How Lunra handles investor information

Lunra decides what goes into the directory, from which sources, and for what purpose, so for the directory itself Lunra is responsible for your information. Contact us at privacy@lunra.io.

Separately, our customers (advisers and founders) use the directory to run their own outreach. They decide who to contact and what to say, and they are responsible for that. If you received an email, it came from them, not from us, and its footer names them.

Business and professional information: your name, job title, the firm you work for, a work email address, your LinkedIn URL, your public X handle where we have one, and attributes describing your investing focus such as sectors, stage, geography, and typical cheque size. Where a public filing records an investment, we hold that too.

We do not seek out or store special category data, financial account details, or anything about your private life.

We do not buy consumer data and we do not collect anything from you directly. Sources are:

• SEC Form D filings from the EDGAR public database. This is the single largest source, and covers a substantial share of the people we hold.
• Public professional profiles and firm websites, found by web search.
• Business contact data providers, currently Hunter, People Data Labs, and Instantly, who supply or verify work email addresses and professional details.
• Public posts on X, for a small number of people, used to tell a customer when someone has recently been active on a relevant topic.
• Public business directories.
• Our customers, when they add someone they already know.

We record which source each field came from, so if you ask, we can tell you where a specific detail about you originated rather than answering in generalities.

The purpose is to help a company raising money find investors who plausibly invest in companies like theirs, and to help them make contact. We rely on legitimate interests: ours and our customers’ in reaching relevant investors efficiently, and the general interest in capital reaching companies that need it. The information is professional rather than private, it concerns you in your business capacity, and much of it you or your firm already published.

That basis depends on your interests not overriding ours, which is why the objection route in section 07 is unconditional and takes effect immediately.

The customer running a raise sees the investors matched to it. Beyond that we use service providers who process information on our instructions only: hosting and database infrastructure (Supabase, Vercel), email delivery (Resend, Instantly), the data providers named in section 03, and Anthropic for the AI features that draft and summarise. We do not sell your information and we do not share it for anyone else’s advertising.

Lunra and these providers operate in the United States, so information is processed there.

Rather than a fixed period for everyone, we apply a rule. A profile that has never been used, meaning it has never been attached to a raise, never contacted, never introduced, and never monitored, is deleted once we have held it beyond our retention window. Profiles in active use are kept while that use continues, and reviewed after it ends.

Deletion under this rule is a real deletion, not a flag. If you have asked us not to contact you, we keep a minimal record of that request only, because it is the only way to stop the same public filing putting you back in the directory next month.

You can tell us to stop contacting you, or to delete you outright, using our request form. It needs no account, asks for no reason, and is applied straight away rather than after a review.

You also have the right to ask what we hold and get a copy, to have it corrected, to restrict how we use it, and to object to our use of it. Your right to object to direct marketing is absolute: if you exercise it, that is the end of the matter and there is no balancing exercise. For anything beyond stopping contact or deletion, write to privacy@lunra.io and we will respond within one month.

If you are unhappy with how we have handled it, you can complain to your data protection regulator. In the UK that is the Information Commissioner’s Office; in the EU it is the supervisory authority where you live or work.

We score how well an investor appears to fit a particular raise, and rank matches for our customers using those scores. This is a relevance judgement for the person doing the raise. It produces no decision about you with legal or similarly significant effects, and a human always chooses whether to contact anyone.