Privacy Policy
Hastati Ventures LLC, a limited liability company organised under the laws of the State of Arizona, United States of America (Arizona Corporation Commission file number 23890386), with principal place of business at 11390 East Via Linda, Suite 101, Scottsdale, AZ 85259, USA ("The Punt", "we", "us", "our") is the data controller for personal data processed in connection with the The Punt mobile application, website, APIs and related services (the "Service"). Although we are based in the United States, the Service is offered to and used predominantly by individuals in the United Kingdom; we therefore process personal data in accordance with the UK General Data Protection Regulation (UK GDPR), which applies to us extraterritorially under Article 3(2)(a), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations 2003 (PECR). For US-resident users, we also honour the principles of US state privacy laws where applicable.
- What we collect
- How we use it and our lawful bases
- Marketing
- Who we share it with (recipients and processors)
- International transfers
- How long we keep it
- Your rights
- Children
- Security and breach notification
- Cookies and analytics
- Automated decision-making
- Changes to this policy
- Contact and complaints
1. What we collect
1.1 Information you give us
- Account data: your Cambridge email address, password (handled by our authentication provider Clerk — we never see your plaintext password), display name, biographical information you choose to add, and college/affiliation if you share it.
- Content you create: posts, comments, marketplace listings, event submissions, direct messages and images you upload.
- Marketplace and seller data: for sellers using the escrow flow, identification information you provide directly to Stripe during onboarding (Stripe is the controller for that data — see Stripe's privacy policy). We receive only your Stripe account ID, payout-readiness status, and the references to payments, charges and transfers we initiate on your behalf.
- Buyer payment data: card details are entered directly on Stripe's hosted checkout — we never see or store your card number, CVC, or full expiry. We receive only the transaction status, the last four digits and brand of the card used, and Stripe transaction IDs.
- Communications with us: the content of emails, support tickets and any other correspondence you send us, plus the email address from which you send them.
1.2 Information we collect automatically
- Device and log data: IP address, user-agent string, device type and operating system version, request timestamps, request paths, response codes, error stack traces, and the pages or features you interact with.
- Notification token: if you enable push notifications, the device push token issued by Apple or Google.
- Diagnostic data: crash reports and basic performance metrics necessary to operate and improve the Service.
1.3 Information from third parties
- Verification status from our authentication partner Clerk.
- Account, payout and dispute status updates from Stripe.
- Publicly available event information from third-party event platforms (Cambridge SU, Cambridge Union, Camdram, Cambridge Live, FIXR, Eventbrite). This is not personal data about you unless you yourself organise such an event.
1.4 Special category data
We do not ask you to provide and we do not deliberately process "special category" data (data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, genetic data, biometric data, health data, or data concerning sex life or sexual orientation). If you choose to share such data in your profile, posts, listings or messages, you do so on your own initiative and consent to that processing for the purpose of operating the Service.
2. How we use it and our lawful bases
| Purpose | Lawful basis (UK GDPR Art. 6 / Art. 9) |
|---|---|
| Provide the Service: account creation, posting, messaging, marketplace, event browsing | Performance of a contract (Art. 6(1)(b)) |
| Verify Cambridge eligibility | Performance of a contract; Legitimate interests (operating a closed network) |
| Process escrow payments and payouts | Performance of a contract; Legal obligation (financial-crime / record-keeping) |
| Detect, prevent and investigate fraud, abuse, security incidents and breaches of our Terms | Legitimate interests (protecting the Service, our users and us); Legal obligation |
| Comply with court orders, regulator requests, tax/accounting and other legal obligations | Legal obligation (Art. 6(1)(c)) |
| Send service-related emails (verification codes, security alerts, transactional receipts, important policy changes) | Performance of a contract; Legitimate interests |
| Send marketing and product-update emails / push notifications | Consent (Art. 6(1)(a)) — you can withdraw at any time |
| Defend, establish or exercise legal claims | Legitimate interests; Legal claims (Art. 9(2)(f) where special category data is involved) |
Where we rely on legitimate interests, we have balanced our interests against your rights and concluded that our processing does not override them. You can ask us for our balancing assessment at any time.
3. Marketing
We will only send you marketing communications where you have explicitly opted in (or where you are an existing user and we are emailing you about features similar to those you already use, in line with PECR's "soft opt-in"). Every marketing email contains an unsubscribe link, and you can opt out of push notifications at any time via your device settings or in-app settings.
4. Who we share it with
We share personal data with the categories of recipients set out below. We require all our processors to apply appropriate technical and organisational safeguards and to process personal data only on our documented instructions.
| Recipient | Purpose | Location |
|---|---|---|
| Clerk Inc. | Authentication, account management, email verification | USA |
| Stripe Payments Europe Ltd; Stripe Inc. | Payment processing, escrow, payouts, fraud screening, regulated identification of sellers | Ireland; USA |
| OpenAI, L.L.C. | Automated content moderation of posts, comments, listings, chat messages and uploaded images, to detect content that violates our Terms (e.g. CSAM, threats, hate speech, graphic violence). Processed under OpenAI's enterprise data-processing terms; OpenAI does not use API inputs to train its models and retains them only as long as necessary for abuse monitoring (typically up to 30 days) before deletion. See openai.com/enterprise-privacy. | USA |
| Replit Inc. | Application hosting, database, server infrastructure, deployment | USA |
| Google Cloud Storage (a Google LLC service) | Storage of images and files you upload | EU / USA |
| Apple, Google (push notification gateways) | Delivery of push notifications to your device | USA |
| Professional advisers (lawyers, accountants, auditors) | Legal, accounting and audit services | UK |
| Law enforcement, regulators, courts | Where required by valid legal process or to prevent serious harm | Various |
| Acquirer or successor entity | In connection with a corporate restructuring, sale, merger or acquisition | Varies |
Other users see only what you choose to make visible: your display name, posts, public listings, comments, event submissions and community memberships. Profile pictures are not supported. Direct messages are visible only to participants in that conversation. We do not sell, rent or trade your personal data to third parties for their own marketing purposes.
5. International transfers
Some of our processors are based outside the UK or EEA. Where personal data is transferred to a country that the UK Government has not deemed to provide an adequate level of data protection, we rely on appropriate safeguards, including the UK International Data Transfer Agreement, the EU Standard Contractual Clauses with the UK Addendum, or another lawful transfer mechanism. A copy of the relevant safeguards is available on request from info@hastati.ventures.
6. How long we keep it
| Category | Retention |
|---|---|
| Account data (profile, content, message history) | For as long as your account is active. |
| Account data after deletion | Minimal record (user ID, deletion timestamp, ban/suspension reason if any) for up to 90 days, then deleted, except where longer retention is required for fraud prevention or legal claims. |
| Marketplace transaction records | Up to 7 years from the transaction date, to meet UK accounting, tax (HMRC) and AML record-keeping requirements. |
| Server / request logs | Typically 30 days; up to 12 months where needed for security investigation. |
| Direct messages | Retained while either participant's account exists. Deleting your account removes your messages from your view; copies may remain in the recipient's view in line with how messaging works. |
| Backups | Backups are rotated on a rolling basis (typically up to 35 days) and any deleted data persists in backups until that backup expires. |
| Support correspondence | Up to 3 years from the last contact. |
| Records of consent (e.g. marketing opt-in) | Up to 3 years from withdrawal. |
7. Your rights
Subject to certain exceptions in law, you have the right to:
- Access the personal data we hold about you and receive a copy ("subject access request");
- Rectify inaccurate or incomplete data;
- Erase your data ("right to be forgotten") — note that we may need to retain some data to meet legal obligations or for the establishment, exercise or defence of legal claims;
- Restrict processing in certain circumstances;
- Object to processing based on legitimate interests, and to direct marketing at any time;
- Data portability: receive a copy of data you have provided in a structured, machine-readable format and transmit it to another controller;
- Withdraw consent at any time where we rely on consent (this does not affect the lawfulness of processing before withdrawal);
- Not be subject to a decision based solely on automated processing that produces legal or similarly significant effects on you (see section 11 for our current automated processing and how to request human review).
To exercise any of these rights, email info@hastati.ventures. We will verify your identity (typically by confirming you control the registered email address) and respond within one calendar month. We may extend this by a further two months for complex requests; we will let you know if so. There is no fee for reasonable requests; we may charge a reasonable fee or refuse manifestly unfounded or excessive requests.
You may also lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113 — we would, however, appreciate the chance to address your concerns first.
8. Children
The Service is not intended for and we do not knowingly collect personal data from children under 18. Our Cambridge-email gating is intended to ensure only verified adult members of the University use the Service, but it is not a substitute for our age requirement. If you believe a child has registered in breach of our Terms, please contact info@hastati.ventures and we will delete the account promptly.
9. Security and breach notification
We take security seriously and apply technical and organisational measures appropriate to the risk, including TLS in transit, encryption at rest for stored files, hashed passwords (handled by Clerk), least-privilege access controls, audit logging, regular dependency security scanning and regular code review. No system is 100% secure; you should choose a strong password, never share it, and notify us immediately at info@hastati.ventures if you suspect any compromise. In the event of a personal-data breach likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours where required and notify affected users without undue delay where the breach is likely to result in a high risk to them.
10. Cookies and analytics
The mobile application does not use browser cookies. Our public-facing legal and Stripe-return pages serve only essential session/security cookies as needed. We do not currently use third-party analytics or advertising SDKs in the application. If we adopt them in future, we will update this policy and seek consent where required by PECR or the UK GDPR.
11. Automated decision-making
We use limited automated processing to operate and protect the Service. This includes: rate limits and anti-abuse heuristics; Stripe's fraud-screening tools; and AI-powered content moderation (currently OpenAI's omni-moderation-latest API) which may automatically block individual submissions — posts, comments, listings, chat messages and uploaded images — that appear to violate our Terms. The data we send to the moderation service is the content of your submission itself (and, for image checks, the image bytes); we do not send your name, email or other profile data with it. The moderation service is best-effort: it does not catch everything, and on rare occasions it may flag content that is in fact acceptable. If the service is temporarily unavailable, submissions may be allowed through and reviewed later; account-level decisions (suspension, termination) are reviewed by a human.
We do not consider these to be decisions that produce legal or similarly significant effects on you within the meaning of Article 22 UK GDPR: a single blocked submission does not affect your account standing, your ability to use the Service or any of your legal rights, and you can edit and resubmit. Repeat or serious violations may lead to a human-reviewed account suspension under section 3 of our Terms.
If a moderation decision materially affects you, or if you believe a submission was wrongly blocked, contact us at info@hastati.ventures and a human will review it. You also have the right to express your point of view and to contest the decision under Article 22(3) UK GDPR.
12. Changes to this policy
We may update this policy from time to time. Material changes will be notified in-app and/or by email at least 14 days before they take effect. The date at the top of this policy shows the latest version.
13. Contact and complaints
Hastati Ventures LLC (Arizona file number 23890386)
11390 East Via Linda, Suite 101, Scottsdale, AZ 85259, USA
Privacy / data requests: info@hastati.ventures
General support: info@hastati.ventures
UK supervisory authority: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF — ico.org.uk — 0303 123 1113. As a non-UK controller subject to UK GDPR Article 3(2), we may be required under Article 27 to designate a UK Representative if we routinely process UK personal data on a large scale or for high-risk activities. We monitor our activity against this threshold and will appoint and disclose a UK Representative here if and when required.