Privacy Policy

Version v2 · Last updated: 27 September 2026

1. Who we are

Le Main de Dieu ("we", "us", "our") operates a matching platform for deep-tech founders, co-founders, investors, and commercial partners. We are the data controller for personal data processed through the platform.

Contact: privacy@lmdd.tech

2. What data we collect

Category	Examples	Source
Account data	Name, email, password (hashed), role	Provided by you at signup
Profile data	Organization, title, category, capabilities, geography, team, funding status	Provided by you
Mandate data	Categories, stages, priorities, preferences, deal-breakers	Provided by you
Connection data	Requests sent/received, status, outcome reports	Generated by your use of the platform
Support data	Messages you send through the query form	Provided by you
Consent records	Timestamps and versions of Terms and Privacy acceptances	Recorded automatically
Technical data	IP address, browser type, session tokens	Collected automatically on sign-in

3. How we use your data

We process personal data for the following purposes:

To provide the matching service — showing your profile and mandates to relevant counterparties, computing matches, facilitating connections.
To secure your account — authenticating sign-ins, detecting suspicious activity.
To communicate with you — service emails (password resets, security alerts) and, if you opt in, match notifications.
To improve the service — aggregate, anonymized analytics about how users interact with the platform.
To comply with legal obligations — responding to lawful requests, maintaining records required by law.

4. Legal basis for processing

We process personal data on the following legal grounds under GDPR:

Contract (Art. 6(1)(b)) — to provide the service you signed up for.
Consent (Art. 6(1)(a)) — for optional features like match notification emails. You can withdraw at any time from Settings.
Legitimate interests (Art. 6(1)(f)) — for fraud prevention, platform security, and aggregated analytics. We balance these interests against your rights.
Legal obligation (Art. 6(1)(c)) — for tax, accounting, and legal compliance.

5. Who we share your data with

We use the following processors. Each has its own privacy commitments and GDPR compliance.

Processor	Purpose	Location
Supabase	Database, authentication, file storage	EU / US (configurable)
Resend	Transactional email delivery	US
Stripe	Payment processing (for paid accounts)	US / EU
Namecheap	Website hosting	US

We do not sell your personal data. We do not share it with advertisers.

Profile visibility: Your profile and mandate data are visible to counterparties on the platform as part of the matching service. Contact details (email, phone) are only revealed to users you have accepted a connection with.

6. International transfers

Some of our processors are located outside the EEA. When we transfer personal data outside the EEA, we rely on Standard Contractual Clauses or an equivalent safeguard approved by the European Commission.

7. How long we keep your data

Account and profile: until you delete your account, plus 30 days in backups.
Connection records: while either party remains active on the platform.
Consent records: for as long as we are required to demonstrate compliance (typically 3 years).
Inactive accounts: deleted after 24 consecutive months of no sign-in, with a warning email 30 days prior.

8. Your rights

You have the following rights under GDPR. Most are available directly from the dashboard's Settings page.

Access — request a copy of your personal data.
Rectification — correct inaccurate data.
Erasure — delete your account and associated data.
Restriction — limit how we process your data.
Portability — export your data in machine-readable format.
Object — object to processing based on legitimate interests.
Withdraw consent — for any consent-based processing, at any time.
Complain — lodge a complaint with your national data protection authority.

To exercise any right, use Settings or email privacy@lmdd.tech. We respond within 30 days.

9. Security

Passwords are hashed with industry-standard algorithms. Sessions are time-limited. Data in transit is encrypted with TLS. Access to production systems is restricted and logged.

If we become aware of a data breach affecting your personal data, we will notify you and the relevant supervisory authority within 72 hours as required by GDPR.

10. Cookies and local storage

We use local storage for session tokens and preferences. We do not use tracking cookies or third-party advertising cookies.

11. Changes to this policy

We may update this policy. Material changes will be communicated by email and will require re-acceptance on your next sign-in.

12. Contact

Questions or requests: privacy@lmdd.tech