Privacy Policy

Data controller: AlphaBridge GmbH Address: [TODO — Street], [TODO — Postcode] [TODO — City], Germany Managing director: [TODO — Name] Commercial register: [TODO — Amtsgericht City], HRB [TODO — Number] Privacy contact: privacy@alpha-bridge.co Support: support@alpha-bridge.co

AlphaBridge GmbH ("AlphaBridge", "we", "us") operates the expert network platform at https://alpha-bridge.co. We are the data controller for personal data processed in connection with the platform.

UK representative (UK GDPR Art. 27): AlphaBridge GmbH is not established in the United Kingdom. AlphaBridge relies on the Art. 27(2) UK GDPR exemption: processing of UK residents' personal data through this platform is not carried out on a large scale, does not involve special category data or criminal conviction data, and is unlikely to result in high risk to the rights and freedoms of natural persons, given the exclusively B2B professional context. UK data subjects and the ICO may contact AlphaBridge directly at privacy@alpha-bridge.co.

Where personal data is processed in Germany, the Bundesdatenschutzgesetz (BDSG) supplements the GDPR. Our primary supervisory authority is the data protection authority of the German state in which our registered office is located. [TODO — confirm registered address to identify lead supervisory authority.]

---

### Investors

When you register as an investor we collect your name, work email address, organisation, job title, and subscription details. During platform use we collect call request data (topics, sectors, restrictions), call metadata, consent records, and usage logs. Where billing applies, we process payment-related data via our payment processor Stripe.

### Experts

When you apply as an expert we collect your name, email address, professional background, employment history, LinkedIn profile, portrait photograph, video screening submission, declared area of expertise, and conflict-of-interest and NDA declarations. During platform use we collect call participation data, recordings, transcripts, compliance acknowledgements, and compensation records.

Where necessary for compliance verification, AlphaBridge may additionally collect professional and employment information from LinkedIn or directly from an Expert's declared employer. Experts are informed when such third-party data collection occurs.

### All users

We collect technical data including IP addresses, browser type, device identifiers, session logs, and authentication records via Google Firebase. We collect consent records (timestamp, policy version, user ID) for every call recording consent event.

---

We process personal data on the following legal bases under GDPR Article 6:

Contract (Art. 6(1)(b)): processing necessary to provide the platform, manage accounts, facilitate calls, process payments, and fulfil obligations under our terms of service and expert agreement.

Legal obligation (Art. 6(1)(c)): processing required to comply with applicable law, including data protection, tax, and financial regulation.

Consent (Art. 6(1)(a)): joining a recorded call (recording consent captured per participant per call via consent modal), marketing communications (where applicable), transcript library publication (consent given by experts at the point of accepting each call request under the Expert Agreement).

Legitimate interest (Art. 6(1)(f)): retention and compliance use of call recordings and transcripts for audit and regulatory purposes; platform security; fraud prevention; service improvement (excluding use of call recordings or transcripts for this purpose); compliance monitoring.

Vital interests (Art. 6(1)(d)): where applicable in exceptional circumstances.

Note on call recording: consent is the legal basis for the act of recording, captured before joining each call. Subsequent retention of recordings for compliance and audit purposes relies on legitimate interest (Art. 6(1)(f)). Withdrawal of recording consent does not obligate deletion of recordings retained for legitimate compliance purposes.

---

We use personal data to:

• Provide platform access, including account creation, authentication, and subscription management
• Match investors with experts and facilitate video calls
• Record, transcribe, and store calls for compliance and audit purposes
• Screen calls and transcripts for compliance, including automated MNPI detection
• Process payments and manage billing records
• Send service communications, compliance notices, and (with consent) marketing
• Respond to data subject rights requests and comply with legal obligations
• Maintain platform security, detect fraud, and prevent abuse
• Verify Expert employment declarations and compliance with platform eligibility requirements
• Enforce platform agreements including non-solicitation obligations where applicable

---

All calls conducted through the AlphaBridge platform are recorded and transcribed, regardless of subscription tier. Recording is a condition of platform participation and occurs for MNPI compliance and audit purposes. Before joining a call, each participant must explicitly consent via a consent modal. Participation is technically prevented without completing this step — the LiveKit room token is withheld until consent is recorded.

Standard calls are published to the AlphaBridge subscriber library after compliance review, as a core service purpose under the Expert Agreement. Private calls (designated by clients on a Premium subscription before the call) are recorded for compliance and audit purposes only and are not published to the library.

Recordings and transcripts are retained in accordance with the Recording Consent Policy and Data Retention Policy.

The consent mechanism is designed to satisfy recording consent requirements in all-party consent jurisdictions including California (Penal Code §632), Illinois (720 ILCS 5/14), and Florida (§934.03). Participation without completing the consent step is technically prevented at the platform level.

---

We use automated transcription (ElevenLabs Scribe) to convert call audio to text. Transcripts may be processed by automated tools for compliance screening purposes, including detection of potentially restricted topics or companies. Compliance review follows where automated screening raises a flag.

GDPR: This automated processing does not produce legal or similarly significant effects concerning you without human involvement, in accordance with Article 22 GDPR.

California residents (CPRA): Under the CPRA, you have the right to opt out of automated decision-making technology, including profiling, that produces legal or similarly significant effects. The automated processing described above is used solely for compliance screening and does not determine your access to the platform or produce binding outcomes. To request more information or exercise your opt-out right, contact privacy@alpha-bridge.co.

Swiss users: In accordance with Article 21 of the Swiss Federal Act on Data Protection (nFADP), you have the right to request human review of any automated processing that produces a decision with legal or similarly significant effects on you, and to express your view on that decision. Contact privacy@alpha-bridge.co to exercise this right.

---

We share personal data only as described in this policy:

• Subprocessors: we use third-party service providers to operate the platform (see Section 8). These providers process data only on our instructions.
• Legal requirements: we may disclose personal data to regulators, courts, or law enforcement where required by applicable law.
• Business transfers: in the event of a merger, acquisition, or sale of assets, personal data may be transferred to the acquirer, subject to equivalent data protection obligations.
• Expert content: expert call content is published to the AlphaBridge subscriber library as part of the platform's core service (with or without attribution as agreed). This is a disclosed and agreed purpose under the Expert Agreement. See Section 7 (Data sharing) and our Privacy Choices page for how experts can request call exclusions or transcript removal.

AlphaBridge's core service is a subscriber library of expert call transcripts and recordings, sold to institutional investors on a subscription basis. Library publication is a disclosed and agreed purpose of the platform: experts consent to publication when accepting a call request under the Expert Agreement. Published transcripts contain expert personal data — names, professional background, and attributed opinions. Under the CCPA/CPRA, making personal data available to third parties for valuable consideration constitutes a "sale" of personal data. AlphaBridge discloses this practice and provides experts with the right to request exclusion or removal. For more information and to exercise your rights, see Section 9 (California residents) and our Privacy Choices page.

---

We use the following subprocessors:

Full and current subprocessor details are maintained in the Subprocessor Register.

For transfers of personal data from the EEA to the United States, LiveKit and Stripe rely on the EU–U.S. Data Privacy Framework (DPF), adopted by the European Commission on 10 July 2023, with Standard Contractual Clauses maintained as a fallback. ElevenLabs transcription processing relies on Standard Contractual Clauses under our Data Processing Agreement with ElevenLabs. Transfer Impact Assessments have been conducted for material subprocessors. UK-to-US transfers rely on the UK Extension to the EU–U.S. DPF and UK-approved SCCs where applicable.

Note on AI transcription: AlphaBridge processes call audio through ElevenLabs' speech-to-text API solely for transcription. Audio is sent only for that purpose and transcripts are stored in our EU infrastructure after processing, in accordance with ElevenLabs' API terms and our Data Processing Agreement with ElevenLabs. Transcription data is not used for any purpose beyond those described in this Privacy Policy.

---

### EU residents (GDPR)

Under GDPR you have the right to: access your personal data; rectify inaccurate data; request erasure where no lawful basis for retention exists; restrict processing; data portability; object to processing on legitimate interest grounds; and withdraw consent for consent-based processing at any time without affecting the lawfulness of prior processing.

To exercise these rights, contact privacy@alpha-bridge.co. We respond within 30 days (extendable by two months for complex requests).

The competent supervisory authority for AlphaBridge GmbH is the data protection authority of the German state of our registered office [TODO — confirm]. You may also contact the supervisory authority in your country of residence.

### UK residents (UK GDPR)

For users based in the United Kingdom, AlphaBridge processes personal data in accordance with the UK GDPR and the Data Protection Act 2018. UK residents have the same rights as those described in this section under EU GDPR. To exercise these rights, contact privacy@alpha-bridge.co or our UK representative (details in Section 1). The competent supervisory authority for UK residents is the Information Commissioner's Office (ICO), available at ico.org.uk.

### California residents (CCPA/CPRA)

California residents have the right to know what personal information is collected, to request deletion, to correct inaccurate information, to limit use of sensitive personal information, and to opt out of the sale or sharing of personal information.

AlphaBridge's business is a subscriber library of expert call transcripts sold to institutional investors. Library publication is the core disclosed purpose of the platform; experts consent to this at the point of accepting each call request under the Expert Agreement. Published transcripts contain expert personal data (names, professional background, attributed opinions) and this constitutes a "sale" of personal information under CCPA/CPRA.

California-resident experts may request exclusion of a specific call before it takes place, or removal of a previously published transcript, by contacting privacy@alpha-bridge.co. This is your right to opt out of the sale of your personal data. AlphaBridge will not discriminate against you for exercising this right.

To exercise any CCPA/CPRA right — including the right to know, delete, correct, limit, or opt out of sale/sharing — contact privacy@alpha-bridge.co or visit our Privacy Choices page. We respond within 45 days.

### Other US state residents

Residents of Virginia, Colorado, Texas, and other states with enacted comprehensive privacy legislation have similar rights. Contact privacy@alpha-bridge.co.

### Illinois residents (BIPA)

No biometric identifiers, including voiceprints or facial geometry, are derived from call recordings. Audio is processed solely for speech-to-text transcription via ElevenLabs Scribe and is not used to generate biometric data as defined under the Illinois Biometric Information Privacy Act (740 ILCS 14). If this practice changes, AlphaBridge will obtain explicit written consent from Illinois residents before any biometric data collection in compliance with BIPA requirements.

### Brazilian residents (LGPD)

AlphaBridge processes personal data of Brazilian residents in accordance with the Lei Geral de Proteção de Dados Pessoais (LGPD), Law No. 13.709/2018. Brazilian residents have the right to confirm the existence of processing, access their data, correct incomplete or inaccurate data, anonymise, block or delete unnecessary data, request data portability, delete data processed with consent, and lodge a complaint with the Autoridade Nacional de Proteção de Dados (ANPD). AlphaBridge publishes expert call transcripts to a subscriber library as part of its core service; see Section 7 for details. To exercise these rights, contact privacy@alpha-bridge.co. Transfers of personal data from Brazil are carried out with appropriate safeguards including Standard Contractual Clauses, given that Brazil does not currently hold an EU adequacy decision.

### Indian residents (DPDPA)

AlphaBridge processes personal data of Indian residents in accordance with India's Digital Personal Data Protection Act 2023 (DPDPA). Indian residents have the right to access, correct, and erase personal data held by AlphaBridge, and to nominate a representative to exercise these rights. To exercise these rights contact privacy@alpha-bridge.co. The relevant data protection authority is the Data Protection Board of India.

### Singapore residents (PDPA)

AlphaBridge processes personal data of Singapore residents in accordance with Singapore's Personal Data Protection Act 2012 (PDPA). AlphaBridge obtains consent before collecting, using, or disclosing personal data as required under the PDPA. Singapore residents have the right to access and correct their personal data held by AlphaBridge. To exercise these rights, contact privacy@alpha-bridge.co. AlphaBridge will respond within 30 days.

### Hong Kong residents (PDPO)

AlphaBridge processes personal data of Hong Kong residents in accordance with the Personal Data (Privacy) Ordinance (Cap 571) (PDPO). Hong Kong residents have the right to request access to and correction of personal data held about them by AlphaBridge. AlphaBridge does not use personal data for direct marketing purposes without consent. To exercise these rights, contact privacy@alpha-bridge.co.

### Mexican residents (LFPDPPP)

AlphaBridge processes personal data of Mexican residents in accordance with the Ley Federal de Protección de Datos Personales en Posesión de los Particulares (LFPDPPP). A separate Aviso de Privacidad in Spanish is provided to Mexican residents, as required by Articles 15 and 16 LFPDPPP: see Aviso de Privacidad. Mexican residents have ARCO rights (acceso, rectificación, cancelación, oposición) exercisable by emailing privacy@alpha-bridge.co. The supervisory authority is the Instituto Nacional de Transparencia, Acceso a la Información y Protección de Datos Personales (INAI), at www.inai.org.mx.

### UAE and Middle East residents

UAE (Federal PDPL): AlphaBridge processes personal data of UAE residents in accordance with Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL). UAE residents have the right to access, correct, and request erasure of their personal data held by AlphaBridge, to withdraw consent for consent-based processing, and to request data portability. AlphaBridge collects personal data only for the purposes described in this Privacy Policy and does not use it for unrelated purposes. Cross-border transfers of personal data from the UAE are made subject to appropriate safeguards in accordance with Article 22 of the UAE PDPL. To exercise your rights, contact privacy@alpha-bridge.co. The UAE Data Office (uaedataoffice.ae) is the supervisory authority.

Dubai International Financial Centre (DIFC): If you are located in or interact with AlphaBridge through the DIFC, your personal data is processed in accordance with the DIFC Data Protection Law (DIFC Law No. 5 of 2020, as amended). DIFC residents have rights to access, correct, and restrict processing of personal data, and to object to processing on legitimate interest grounds, consistent with the DIFC law. The supervisory authority is the DIFC Commissioner of Data Protection.

Saudi Arabia (PDPL): AlphaBridge processes personal data of Saudi Arabia residents in accordance with the Personal Data Protection Law (PDPL), Royal Decree M/19 dated 9/2/1443H (in force September 2023). Saudi residents have the right to access, correct, and request erasure of their personal data, to withdraw consent, and to request restriction of processing. AlphaBridge obtains consent before processing Saudi residents' personal data for any purpose not strictly necessary for the contracted service. Cross-border transfers from Saudi Arabia are made subject to appropriate safeguards. To exercise your rights, contact privacy@alpha-bridge.co. The Saudi Data and AI Authority (SDAIA, sdaia.gov.sa) is the supervisory authority.

### Australian residents (Privacy Act 1988 / APPs)

AlphaBridge processes personal data of Australian residents in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Australian residents have the right to access and correct personal information held about them by AlphaBridge. AlphaBridge collects personal information only for purposes disclosed at the time of collection and does not use it for unrelated secondary purposes. Cross-border transfers of personal data from Australia are made in accordance with APP 8, including where AlphaBridge takes reasonable steps to ensure that overseas recipients handle the data consistently with the APPs. To exercise your rights or make a privacy complaint, contact privacy@alpha-bridge.co. If your complaint is not resolved to your satisfaction, you may contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

### Canadian residents (PIPEDA / Quebec Law 25)

AlphaBridge processes personal data of Canadian residents in accordance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and, for residents of Quebec, the Act respecting the protection of personal information in the private sector (Law 25 / Bill 64, in force since 2023). Canadian residents have the right to access, correct, and withdraw consent for processing of their personal data. Quebec residents additionally have the right to data portability and the right to request that AlphaBridge cease using their personal information. AlphaBridge collects, uses, and discloses personal information only with knowledge and consent, and only for purposes a reasonable person would consider appropriate in the circumstances. To exercise your rights, contact privacy@alpha-bridge.co. If your complaint is not resolved, you may contact the Office of the Privacy Commissioner of Canada (OPC) at priv.gc.ca or, for Quebec residents, the Commission d'accès à l'information (CAI) at cai.gouv.qc.ca.

### Employees and contractors

Personal data processed in the context of the employment or contractor relationship is governed by a separate Employee Privacy Notice provided at the time of onboarding. See Employee Privacy Notice.

---

Retention periods are defined in the Data Retention Policy. In summary: call recordings and transcripts are retained for seven years; consent records for seven years; account data for the account lifetime plus three years; billing records for ten years.

---

Material changes will be communicated via email or platform notice at least 30 days before taking effect. Where changes affect consent-based processing, we will seek fresh consent before those changes apply. Continued use after the notice period constitutes acknowledgment of the updated policy for non-consent-based processing. You may close your account if you do not accept material changes.

---

For any questions about this policy or to exercise your rights:

Email: privacy@alpha-bridge.co Post: AlphaBridge GmbH, [TODO — registered address]

---

AlphaBridge uses technically necessary cookies for authentication and session management via Google Firebase. We do not use advertising cookies or third-party tracking pixels. You may configure your browser to refuse cookies, but this may affect platform functionality. For full details see our Cookie Policy.

---

In the event of a personal data breach, AlphaBridge will notify the relevant supervisory authority within 72 hours of becoming aware where required under GDPR Article 33. Where a breach is likely to result in high risk to affected individuals, we will notify those individuals without undue delay. US users will be notified in accordance with applicable state breach notification laws.

---

The platform is intended solely for professional use by adults. We do not knowingly collect personal data from individuals under 18. If you believe we have inadvertently collected data from a minor, contact privacy@alpha-bridge.co immediately.