Privacy Policy

1. Introduction

Kakashi Venture Accelerator Srl ("KVA," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website and use our services.

We are the First AI Native Venture Studio in Italy, and we take data protection seriously. This policy applies to all information collected through our website and any related services, sales, marketing, or events.

2. Data Controller

The data controller responsible for your personal data is:

3. Information We Collect

3.1 Information You Provide

We collect information that you voluntarily provide when using our services:

• Search Queries: When you use our AI-powered search feature, we collect the queries you submit to provide relevant responses.
• Feedback: Ratings, comments, and feedback you provide about our generated content.
• Follow-up Questions: Additional questions you ask in conversation with our AI system.
• Account Information: For administrators, we collect email addresses and encrypted passwords.

3.2 Automatically Collected Information

When you access our website, we automatically collect certain information:

• Session Data: A randomly generated session identifier to correlate your interactions during a visit.
• Engagement Metrics: Time spent on pages, scroll depth, and interaction patterns to improve our content quality.
• Device Information: Browser type, user agent, and general device characteristics.
• IP Address: Used for security purposes, rate limiting, and fraud prevention.
• Timestamps: When you access our services.

3.3 Information We Do NOT Collect

We want to be clear about what we don't do:

• We do not use third-party analytics services (e.g., Google Analytics)
• We do not use advertising trackers or marketing pixels
• We do not sell your personal data to third parties
• We do not create persistent user profiles across sessions
• We do not process payment information (no e-commerce functionality)

4. How We Use Your Information

We use the collected information for the following purposes:

5. Data Sharing and Third-Party Services

We share your information with the following categories of service providers:

5.1 AI Service Providers

To provide AI-generated responses, your queries are processed by:

• Anthropic (Claude): Our fallback provider for content generation, used when the primary provider does not answer. Their privacy policy is available at anthropic.com/privacy
• OpenAI: Our primary AI provider: it generates the site’s answers, produces the text embeddings and powers the Call4Ideas assistant. Their privacy policy is available at openai.com/privacy
• Google (Gemini): Used for multimodal processing tasks. Their privacy policy is available at policies.google.com/privacy
• Call4Ideas assistant (OpenAI): When you use the form’s assistant, the text you write or the audio you record is sent to OpenAI for transcription and to prepare a draft of your answers, which you then review and confirm. We do not keep them. OpenAI does not use them to train its models; the text may stay in its abuse-monitoring logs for up to 30 days, while it states that the audio is not retained. The microphone only turns on when you press record. Their privacy policy is available at openai.com/privacy

5.2 Infrastructure Providers

• Vercel: Our hosting provider (servers located in the EU/US). They process request logs and provide caching services.
• Supabase: Our database provider, hosting our PostgreSQL database with data stored in AWS infrastructure.
• Google Fonts: We use the Epilogue font family. Font files are loaded from Google's CDN.

5.3 KVA internal tools

The applications and proposals you send through our forms are handled with our internal tools, which process the data on behalf of the controller:

• Control8: Our internal project and innovation-pipeline platform. It receives proposals sent through Call4Ideas and records them as potential ideas, with the proposer's contact details and the record of the consents given.
• AskMadarAI: Our dealflow system. It receives applications sent through Call4Ventures, with their attached documents, and records them as deals in screening for assessment.
• Email: Notifications to the team travel over Google Workspace, or Resend where configured. They carry the form fields and the attached documents.
• Vercel Blob: Storage for documents uploaded with an application, when they are larger than the form itself can carry.
• Google Analytics and Tag Manager: Site usage statistics. They load only after you accept the “analytics” category in the cookie banner: if you refuse, the scripts are never requested and no data reaches Google.

5.4 No Sale of Data

We do not sell, rent, or trade your personal information to third parties for their marketing purposes.

6. Applications and proposals (Call4Ventures and Call4Ideas)

When you send an application or a proposal we collect what you write in the form: name, email, organisation, an optional link to your profile, the description of the idea or the startup, and the documents you attach. If you use the form’s assistant, the story you write or dictate only serves to prepare the draft of your answers: we keep neither it nor the audio; only the answers you confirm and send remain. How the AI provider handles them is described in section 5.1.

6.1 Legal basis

We process this data to assess the application and reply to you. The legal basis is the performance of pre-contractual measures taken at your request, under Art. 6(1)(b) GDPR. Updates unrelated to your application are sent only with your explicit consent, Art. 6(1)(a), which you can withdraw at any time with no effect on the assessment.

6.2 Record of consent

We record the moment of submission and the version of the notice you were shown, together with your choice about updates. This is how we demonstrate the consents given, as Art. 7(1) GDPR requires.

6.3 Retention

We keep applications we did not take forward for 24 months, so we can come back to you if a suitable call opens, and then delete them. If you ask for deletion sooner, we do it. Applications that lead to a collaboration follow the retention periods for contractual relationships.

You can request access, rectification, erasure, restriction and portability, and object to the processing, by writing to the contacts at the bottom of this page.

7. International Data Transfers

Your data may be transferred to and processed in countries outside the European Economic Area (EEA), including the United States, where our AI service providers are located.

When we transfer data outside the EEA, we ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses approved by the European Commission
• Data Processing Agreements with our service providers
• Verification that providers maintain appropriate security measures

8. Data Retention

We retain your information for the following periods:

We run automated cleanup processes to remove data that exceeds these retention periods.

9. Your Rights (GDPR)

Under the General Data Protection Regulation (GDPR), you have the following rights:

• Right of Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Request correction of inaccurate personal data.
• Right to Erasure: Request deletion of your personal data ("right to be forgotten").
• Right to Restriction: Request limitation of processing of your personal data.
• Right to Data Portability: Receive your data in a structured, machine-readable format.
• Right to Object: Object to processing based on legitimate interests.
• Right to Withdraw Consent: Withdraw consent at any time for processing based on consent.

To exercise any of these rights, please contact us at alberto@kakashi.ventures. We will respond to your request within 30 days.

You also have the right to lodge a complaint with a supervisory authority, such as the Italian Data Protection Authority (Garante per la protezione dei dati personali).

10. Cookies and Local Storage

We use a minimal set of cookies and local storage for essential functionality:

• Session Cookie (kva_session): For administrator authentication only. HTTP-only, secure, 24-hour duration.
• Session ID Cookie: A randomly generated identifier to correlate your interactions during a visit.
• Theme Preference: Stored in your browser's localStorage to remember your light/dark mode preference.
• Cookie Consent: Stores your cookie preferences to avoid asking repeatedly.

For detailed information about our cookie practices, please see our Cookie Policy.

11. Security

We implement appropriate technical and organizational measures to protect your personal data, including:

• Encryption of data in transit (HTTPS/TLS)
• Secure password hashing for admin accounts
• Rate limiting to prevent abuse
• Input validation and sanitization
• Security headers (HSTS, X-Frame-Options, Content-Type-Options)
• Prompt injection defense for our AI systems
• Regular security updates and monitoring

While we strive to use commercially acceptable means to protect your personal data, no method of transmission over the Internet or electronic storage is 100% secure.

12. Children's Privacy

Our services are not intended for individuals under the age of 16. We do not knowingly collect personal data from children. If you are a parent or guardian and believe your child has provided us with personal data, please contact us at alberto@kakashi.ventures.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date.

We encourage you to review this Privacy Policy periodically for any changes. Changes are effective when they are posted on this page.

14. Contact Us

If you have any questions about this Privacy Policy, please contact us: