How we collect, use, and protect personal data.

This policy applies to (a) individuals working at organizations that purchase or trial 4invest, (b) clients and investors who access a portal one of those organizations has invited them to, and (c) anyone who interacts with 4invest's public websites, sales calls, or marketing channels.

Where an organization uses 4invest to host its own client data, the organization is the controller of that data and 4invest is the processor. The terms of that relationship are in the Data Processing Addendum.

Account data: name, work email, role, organization, locale, and the workspace settings the user configures.

Usage data: deal records, document metadata, approval history, payment milestones, and audit log entries the user generates inside the workspace.

Communication data: messages exchanged with sales, support, and onboarding, plus survey responses where provided voluntarily.

Technical data: IP address, browser metadata, device type, and session telemetry needed for security and reliability.

To operate the product (authentication, workspace state, audit trail), to provide support, to send service notices, to defend against abuse, to improve reliability, and to comply with applicable law.

We do not sell personal data. We do not use client-portal visitor data to target advertising. We do not train external AI models on customer workspace content; AI features that touch customer data run on contracted infrastructure under the DPA.

For organization users we rely on contract (Article 6(1)(b) GDPR) and legitimate interests for security and improvement.

For client-portal visitors we rely on the inviting organization's lawful basis as controller, plus our own legitimate interests as processor for service security.

For marketing communications we rely on consent with a clear opt-out in every message.

Workspaces can be hosted in the EU (Frankfurt), the GCC (Bahrain), the US, Canada, Singapore, or Sydney depending on the region selected by the organization. Default hosting for EU customers is in the EU.

When data leaves the customer's home region for service operations (for example, support tickets handled by a global team), we rely on Standard Contractual Clauses, the UK International Data Transfer Addendum, and equivalent mechanisms required by Singapore PDPA, Canadian PIPEDA, and APAC frameworks.

Workspace content is retained for as long as the organization remains a customer, plus an export window of 30 days after termination. Audit logs are retained for the longer of seven years or the period required by local real-estate regulation.

Marketing data is retained until the contact opts out or two years of inactivity, whichever comes first.

Depending on your jurisdiction you may have the right to access, correct, port, restrict, or erase your personal data, and to object to certain processing. EU/UK and California residents have these rights by default; we extend equivalent rights to all visitors where local law allows.

To exercise a right, email privacy@4invest.co. For workspace content held on behalf of an organization, requests are routed to that organization as controller.

4invest by AgencyX · Limassol, Cyprus · privacy@4invest.co

EU/UK supervisory authorities: you may complain to the regulator in your country. For most users, that is the data-protection authority of your habitual residence.