Privacy policy

1. Scope

This policy explains how GetSweaty Pty Ltd (ABN 97 692 477 393) handles personal information. It covers this marketing website and, at a summary level, the GetSweaty platform. When you create an account, the in-product privacy notice presented at sign-up applies in addition to this policy.

GetSweaty launches in Australia and the United Kingdom in October 2026, and anyone anywhere can apply for access in the meantime. We handle personal information in accordance with the Australian Privacy Principles under the Privacy Act 1988 (Cth), which apply to us as an Australian company, and with the data protection law that applies where you are — including the UK and EU GDPR, PIPEDA in Canada, the Privacy Act 2020 in New Zealand, and state privacy legislation in the United States.

2. This website

This site is a set of static pages. It sets no cookies, runs no analytics, embeds no social or advertising pixels, and loads no fonts, scripts or images from third-party domains. There is no login. The two forms described below — the waitlist dialog and the newsletter box in the footer — are the only things on this site that send anything to us.

The only thing stored on your device is your light or dark mode choice, kept in your browser’s local storage. It never leaves your browser and cannot identify you. See the cookie policy for the detail.

There is no contact form. The contact page lists our email addresses and nothing more, so a message reaches us only when you send it yourself, from your own email account.

The waitlist form does. The product is not open in any market yet, so every join and sign-in link on this site opens a waitlist dialog instead. If you submit it we store the name, email address and role you gave us, the moment you submitted, which page you submitted from, and the country your request came from. We use it to tell you when GetSweaty opens in your market. We do not sell it or share it with anyone outside our hosting provider. It is held in private storage operated by Vercel Inc., our hosting provider, readable only by us and not by anyone who happens to know its address, and deleted once you either create an account or ask us to remove you. Write to privacy@getsweaty.com and we will remove it.

That dialog also carries a marketing checkbox, which is not ticked for you and does not have to be ticked to join. Leave it alone and the launch announcement is the only thing we will ever send you. Tick it and we will also send occasional updates about what we are building; we record that you ticked it and when, because consent is only meaningful if we can show where it came from.

The newsletter box in the footer is the other way to ask for those updates, and asking is the whole of it: we store the address you typed, the moment you typed it, which page you were on and the country the request came from, and nothing else. It is a separate list held the same way, in the same private storage. Subscribing to it does not put you on the waitlist, and joining the waitlist does not put you on it.

Either way, you can stop it. Every marketing email carries an unsubscribe link, and writing to privacy@getsweaty.com works just as well. Withdrawing marketing consent does not remove you from the waitlist, and unsubscribing from the newsletter does not either — say so if you want both, and we will do both.

Our hosting provider records standard server logs when a page is requested, which may include your IP address, the page requested, the time of the request and your browser user agent. These logs exist for security and reliability, are held for a short period, and are not used to build a profile of you.

3. The platform

If you create an account, we collect and hold information you choose to provide, which may include:

• identity and contact details: name, email address, mobile number and profile photograph;
• professional information: headline, biography, primary discipline, skills, industry expertise, career highlights, years of experience, location and links to your public profiles;
• preferences that drive matching: availability, weekly hours, preferred duration, work modes, disciplines, industries, company stages, geographies and any equity floor you set;
• for investors: investor type, thesis, preferred sectors, stages, geographies, cheque size range and lead preference;
• for companies: company details, incorporation and registration details, business metrics, proof points, updates and documents you upload to a data room;
• engagement information: opportunities, applications, cover notes, milestones, agreements and their status; and
• communications: messages sent through the platform and their attachments, and correspondence with us.

Identity verification is optional. Choosing not to verify does not restrict your existing account access. With your consent, our identity verification provider collects your government photo ID, selfie and any liveness video directly. The provider extracts identity information from your document, processes biometric data for facial comparison and liveness checks, and analyses device and IP information. Our authorised team can review the evidence and results in the provider’s system for identity verification, manual review and fraud prevention.

Our app privately stores your verified full name and any available given and family names returned by the provider, the verification result, and whether your profile name matches. We also retain any different profile name explicitly accepted after manual review. We use these records to retain your identity verification and assess later profile-name changes. Other members see only your badge, not these private records. We do not copy your ID images, selfies, videos, document number, biometric data or full verification report into our app database. We have opted out of the provider’s use of our verification data for model training.

4. Why we handle it

We use personal information to:

• create and administer your account and verify your identity;
• operate the marketplace, including discovery, matching, applications and messaging;
• generate, record and administer equity agreements and milestone schedules, and meet the filing and record-keeping obligations attached to them;
• keep the platform safe, and detect and prevent misuse;
• improve the product and understand, in aggregate, how it is used; and
• comply with our legal obligations.

Where the UK or EU GDPR applies, our lawful bases are performance of a contract with you, our legitimate interests in operating and securing the platform, compliance with legal obligations, and your consent where we ask for it.

5. What other people can see

The platform is a marketplace, so parts of your profile are visible to other members by design. You control whether your profile is public, what you publish on it, and who you grant data-room access to. Documents shared through a data room are subject to folder-level access controls and an audit trail of who opened what and when.

If you verify, other members can see your Verified badge and verification date on your profile. They cannot see your private verification status or identity documents. The badge records an identity check; it does not verify your company, employment or qualifications.

6. Service providers

We use a small number of providers to run the service, including:

• cloud hosting and content delivery for the website and product;
• a managed database, authentication and file storage provider for account and profile data;
• an email delivery provider for transactional email;
• an identity verification provider for optional government ID, selfie and liveness verification;
• a video hosting provider for company videos; and
• a places provider used to standardise location entry, called from our servers rather than from your browser.

Some of these providers store or process data outside the country you are in, including in Australia, the United States and the European Union. Where we transfer personal information across borders, we take reasonable steps to ensure it is handled consistently with this policy and with the transfer requirements that apply.

7. Retention

We keep personal information for as long as your account is active and afterwards only for as long as we need it, including to meet legal, tax, accounting and record-keeping obligations attached to equity agreements. Records relating to a signed agreement are generally kept for at least seven years. Server logs are kept for a short period.

We configure our identity verification provider to retain verification sessions and their full collected evidence for ten years, for identity verification, manual review and fraud prevention. This includes ID images, selfies, any liveness videos, extracted identity data, biometric data, device and IP information, and check results. This period is subject to earlier deletion where the data are no longer needed, a valid erasure or consent-withdrawal request requires it, or applicable law requires a shorter period.

Separately, the provider may retain an image-free numerical face template after operational deletion of a session and its photos, videos and other evidence. The template remains biometric data, is not anonymous, and, for duplicate-account detection and fraud prevention, is linked to your user record in GetSweaty’s account with the provider. We configure a 3,650-day limit, capped by our general ten-year retention window. It is deleted sooner if its purpose ends, applicable law requires it, your user record with the provider is deleted, or we instruct privacy erasure or explicitly purge it. A valid privacy-erasure request covers both the session evidence and any retained template.

GetSweaty keeps the minimal verification reference, result, verified full name and available given and family names, your saved GetSweaty profile name, any profile name accepted after manual review, the name-match result, and consent and verification dates while needed to provide the badge. Routine deletion of the verification evidence held by our identity verification provider does not itself remove that dated result. You can withdraw your verification consent and ask us to remove your verification and badge by writing to privacy@getsweaty.com.

8. Security

We use access controls, encryption in transit, row-level authorisation rules and audit logging to protect personal information. No system is perfectly secure, and we cannot guarantee absolute security, but we take reasonable steps to protect information from misuse, interference, loss and unauthorised access, modification or disclosure.

9. Your rights

You may ask us to:

• give you access to the personal information we hold about you;
• correct information that is inaccurate, out of date or incomplete;
• delete information we no longer need to keep;
• restrict or object to certain handling; and
• provide a copy of information you gave us in a portable format, where that right applies to you.

Write to privacy@getsweaty.com and we will respond within a reasonable period, usually within 30 days. We may need to verify your identity first. Some information cannot be deleted while we are required to keep it, for example records attached to a signed equity agreement.

10. Complaints

If you think we have mishandled your personal information, tell us at privacy@getsweaty.com and we will investigate. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner, or to the data protection authority where you are — for example the Information Commissioner’s Office in the United Kingdom, the Office of the Privacy Commissioner of Canada, or the Office of the Privacy Commissioner in New Zealand.

11. Children

GetSweaty is intended for people aged 18 and over. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will delete it.

12. Changes

We may update this policy. The version published here is the current one, and the date at the top of this page shows when it last changed. Material changes affecting account holders will also be notified in the product.

13. Contact

Privacy enquiries: privacy@getsweaty.com. General enquiries: hello@getsweaty.com. See also our cookie policy.