Privacy Policy

88 Labs ("RaiseOS", "we", "us") builds fundraising software for early-stage founders. This notice explains what personal data we collect, why we collect it, how long we keep it and the choices you have. For data you submit through the product, RaiseOS acts as the controller of your account data and as a processor for the content you upload on behalf of your company.

Questions, requests or complaints about privacy go to privacy@raiseos.com. We answer data-rights requests within 30 days.

• Account data: name, work email, company name, role, password hash and authentication metadata.
• Company and raise data you enter: company basics, founder profile, traction figures, financials, round details and documents you upload to the data room.
• Investor and contact records you import or that we capture from mailboxes and messaging you connect, including names, work email addresses and interaction history.
• Usage data: pages viewed, features used, timestamps, device and browser type, approximate location derived from IP address.
• Billing data: plan, billing country, invoice history. Card details are handled by our payment processor and never stored on our servers.
• Support and marketing data: messages you send us, and newsletter subscription status if you opt in.

• To provide the product, including matching, CRM, outreach drafting, the data room and captable features. Legal basis: performance of a contract.
• To keep the service secure, prevent abuse, and debug failures. Legal basis: legitimate interests.
• To bill you and meet accounting obligations. Legal basis: contract and legal obligation.
• To send product and newsletter email you asked for. Legal basis: consent, withdrawable at any time.
• To improve the product using aggregated or de-identified usage patterns. Legal basis: legitimate interests.

We do not sell personal data, and we do not use your company documents, investor lists or outreach content to train third-party foundation models.

Some features send the minimum content required to third-party AI providers to generate matches, briefs, drafts and suggestions. Those providers process the content only to return a result for you, under contracts that prohibit training on it. AI output can be wrong; nothing is sent to an investor without your explicit approval.

• Infrastructure and hosting providers that run our application and databases.
• Email, calendar and messaging providers you connect, only to the scopes you grant.
• AI model providers, for the features described above.
• Payment processing, analytics, error monitoring and customer-support tooling.
• Professional advisers, or authorities where we are legally required to disclose.
• An acquirer, if the business is merged or acquired; you will be notified before your data moves.

Every processor is bound by a written agreement limiting them to our instructions and requiring appropriate security measures.

We operate globally, so your data may be processed outside your country, including in the United States, the European Union and India. Where we transfer personal data out of the EEA or the UK, we rely on Standard Contractual Clauses or the UK Addendum, together with technical safeguards such as encryption in transit and at rest.

• Account and company data: for as long as your account is active.
• After deletion: workspace content is removed from live systems within 30 days and from encrypted backups within 90 days.
• Invoices and tax records: retained as long as applicable law requires, typically eight years.
• Security and audit logs: up to 12 months.

We use encryption in transit (TLS) and at rest, role-based access control, least-privilege access for staff, audit logging, and regular dependency and vulnerability review. No system is perfect. If a breach affects your personal data, we notify affected users and the relevant regulator without undue delay, and within 72 hours where required.

Depending on where you live, you may have the right to access, correct, delete, export or restrict processing of your personal data, to object to processing based on legitimate interests, to withdraw consent, and to lodge a complaint with your supervisory authority. Under the GDPR, the UK GDPR and India's Digital Personal Data Protection Act these rights apply directly; if you are in California, you may also request disclosure of categories collected and opt out of any sale or sharing (we do neither). Email privacy@raiseos.com and we will verify your identity and respond within 30 days.

We use strictly necessary cookies for sign-in and security, and limited analytics cookies to understand which pages are useful. Where consent is required, we ask before setting non-essential cookies, and you can change your choice at any time in your browser or through the cookie banner.

RaiseOS is a business tool and is not directed at anyone under 18. We do not knowingly collect data from children. If we learn we have, we delete it.

If we make a material change we will email account holders and update the date at the top of this page before the change takes effect. Continued use after that date means you accept the updated notice.