Privacy Policy

InvestOS respects the privacy of its users and protects the confidentiality of the information submitted through the platform.

This Privacy Policy explains what information InvestOS processes, why, how it is protected, who can access it, and what rights you have. It applies to the InvestOS website and platform at https://investos.ge.

InvestOS is operated in Georgia and is the controller of the personal data processed through the platform. The full legal entity name and registered address will be published here.

Privacy contact: info@investos.ge

InvestOS collects only the information needed to run your account, provide the valuation service, keep the platform secure and answer your requests.

2.1 Account information

When you register, we store:

• your email address;
• your full name;
• your password, stored only as a one-way hash (bcrypt). It is never stored in plain text, and InvestOS staff cannot recover it.

If you register an organization, we also store the organization name, its contact email and, if you upload one, its logo. The logo is used to brand reports generated for that organization.

If you enable two-factor authentication, we store the secret needed to check your authentication codes.

2.2 Verification

There are two separate verification steps:

1. Email confirmation. We send a link to your email address to confirm that it belongs to you.
2. Report unlock. The full investor-report PDF is available only after the InvestOS team manually verifies the request. This step is repeated for each new upload. You can request it through the support chat or at info@investos.ge.

2.3 Security and technical records

To protect accounts, we keep records such as:

• account creation, sign-in, failed sign-in and account-lock events;
• email confirmation, password reset and two-factor authentication events;
• data deletion and report download events (these records do not contain the company name or its figures).

Your IP address is processed to limit the number of requests and to prevent abuse. Our hosting provider may also record it in its technical logs.

To perform a valuation, you upload an Excel file. Depending on the template, it may contain information about:

• the company, its stage and sector;
• founders and team;
• product, market and business model;
• customers and traction;
• financial figures and projections;
• fundraising, capital structure and investment terms;
• risks and exit assumptions.

InvestOS reads the file and stores the extracted values, the validation results, the file name and the calculated valuation results. The original file itself is not kept after it has been read.

We use this information only to provide the valuation, dashboard and reports you request.

Company information may contain personal data about other people, such as founders, shareholders, employees or customers.

If you provide personal data about another person, you are responsible for being allowed to share it with InvestOS. We process it only to provide the service you requested.

We process personal data only where Georgian personal data protection law provides a legal basis.

We do not currently send marketing emails. If we introduce them, we will ask for your consent where the law requires it, and you will be able to withdraw it at any time.

Your uploads, valuation inputs and results are linked to your account and are never made public.

Other users cannot see them. Every request to the platform is checked against the signed-in account.

If you belong to an organization, the organization’s administrator can see the name and email address of its members. The administrator cannot see members’ uploads or valuation results.

The InvestOS administration panel is designed so that administrators cannot see the content of your company data.

Administrators can see:

• account information: email address, full name, role, account status, whether the account is verified, and the registration date;
• organization information: organization name, contact email and white-label status;
• activity information: when you uploaded and calculated, the data completeness percentage, quality and confidence scores, how many valuation methods were calculated or skipped, and how many valuations and report downloads you made;
• security records described in section 2.3;
• support messages you send (see section 9).

Administrators cannot see in the panel:

• company names or uploaded file names;
• financial figures or any other uploaded values;
• valuation results or ranges;
• generated reports.

This describes the administration panel. The information is stored in our database, so it can be technically reached by the people who operate the infrastructure. They access it only when necessary, for example to fix a technical fault, investigate a security incident, or when the law requires it.

If you write to us through the support chat or by email, the InvestOS team reads your message to help you.

Support messages are used only to understand and answer your request, solve technical or account problems, and keep the service secure.

Answering a support request does not give the team access to your company data.

The InvestOS valuation engine is deterministic and rule-based. The same inputs always produce the same results.

Results are calculated from the information you provide, using defined valuation methods and published parameters. The engine does not use generative AI, large language models or machine-learning models.

We do not use your company information to train any AI or machine-learning model, and we do not use it for advertising.

InvestOS does not sell or rent your personal data, company information or valuation results to anyone.

We disclose information only:

• to the service providers listed in section 12, to run the platform;
• when you ask us to;
• when the law requires it.

We use the following providers to run InvestOS:

These providers process data only to deliver their service to InvestOS. They may not use it for their own advertising or commercial purposes.

InvestOS does not use analytics, advertising or tracking services.

Our service providers process data outside Georgia, including the hosting of the platform and its database by Render.

We transfer data only in line with Georgian personal data protection law and with the safeguards it requires. You may ask us at info@investos.ge for information about these transfers, their legal basis and the safeguards used.

We protect your information with the following measures:

• encrypted connections (HTTPS/TLS) between your browser and the platform;
• passwords stored only as one-way hashes (bcrypt);
• optional two-factor authentication;
• temporary account lock after repeated failed sign-in attempts;
• short-lived sign-in tokens that expire automatically;
• a limit on the number of requests from one IP address;
• account-level authorization on every request;
• an administration panel that does not display company data (see section 8);
• security event records (see section 2.3).

No system is completely secure. We review and update these measures as the platform develops.

We keep personal data only as long as needed for the purpose it was collected for, or as long as the law requires.

Deleted data may remain in our hosting provider’s backups for a limited time until those backups are replaced.

You can delete your company data yourself with Clear all my data on the Danger zone page. It permanently removes all your uploads and all valuation results calculated from them. This cannot be undone.

This function does not delete your account, your organization, your support messages or security records.

To delete your account completely, use Delete my account on the Danger zone page (the red link at the top of the platform). You confirm with your password. This permanently deletes your account, your uploads and valuation results, your support messages and, if you are its only member, your organization and its logo. Security records are kept, but without your name, email or any link to your account.

If the account cannot be deleted there (for example, an organization that still has other members), write to info@investos.ge from the email address of the account and we will delete it for you, except records we must keep by law.

Under Georgian personal data protection law, and subject to its exceptions, you have the right to:

• know whether we process your personal data, why, on what legal basis, for how long and who receives it;
• get a copy of your personal data;
• have inaccurate or incomplete data corrected;
• have your data deleted or destroyed;
• have processing stopped or restricted;
• withdraw consent, where processing is based on consent;
• receive information about transfers outside Georgia and their safeguards;
• receive information about automated decisions, where they apply;
• file a complaint with the Personal Data Protection Service of Georgia.

Write to info@investos.ge. Please send the request from the email address registered to your account, so we can confirm it is you. If needed, we may ask for additional confirmation.

The platform does not currently let you change your name or email address yourself. Send us a request and we will correct them.

We will answer within the time limits set by Georgian law.

The valuation is calculated automatically by fixed rules from the information you provide. It is an indicative estimate for your own use, shown as a range.

InvestOS does not use it to make decisions about you that have legal or similarly significant effects, and does not build profiles of users.

The valuation needs only the information requested in the template. Please do not submit:

• passwords, API keys, private keys or other access credentials;
• access details for bank, accounting or other systems;
• source code or technical documentation unrelated to the valuation;
• personal data about customers, employees or other people that the valuation does not need.

Extra sensitive information increases risk and does not improve the valuation.

InvestOS is a business service for adults. It is not intended for children, and we do not knowingly collect children’s personal data.

If a personal data incident occurs, we will assess it and take the measures required by law. Where Georgian law requires it, we will notify the Personal Data Protection Service within 72 hours of identifying the incident, and inform the affected people.

InvestOS does not use cookies, and does not use analytics, advertising or tracking technologies.

To keep you signed in, your browser stores sign-in tokens in its local storage. They are needed for the platform to work, expire automatically and are removed when you log out.

If we ever introduce non-essential technologies, we will update this policy and ask for consent where the law requires it.

InvestOS does not currently send marketing emails, and never sells or shares your email address for advertising.

If we introduce marketing emails, we will send them only with your consent where the law requires it, and every email will include a way to unsubscribe.

We may update this policy when our service, technology or legal requirements change. The date at the top shows the latest update. If we make significant changes, we will inform you through the platform or by email.

For any question about privacy or this policy:

• Email: info@investos.ge
• WhatsApp: +995 551 30 66 00