Privacy policy

Who we are, and what TLDRocket is

TLDRocket (tldrocket.com) is a directory and data platform for the AI industry, run by Brightbluebyte B.V. (trading as TLDRocket) (Chamber of Commerce KVK 81901755), the controller for the personal data described here. It tracks companies, investors, models, funding rounds, events and market data compiled from publicly available reporting, newsletters and company announcements, and links every development to its original source. We publish original research and structured facts, with links to evidence. We do not republish source articles, headlines or snippets. Reading is free. Companies can claim and maintain their own profile, buy paid listings and subscribe to funding alerts, as described below.

Profiles of people

Some profiles describe people who play a public role in the AI industry, compiled from public sources under our legitimate interest in reporting on that industry. Each such page explains where its data came from; you can object to, correct or remove yours at any time through the removal request form.

Our paid products — data exports, the API, paid listings and funding alerts — are company-level: they contain no person records or person fields, such as founders, executives or individual angel investors.

Visitors

Reading the site requires no account. We use no advertising and no tracking cookies. Our web server keeps standard access logs (IP address, user agent, requested page) for security purposes only; they are rotated and not used to profile anyone.

Analytics

We measure aggregate readership (page views, referrers, countries, browsers) with a self-hosted instance of Umami, running on our own server in the EU. It is cookieless: it sets no cookies and no identifiers in your browser, stores no IP addresses, and cannot follow you across websites. Those statistics are anonymous and never leave our server.

We also use Google Analytics to understand how readers find and move through the site. Unlike Umami, it sets cookies in your browser, assigns your device an identifier and sends that data to Google, which processes it as a third party and may store it outside the EU. It is used for audience measurement only — we do not run advertising, and we do not sell or share reader data. You can opt out with Google’s browser add-on or by blocking the tag in your browser.

It only runs if you allowed it: nothing from Google loads before you answer the consent question, refusing takes exactly one click, and your cookie settings can be changed or withdrawn at any moment — the same link sits in the footer of every page.

Cookies & local storage

Most of what TLDRocket stores in your browser is strictly necessary — the kind that EU ePrivacy rules exempt from consent because the site cannot function securely without it. The exception is Google Analytics, which sets measurement cookies as described above.

No advertising or profiling cookies are used: we run no ads, and reader data is never sold or shared for marketing. The analytics cookies above are the only non-essential ones, and blocking them costs you nothing on this site.

Search

When you use the site's search box, we log the search term, the number of results, your IP address and browser user agent, so the operator can see what people look for and improve coverage. These search logs are not linked to any account, are never sold or shared, and are automatically deleted after 90 days.

AI-generated content

TLDRocket uses artificial-intelligence systems, under human editorial oversight, to read the reporting we index and record its facts (companies, deals, events), and to write blog analyses, company-profile descriptions and the cover images that accompany them. Cover images are illustrative AI-generated visuals, not real photographs of actual events, places or products.

Company claims and profile edits

Someone who works at a company can claim its profile. A claim needs a work e-mail address at the company’s own domain — free-mail addresses are refused — and we verify it with a magic link: single-use, valid for 24 hours, and stored only as a hashed token together with the e-mail address and IP address it was requested from. Where a company has no verified website to match the domain against, an admin reviews the claim by hand. For a claim we store your name, work e-mail address, your role at the company and the IP address used, so we can tell a genuine claim from an impersonation. Once verified, you get a (non-admin) account holding your name and e-mail address, and you sign in with the same kind of magic link.

What you add to a profile — description, logo, links and up to three sectors — is published only after an admin has reviewed it, and is shown as “From the company”. Every decision is recorded in our audit log (who did what, and when). Legal basis: taking the steps you asked for (art. 6(1)(b) GDPR) and our legitimate interest in keeping the directory accurate and free of impersonation (art. 6(1)(f)).

Paid listings, alerts and payments

Paid research, company subscriptions and other paid products use Stripe for checkout, payment processing, receipts and billing management. The operator is the seller. Stripe handles the payment details you enter under its privacy policy. We send Stripe your account e-mail, billing-account name and internal purchase references. Stripe collects your billing address and business tax ID when applicable. We retain customer, checkout, invoice, subscription and payment references, e-mail, amounts, currency, payment status, and the workspace or company to which your purchase applies. We do not store full card numbers, card security codes or raw Stripe webhook payloads. Billing access is restricted to the current workspace owner, verified company owners, or the account holder for individual services. We use these records to fulfil and manage purchases and meet applicable recordkeeping obligations. Older payment-provider records remain subject to their retention period. Analytics, where consented, do not receive your e-mail address or payment credentials.

Funding alerts and follows

Funding alerts are sent only after double opt-in: you enter your e-mail address, we send a confirmation link — valid for 48 hours and usable once — and nothing is sent until you click it, also when you already receive our newsletter. With each alert we store your e-mail address, the filters you chose (sectors, stages, headquarters countries, minimum amount, frequency), when and from which IP address you signed up and confirmed, which funding rounds we sent you, and when. Whether you get the free or the paid plan is looked up from your alerts subscription for the same e-mail address. Every alert e-mail has a one-click unsubscribe link, for one alert or all of them, and you can change or delete alerts any time from the manage link in each e-mail. An alert you unsubscribe from, or never confirm, is deleted 30 days later together with its send history. Legal basis: your consent (art. 6(1)(a) GDPR) and, for the paid plan, the contract (art. 6(1)(b)). Alerts contain company-level data only, never data about people.

Following a company or topic on the site works with the same double opt-in and is tied to your newsletter subscription.

Removal and correction requests

The removal request form lets anyone — a person, a company or a rights holder — ask us to remove or correct a page or data, without an account. We store your name, e-mail address, what the request is about, your reason and the IP address used (against abuse), and record how we handled it. Requests about personal data are answered within one month.

Newsletter

If you subscribe to the newsletter we store your email address, your confirmation (double opt-in, including the IP address used to subscribe), and the optional profile answers you give (role, industry, topic interests) — used only to send and tailor the briefing. We never sell or share the list. Every email contains an unsubscribe link; unsubscribing stops all sending, and you can request full deletion of your data at the address below.

Accounts

Readers need no account. Accounts exist for the operator’s editors and for verified company representatives who manage a claimed profile. Session cookies are used for those logins.

Google user data (Gmail)

The operator can connect a Google (Gmail) mailbox to TLDRocket via Google OAuth so the site can ingest email newsletters. When connected:

• TLDRocket accesses the mailbox over IMAP solely to read unread messages from the specific newsletter senders configured by the operator.
• The subject and body of those newsletter emails are stored to extract the stories they contain and generate summaries. No other mail is read, stored, or modified beyond marking processed newsletters as read.
• OAuth tokens are stored encrypted and are used only to access the mailbox as described. They can be revoked at any time on the Mailbox settings page or at myaccount.google.com/permissions.
• Google user data is never sold, never used for advertising, and never transferred to third parties except as described under “Third-party processing” below.

TLDRocket's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Third-party processing

To analyse the reporting we index, the text of ingested articles and newsletters is sent to the API of an AI model provider (OpenAI, or Anthropic for features configured to use its models), processed under that provider’s commercial API terms, which exclude training on our data. That text contains no reader, customer or subscriber data. Payments run through Stripe as described above. E-mail is delivered through our e-mail sending provider. If you add the briefing to Slack, Slack delivers it to the channel you chose; we keep the encrypted delivery address and the workspace and channel names.

Retention and deletion

• Search logs and e-mail delivery logs: 90 days.
• Newsletter, alert and follow subscriptions: until you unsubscribe; we then keep only what is needed not to e-mail you again, and delete everything on request.
• Company claims and verification records: while the claim or account is active, and 12 months after it ends. Sign-in and verification links expire after a short time and can be used only once.
• Audit log of moderation and editorial decisions: 2 years.
• Orders and subscription records: 7 years, the period Dutch tax law requires for business records.
• Removal requests: 2 years after we resolved them, as the record of how we handled them.
• Stored person records from the former people profiles: unpublished, until deleted (see “Profiles of people”).
• Ingested articles and the data we extracted from them are retained to power the archive. Disconnecting the Gmail mailbox deletes its OAuth tokens immediately.

You can ask for access to, correction or deletion of your data, restrict or object to its use, or take a copy of it, through the removal request form or the address below. You may also complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens.

Changes and contact

Material changes to this policy will be posted on this page with an updated date. Questions or requests: contact@tldrocket.com, or use the removal request form.

Business workspaces and company subscriptions

Research subscriptions provide access to reports, monitoring, team seats and exports within the allowance shown at checkout. The workspace owner manages invitations and billing. Monthly and annual subscriptions renew until cancelled; access continues through a paid cancellation period. A downgrade may reduce seats, watchlists and exports. Contact us if an allowance or payment appears incorrect.

Company Profile Pro and Featured subscriptions are promotional services. Company submissions are moderated and labelled as company-supplied information. Sponsored placement rotates and does not change independent research or rankings. We do not promise traffic, leads, investment returns or a particular search position.

Workspace names, memberships, watchlists and export usage are stored to provide the service. Watchlist emails go to the verified workspace owner and can be stopped using the link in each email. Team invitations expire after seven days. Demo enquiry details are shared only with the verified company owner after the sender consents; they are retained for up to 180 days. Business access requests are retained for up to 180 days. Request correction or deletion using the contact or removal form.