Privacy

Who we are

newlyraised is run by Helios One Oy, a limited company in Espoo, Finland (business ID 3596623-5). Helios One Oy decides how the personal data described here is used (it is the "controller"). Write to us at hello@newlyraised.com, or by mail to our US address: Helios One Oy, 3075 Clay St, San Francisco, CA 94115. Source: Finnish Trade Register (YTJ), Helios One Oy (opens in a new tab)

What we collect

• When you visit the site: the pages you open, clicks, scrolling, what you type into most fields (session replay, see below), your browser and device, your IP address and the rough location it gives, and the campaign or website that sent you. Cookies are listed below.
• When you give us your email on the site: the email, the metro you were looking at, and the page. For a booking also your name, firm, note, time zone and the slot you picked. For a wrong-record report, your note.
• When you use the app: your work email, firm name, metros, the emails of teammates you invite, when you sign in, what you export, and feedback or screenshots you send us.
• Emails we send you, and whether each one was delivered, opened or clicked.
• If you pay: your Stripe customer and subscription ids and status. You type your card on Stripe's own checkout page, so your card number goes to Stripe, not to us. Source: Stripe docs, How Checkout works (opens in a new tab)

Session replay

We record sessions on the site and in the app with PostHog: what you see, click and type. Sign-in code fields, card fields, password fields and anything we mark as private are masked in your browser before anything is sent. Other fields, such as an email or ZIP you type, are recorded. Recordings are deleted after 30 days. Details: Security. Source: PostHog docs, session replay privacy controls (opens in a new tab)

People named in public records

The lists come from public government records. A Form D names a company's executive officers and directors, and we print those names and roles as filed. Some SBA records name a person as the borrower, for example a sole proprietor. We hold those out, so the SBA items in the lists name only businesses. We do this because firms use the lists to find companies that just filed a Form D or had a loan approved (our legitimate interest), and the records are published for reuse. See public records and compliance. Sources: SEC privacy page, Website Dissemination (opens in a new tab); data.sba.gov, 7(a) & 504 FOIA (opens in a new tab)

How many SBA loans we held out this quarter for naming a person: What we leave out.

If you are named in a record and object to how we show it, write to hello@newlyraised.com. We'll review it and answer within 30 days.

Why we use it

• To run what you signed up for: your lists, the weekly email, exports, your team and billing (our contract with you).
• To send the file or the email you asked for on the site (your request). Every list email has a one-click unsubscribe.
• To see how the site and the app are used and fix what confuses people, including session replay (our legitimate interest).
• To keep the service safe and tell people from bots (our legitimate interest).
• So a person can follow up: we get an email alert when you start a trial, book a call or report a record (our legitimate interest).
• To keep accounting records of payments (a legal obligation).

Who processes it, and where

These services store or process data for us, under their data processing terms:

• Convex

  Our database and backend: accounts, metros, team, exports, form entries, the email log and server events.

  Where: United States: AWS US East (N. Virginia), region aws-us-east-1. Source: Convex docs, Regions (opens in a new tab)

• Fly.io

  Runs the servers for this site and the app.

  Where: United States: Ashburn, Virginia (region iad). Source: Fly.io docs, Regions (opens in a new tab)

• PostHog Cloud EU

  Usage analytics and session recordings for the site and the app.

  Where: European Union: Frankfurt, Germany. Source: PostHog docs, Data storage (opens in a new tab)

• Resend

  Sends our email: sign-in codes, the weekly list, trial notices.

  Where: United States. Source: Resend, Security (opens in a new tab)

• Stripe

  Will take payments when paid plans open. You will type your card on Stripe's own checkout page, so your card number goes to Stripe, not to us.

  Where: Stripe's own systems, certified PCI Service Provider Level 1. Sources: Stripe docs, Security (opens in a new tab); Stripe docs, How Checkout works (opens in a new tab)

• We don't sell or rent personal data, and we don't share it with advertisers or data brokers.
• We disclose data to authorities only when the law requires it.
• Most data is stored in the United States, and analytics in the EU. Data that moves from the EU to the US moves under each provider's data processing terms. Resend, for example, says its transfers are covered by the EU Standard Contractual Clauses and the EU-U.S. Data Privacy Framework. Source: Resend, Security (transfers) (opens in a new tab)

How long we keep it

Your choices and rights

• Unsubscribe from any list email with the link at the bottom of it.
• Ask for a copy of your data, a correction, deletion, or that we stop using it, at hello@newlyraised.com. We answer within 30 days.
• Block or delete cookies in your browser. The site still works; we just can't connect your visits.
• If you are in the EU or the UK, you can also complain to a data protection authority. Ours is the Office of the Data Protection Ombudsman, P.O. Box 800, 00531 Helsinki, Finland (tietosuoja.fi). Source: European Data Protection Board, members (opens in a new tab)

Cookies and browser storage

Cookies the site sets:

What the site keeps in your browser's local storage. Unlike a cookie, your browser doesn't send it to us with each request:

Children and changes

newlyraised is for businesses. We don't knowingly collect data from anyone under 16.

When this page changes, the date at the top changes. If a change matters for account holders, we email them before it applies.