your theme. We do not use advertising cookies.

We do not ask for tax file numbers, passport scans or bank credentials.

Most of it comes from you, when you create an account, complete a profile or upload a document.

Some of it comes from another party to your raise. A company or adviser that invites you enters your name and email, and may record details about you, such as an offer date or a certificate they have sighted. Where you are added to a register by a company importing its past rounds, your holding is recorded by the company.

Some of it comes from service providers acting for us: our e-signature provider tells us when a document was signed, and our email provider tells us whether a message was delivered.

If we receive personal information about you that we did not ask for and could not have collected ourselves, we destroy or de-identify it.

• To run the raise you are part of: invitations, dataroom access, questions and answers, signing and settlement.
• To keep the share register and the records the Corporations Act requires a company to keep.
• To record investor qualification, so a company can rely on an exemption from disclosure and show later that it was entitled to.
• To send the notices a raise involves: invitations, reminders, signing requests and completion notices.
• To keep the platform secure, detect misuse and keep the audit trail every party relies on.
• To answer your questions and improve the product.
• To comply with the law, and to respond to lawful requests from regulators or courts.

We do not sell personal information, and we do not use it for advertising.

Parts of the product use AI models: answering questions from the documents in a dataroom or vault, drafting answers for a company to review, rehearsing an investor’s diligence questions against a company’s own documents, classifying documents, reading cap tables and option grant letters, and the in-app assistant that answers from a raise’s live figures and Struck’s own guides. To produce an answer, the question asked and the text of the relevant documents or figures (or, for a scanned letter, its image) are sent to the model. The answer is labelled as assembled from documents, not as a statement by the company and not as advice, and each AI surface says so where you type.

The models are Claude, developed by Anthropic, run for us by Amazon Web Services on its Bedrock service in AWS’s Australian regions (Sydney and Melbourne). What is sent is processed and stored in those regions. Under our agreement with AWS it is used only to produce the response: AWS does not store the request or the response afterwards, does not share them with Anthropic, and does not use them to train any model. The search index that finds the right passages is built in Australia the same way, by an Amazon model on the same service or by a model inside our own database. Where AI search is on for a raise, what is said in its dataroom’s videos is transcribed by Amazon Transcribe in Sydney so answers can quote it: the copy sent for that is deleted as soon as the words are read, within a day at most, and AWS is not permitted to keep it or use it to improve its services.

The one exception we allow for is low-sensitivity drafting, such as a company’s announcement to its investors, which may be sent to Anthropic’s own service in the United States under Anthropic’s data processing agreement, on the same terms: not retained after the response, and not used for training. Nothing from a dataroom, a vault, a register or an investor’s qualification evidence is sent that way. A company can turn AI features off for a raise or a vault, and can exclude individual documents.

The other parties to your raise

A raise is a shared workspace, and what you put into it is visible to the parties it is meant for. The company and its advisers see the investors in their raise, their commitments and their qualification status. An investor sees the documents they have been granted, their own agreements and their own holding. Other investors do not see your details.

Service providers

We use a small number of providers to run the product. Each one processes data only to provide its service to us.

• Supabase: database, file storage and authentication, hosted in Sydney, Australia.
• Vercel: application hosting. Our server functions run in Sydney; static assets are served from a global network.
• Resend: transactional email.
• Stripe: subscription billing for companies on a plan. Stripe holds the card or invoice details and the billing contact, and processes them in the United States and elsewhere.
• Google (Firebase Cloud Messaging), and Apple for iPhones: delivery of push notifications to the Struck mobile app, where you have allowed them. A notification’s title and text pass through these services, which run in the United States.
• BoldSign: electronic signatures, where a raise uses them.
• Australian Business Register: when you search for a company, the name or number you search for is sent to the government register to look it up.
• Amazon Web Services (Bedrock and Transcribe): runs the AI models described above, and transcribes dataroom videos, in AWS’s Australian regions.
• Anthropic: develops the Claude models. Through Bedrock it does not receive your requests; its own service, in the United States, is used only for the low-sensitivity drafting described above.
• Fly.io: the cloud-import service that transfers files you choose from Google Drive or Dropbox into a dataroom, hosted in Sydney.
• Google: only if you choose to import files from Google Drive, and only the files you pick.
• Dropbox: only if you choose to import files from Dropbox. The connection can read your Dropbox until you disconnect it from the import dialog, and only the files you pick are copied.
• Sentry: error reporting, so we learn about failures without waiting to be told.
• PostHog: product analytics (which screens are used and how often), hosted in the United States. It records pages, not their contents: nothing you type and no document you view. It may also record how a screen is used (where you click and scroll, and the layout of the page) with every piece of text and every field masked in your browser before it is sent, and never the document viewer. Once you sign in, your visits are tied to your account, name and email so we can see where a journey through the product stalls.

Overseas

Your records are stored in Australia: the database, documents and share register sit in Sydney, and AI requests over dataroom, vault and register content stay in Australia. Some providers process data overseas, mainly in the United States, when a feature is used: e-signing, email delivery, billing and payments, push notifications, error reports, usage analytics and the masked screen recordings described above may leave Australia in transit or be processed there, and low-sensitivity AI drafting may be sent to Anthropic in the United States as described under AI features. We choose providers with contractual and security commitments equivalent to the Australian Privacy Principles, and we do not send the register or a dataroom overseas as a whole.

Law

We disclose personal information where the law requires it, such as to a regulator or under a court order.

• Encryption in transit and at rest.
• Row-level security in the database: every query runs as the person making it, and can only reach the rows their role allows.
• Documents are held in private storage and served through short-lived links. The secure viewer shows a view-only reader rendered pages, not the file.
• A hash-chained audit trail of document activity and register changes, checked nightly, so a record that has been altered can be detected.
• Executed agreements are stored with a cryptographic digest taken when they were signed.
• Multi-factor authentication is available to every account.

No system is perfectly secure. If we become aware of a data breach likely to cause serious harm, we will notify the people affected and the Office of the Australian Information Commissioner as the law requires.

• Share register records, executed agreements and the audit trail: for as long as the company must keep them, which is at least seven years under the Corporations Act.
• Investor qualification evidence: for as long as an offer relies on it and for seven years after, so the reliance can be shown.
• Dataroom and vault documents: until the company that owns them deletes them, or closes its account.
• Account details: until you ask us to delete your account, subject to the records above.
• Server logs and error reports: 90 days.

You can see and change your own details in Settings at any time. To ask for a copy of everything we hold about you, or for your account to be deleted, use the Your data section of Settings or email privacy@struckhq.com. We respond within 30 days.

Some records cannot be deleted at your request while a company is obliged to keep them: your entry in a share register, an agreement you executed, and the audit trail around them. When that applies we will tell you what was removed and what was kept, and why.

Where a company or adviser has entered details about you that are wrong, we will help you have them corrected, and where we cannot correct a record we will attach your statement to it.

We use cookies that are necessary to run the product: your session, your theme choice, your choice of workspace view and, if you followed an offer link, the offer you came with. We do not use advertising or cross-site tracking cookies. Blocking cookies in your browser will stop you signing in.

If you think we have mishandled your personal information, write to privacy@struckhq.com. We will acknowledge your complaint within seven days and answer it within 30. If you are not satisfied with our answer you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

We update this policy when the product changes. The date at the top is the date of the current version. A material change is notified to account holders by email before it takes effect.

See also the Terms of Service.