Privacy notice.
What we collect when you use sxhx.io, why, who helps us process it, and how to reach us about it. Last updated 14 October 2026.
Who we are
sxhx.io is run by [Company legal name] Ltd, a company registered in England and Wales (company number [number]), registered office [address]. We are the controller of the personal data described here. ICO registration number: [ZA…].
For anything about your data, email privacy@sxhx.io.
What we collect and why
| When you | What we collect | Why, and our lawful basis |
|---|---|---|
| Visit any page | Your IP address, browser and the pages you request, in our hosting provider's logs. Your rough country, from your IP address, if you download the ledger. | To run and secure the site. Legitimate interests. We use no tracking or advertising cookies. |
| Read our pages | Anonymous visit counts from Vercel Web Analytics: which pages are viewed, the site you came from, and your rough country, device and browser. It sets no cookies and does not identify you. | To see which pages are useful and how people find us. Legitimate interests. |
| Sign in | Your email address and a user ID from our sign-in provider, Privy. Your sign-in session in your browser. | To give you an account that works across our tools and to apply fair-use limits. Contract: you asked to use the tools. |
| Download the ledger CSV | Your email, and your name and organisation if you give them. The filters you had on, the time, and your country. | To understand who relies on the ledger and to tell you about major changes to it. Legitimate interests. You can ask us to stop contacting you at any time. |
| Match a pitch deck | The deck you upload, the text we extract from it, the company profile we draw from it and the investor matches we return. | To give you the matches you asked for. Contract. |
| Build a hypothesis tree (HypoTree) | The website and changelog addresses you enter and the text of those pages, the investor updates and other files you upload, their text, and the tree we generate. | To build and show you the tree you asked for. Contract. |
| Email us | Your message and contact details. | To reply. Legitimate interests. |
Decks and investor updates can contain personal data about other people, such as founders, employees or investors. Upload only what you have the right to share. See our terms.
Use of AI
Deck matching and HypoTree send the text of your deck or files, and for decks with little readable text the file itself, to OpenAI to be analysed. OpenAI processes it for us under its API terms. At the time of writing, those terms say OpenAI does not use API data to train its models and may keep it for up to 30 days to detect abuse. The results are generated by a model, can be wrong, and are not advice. We make no decisions about you that have legal or similarly significant effects by automated means.
Who processes it for us
We share personal data only with the providers below, who process it on our instructions, and with authorities where the law requires it. We don't sell it.
| Provider | What they do | Where |
|---|---|---|
| Vercel | Hosts the site and our server code. Stores uploaded pitch decks. Counts page visits without cookies (Web Analytics). | United States and United Kingdom |
| Supabase | Database for accounts, sign-ups, match results and trees. Stores HypoTree uploads. | United Kingdom (London) |
| Privy | Email sign-in. | United States |
| OpenAI | Analyses decks and investor updates. | United States |
| Jina AI | Fetches the web pages you ask HypoTree to read. It receives the page address, not your files. | See provider |
| Google Fonts, Cloudflare (cdnjs), esm.sh | Serve the typeface and the code for sign-in and deck previews. They see your IP address when your browser loads them. | Global networks |
| Namecheap Private Email | Our email. | See provider |
International transfers
Some providers process data outside the UK, mainly in the United States. Where they do, we rely on the UK–US data bridge for providers certified under it, or on the UK International Data Transfer Agreement or Addendum, so your data has protection equivalent to UK law.
How long we keep it
- Ledger sign-ups: 24 months after your last download.
- Pitch decks: 90 days after upload. Match results: 12 months.
- HypoTree files and trees: while your account is active, then 12 months.
- Account details: until you ask us to delete your account, or after 24 months without sign-in.
- Hosting logs: as set by our hosting provider, typically a few days.
You can ask us to delete any of it sooner.
Cookies and browser storage
We use only what the tools need to work, so we don't ask for consent:
- Privy keeps your sign-in session in your browser's local storage on sxhx.io.
- HypoTree (hypotree.sxhx.io) sets one cookie,
ht_session, to keep you signed in for up to 30 days. - We store your account's email and whether you have already downloaded the ledger in local storage, so we don't ask again.
Your rights
Under UK data protection law you can ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, and to give it to you in a portable form. Email privacy@sxhx.io. We'll reply within one month.
If you're unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint. We'd appreciate the chance to fix it first.
Children
Our tools are for professionals and not intended for anyone under 18.
Changes
We'll update this notice when what we do changes, and change the date at the top.