Privacy Policy

Pastel AI Ltd. (“Pastel,” “we,” “us”) builds AI-powered diligence and portfolio governance software for private equity firms, family offices, and their portfolio companies. This policy explains what information we collect when you use our website and services, how we use it, and the choices you have.

This policy applies to information we process as a controller (for example, information you provide on our marketing site or when booking a demo). When we process your deal or portfolio-company data through the Pastel platform, we do so as a processor on behalf of our customer; that processing is governed by the Data Processing Addendum signed with the customer.

We collect the following categories of information:

• Account & contact information. Name, business email, firm or company name, role, and any message content you send us when you request a demo, contact support, or sign up for an account.
• Authentication data. Identifiers used to sign in, including single sign-on identifiers issued by your identity provider.
• Customer content. Documents, contracts, financials, and communications that customers upload or connect to the platform. We process this on the customer's behalf under our Data Processing Addendum.
• Usage & device data. Pages visited, features used, IP address, browser type, operating system, and timestamps, collected through cookies and server logs.
• Correspondence. Records of communications you have with us, including support tickets and sales conversations.

We use the information we collect to:

• Provide, secure, and improve the Pastel platform.
• Authenticate users, manage accounts, and enforce access controls.
• Respond to demo requests, support inquiries, and other communications.
• Send service-related notices, product updates, and occasional marketing communications (you can opt out of marketing at any time).
• Detect, investigate, and prevent fraud, abuse, and security incidents.
• Meet our legal, regulatory, and contractual obligations.

We do not sell personal information, and we do not use customer content to train generative models.

We share information only as needed and with the following categories:

• Service providers and subprocessors that host our infrastructure, provide analytics, send transactional email, or otherwise help us operate Pastel. A current list is available on request.
• Your own organization and its authorized users, according to the access controls configured in your workspace.
• Law enforcement or regulators when we have a good-faith belief that disclosure is required by law or necessary to protect rights, safety, or property.
• Successors in the event of a merger, acquisition, or sale of assets, subject to equivalent protections.

We retain personal information for as long as needed to provide the services, comply with legal obligations, resolve disputes, and enforce our agreements. Retention periods depend on the category of data and are documented in our Data Processing Addendum for customer content.

When information is no longer needed, we delete it or anonymize it so it can no longer be associated with an identifiable individual.

We encrypt data in transit (TLS) and at rest, isolate customer workspaces, log administrative activity, and follow the practices described on our Security page. No system is perfectly secure; if you believe your account or our systems have been compromised, contact us immediately.

Pastel is operated from the United Kingdom and processes data in the United Kingdom, the European Economic Area, and the United States. When personal information is transferred across jurisdictions, we rely on approved transfer mechanisms, including the UK International Data Transfer Agreement and the EU Standard Contractual Clauses where applicable.

Depending on your jurisdiction, you may have rights to access, correct, delete, restrict, or object to our processing of your personal information, as well as rights to portability and to withdraw consent. To exercise these rights, email privacy@getpastel.ai. You may also have the right to lodge a complaint with a supervisory authority.

We use a small number of cookies and similar technologies to keep you signed in, remember your preferences, and understand aggregate usage. You can control cookies through your browser settings. Disabling cookies may affect the functionality of the service.

Pastel is not directed to children under 16 and we do not knowingly collect personal information from them. If you believe a child has provided personal information to us, please contact us and we will delete it.

We may update this policy from time to time. When we do, we will revise the “Last updated” date above. Material changes will be communicated to account holders by email or in-product notice before they take effect.

If you have questions about this policy or our privacy practices, email privacy@getpastel.ai or write to us at Pastel AI Ltd., United Kingdom.