NorthSeed ("the Platform") is a startup directory connecting founders with investors. It is operated by NorthSeed Technologies, a business registered in Kenya under the Registration of Business Names Act (Business No. BN-36SMOWME), with its registered address at Floor 12, Room 12 73, Kakamega Court, Embakasi, Nairobi, Kenya("we," "us," or "our"). We are the data controller for the personal data described in this policy, and we process it in line with Kenya's Data Protection Act, 2019, and other data protection laws that apply to you where you live.
This policy explains what we collect, why, who we share it with, and your rights. It should be read together with our Terms & Conditions and Cookies Policy.
We do not currently verify the identity, source of funds, or accreditation status of any investor or founder. Users must comply with all applicable anti-money-laundering and counter-terrorist-financing laws. We may be required to disclose information to regulators or law-enforcement authorities where the law requires it.
2. Information We Collect
We collect the following types of information:
Account information: full name, email address, password (stored in hashed form by our authentication provider), and account role (founder or investor), collected when you sign up.
WhatsApp number: collected at signup and kept private. It is used to facilitate introductions between founders and investors and is never displayed publicly. If you accept an introduction request, it may be shared with the other party (see Section 5).
Payment information: we process all payments through our payment processor, Paystack. For founders, this covers the $1 startup listing fee. For investors, this covers the $32 one-time activation fee and $2 monthly subscription. For M-Pesa payments, we collect your M-Pesa phone number. For card payments, card details are entered directly with Paystack and never pass through our servers. We store payment status, transaction references, and billing dates to manage your account.
Startup listing information: if you submit a startup, we collect details you provide such as name, tagline, category, location, traction data, logos, and screenshots. You choose what is public versus investor-only.
Uploaded media: logos, screenshots, and demo images are stored via our media hosting provider (Cloudinary).
Waitlist and email subscription data: your email address, when and how you signed up, and your unsubscribe status.
Usage data: pages viewed, startups viewed, and interactions such as saved startups or introduction requests. Logged-in views are linked to your account so we can show founders unique-viewer counts and investors their viewed-startup counts.
Technical data: IP address, browser and device type, and error and security logs. We use these to keep the Platform secure, limit abuse (such as rate limiting), and diagnose errors.
Messages and introduction requests: the content of requests and messages you send through the Platform.
We do not record your screen, keystrokes, or sessions, and we do not use advertising trackers.
3. How and Why We Use Your Information
We only use personal data where we have a lawful basis to do so. The list below shows our purposes and bases.
To create and manage your account, and process fees and subscriptions — to perform our contract with you.
To display approved startup listings and facilitate introductions — to perform our contract with you and based on the visibility choices you make.
To send account-related notifications (approvals, rejections, messages, intro requests, payment confirmations) — to perform our contract with you.
To send waitlist, launch, and product update emails — based on your consent, which you can withdraw at any time.
To maintain security, prevent fraud and abuse, and fix errors — our legitimate interest in running a safe and reliable platform.
To improve the Platform from aggregated usage patterns — our legitimate interest in improving our service.
To meet legal, tax, and accounting obligations and handle disputes — to comply with the law.
4. Email Marketing
We send marketing or update emails only if you joined our waitlist or otherwise subscribed.
Every marketing email contains a one-click unsubscribe link and our postal address: NorthSeed Technologies, P.O. Box 00518-00100, Nairobi, Kenya
You can also unsubscribe by emailing us at privacy@northseedapp.com. We will stop marketing emails promptly.
We will still send essential service emails about your account, payments, and security.
5. Who Can See Your Information
Public: Approved startup listings, including founder name, pitch, category, location, and the traction fields you mark as public, are visible to anyone browsing the site — no account required — and may be indexed by search engines.
Investor-only: Revenue figures, growth data, and funding details you mark investor-only are visible only to logged-in investor accounts with an active subscription.
Shared on acceptance: When a founder accepts an introduction request, contact details (such as email and WhatsApp number) are shared with the other party. Once shared, they can use them outside our Platform, and we cannot control that use.
Never public: Your email address, WhatsApp number, and payment information are never displayed publicly.
Legal and safety: We may disclose information if required by law, court order, or a valid request from a public authority, or to protect rights, safety, and the security of the Platform.
We do not sell your personal information.
6. Service Providers We Use
These providers process data on our behalf under their own privacy and security commitments:
Supabase: database, authentication, and storage.
Vercel: website hosting and delivery.
Cloudinary: image and media hosting.
Paystack: payment processing (M-Pesa and card) for founder listing fees and investor account fees.
Upstash: rate limiting, which uses your IP address temporarily to prevent abuse.
Sentry: error monitoring. Error reports may include technical details such as your browser, device, page, and IP address.
Our email delivery provider: sends account and waitlist/update emails.
7. International Transfers
Some of our service providers store or process data outside Kenya, including in the United States and Europe. Where we transfer personal data abroad, we rely on appropriate safeguards, such as provider contractual commitments and security measures, as required by the Data Protection Act, 2019.
8. Data Storage and Security
Your data is stored using Supabase with row-level security policies restricting access to authorized users. Media files are hosted via Cloudinary. Payments are processed by Paystack, a PCI-compliant payment processor — card details are handled entirely by Paystack and never stored on our servers. We also use input validation, access controls, and rate limiting. While we take reasonable steps to protect your information, no method of transmission or storage is 100% secure. If a breach affects your personal data, we will notify the Office of the Data Protection Commissioner and affected users as required by law.
9. Cookies
We use cookies and similar technologies to keep you logged in and remember your preferences. See our Cookies Policy for full details.
10. Your Rights and Choices
Under the Data Protection Act, 2019 (and similar laws that apply to you), you have the right to:
Be informed about how your personal data is used.
Access the personal data we hold about you.
Correct inaccurate or incomplete data. You can also edit your profile from your account settings.
Request deletion of your account and associated data.
Object to or restrict certain processing, including direct marketing.
Withdraw consent at any time, for example by unsubscribing from emails.
Request a copy of your data in a portable format where applicable.
Choose what traction data on your startup listing is public versus investor-only.
To use these rights, email us at privacy@northseedapp.com from your registered email address. We may ask you to verify your identity first.
To cancel auto-renewal of your investor card subscription, email us at the same address; access continues until the end of the current billing period.
If you are unhappy with how we handle your data, you can lodge a complaint with the Office of the Data Protection Commissioner of Kenya (odpc.go.ke), or with your local data protection authority if you live outside Kenya.
11. Data Retention
We retain your account and listing data for as long as your account is active. Payment and subscription records are retained for as long as reasonably needed for accounting, tax, and dispute-resolution purposes, even after account deletion. If you delete your account, we remove your other personal data within a reasonable period, except where retention is required for legal or security reasons. Waitlist emails are kept until you unsubscribe or ask us to delete them. Backups and logs are deleted on a rolling basis.
12. Children's Privacy
NorthSeed is not intended for individuals under the age of 18. We do not knowingly collect information from minors. If you believe a minor has given us personal data, contact us and we will delete it.
13. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be reflected by an updated "Last updated" date at the top of this page, and where practical we will also notify registered users by email.
14. Contact Us
If you have questions about this Privacy Policy or how your data is handled, contact us: