Privacy Notice

Who we are

End Cancer is run by Josip Gajšak, Gergő Gulyás and David Simon, who are the joint controllers of the personal data described here. You can reach us at [email protected].

What we collect and why

We only collect what we need for each thing you do on the platform:

• Your account: email, a password (stored hashed by our authentication provider), your name, your role, and an optional LinkedIn URL — so you can sign in and we know who you are.
• Your profile / questionnaire: the answers you give about your organisation or work (for example company name, website, focus area, stage, country, team, and links you choose to share) — so we can review your profile and, for innovators, publish it once approved. The questionnaire also asks how you heard about us (and who referred you, if you tell us), so we understand where members come from, and lets you tick “Keep me posted” if you want event and update emails.
• Files you upload: your logo or profile photo, and documents such as a pitch deck — so they can appear on your profile. We convert images and remove location and camera data from them.
• Introduction requests: you send them from your account, and we record your name, email and account role with your message — so we can pass your request to the member you want to reach.
• Contact form: your name, email, the topic you choose and your message — so we can reply to you.
• Pitch applications: your video link, category, and any context you add — so we can run the pitch competition.
• Waitlist: if you joined our waitlist before launch, your email address and the stakeholder group you chose — so we could tell you when we launched. We no longer add new people to it.
• Technical data: essential cookies that keep you signed in; the basic information your browser sends whenever it loads a page (such as your IP address and browser type); security records — your IP address; your email address when you register, sign in, ask for a sign-in, confirmation or password-reset email, or send us a message through the contact form; and your account ID when you change your email or password, delete your account, send an introduction request, upload a file or open a document — used to stop abuse such as repeated login attempts; page-view statistics; and error reports with your identity, cookies and request contents removed — so the site works, stays secure, and we can fix problems. See “Cookies and similar technologies” below.

Our lawful bases

We rely on your consent for the waitlist, for event and update emails, for listing you publicly as a mentor, investor or corporate member if you tick that option, and for analytics and advertising cookies (you can withdraw it at any time); on performance of a contract to run your account and the services you sign up for, including reviewing your profile and, for innovators, publishing it once approved; and on our legitimate interests in keeping the platform secure and working, understanding how it is used and how people hear about us so we can improve it (including the cookieless measurement described under “Cookies and similar technologies”), passing introduction requests you ask us to send on to the member you want to reach, replying to messages you send us, and loading Google Tag Manager so our team can manage website tools without changing our code. You can object to any use that relies on our legitimate interests (see “Your rights”). We do not sell your data.

Who can see your data

Most of what you submit is private to you and our team. The exceptions:

• Approved innovator profiles (startups, scaleups, research projects and universities) appear in the catalogue in tiers — some fields are public, some are visible only to signed-in, approved investors, mentors and corporates, and some are never shown. You choose what goes into your profile, and you can ask us to unlist you at any time.
• Mentors, investors and corporate members are listed publicly only if you tick the listing option in your profile. You can untick it at any time. While you are listed, members can send you introduction requests through us; if you are not listed, they cannot.
• An uploaded logo or photo is public once your profile is listed. It is stored at a web address that anyone who has the address can open. If you untick the listing option, we move it to a new address, and if you delete your account, we delete it. Uploaded documents, such as a pitch deck, can be opened by approved investors, mentors and corporates, by our team, and, if you apply to pitch, by the mentors reviewing your application. Anyone who opens a document can download it.
• Introduction requests can be sent by members with an account to approved innovators, and to mentors, investors and corporate members who are listed. For now, innovators cannot send them to corporate members, and sponsors can neither send nor receive them. A request is emailed to the member you ask to reach, with our team copied. If your profile has not been approved yet, our team reads your request first and then passes it on.
• Pitch applications are reviewed by our team and may be shared with our mentor committee. Shortlisted applications, including your video link, may be shared with approved investors and corporates who help us choose the finalists. For now our team runs that selection outside the platform.

Where your data lives (the providers we use)

We use a small number of trusted providers to run the platform:

• Supabase — database, authentication and file storage, hosted in London, United Kingdom.
• Vercel — application hosting, and cookieless page-view statistics (Vercel Web Analytics).
• Cloudflare — domain name service, security and content delivery. Every request to the site passes through Cloudflare, including your IP address.
• Resend — sending email (for example account confirmations, notifications and introduction requests).
• Google Workspace — our team email. If you email us, your message is stored there.
• CookieScript — shows our cookie banner and remembers your choice.
• Sentry — error monitoring, configured to remove your identity, cookies and request contents before error reports are sent.
• Google — Google Tag Manager, which loads our website tools; Google Analytics, which shows us how people use the site; and Google’s advertising measurement, which shows us whether our online ads bring people to the site. When these load, your browser sends Google your IP address, basic browser information and the address of the page you are on. What else happens depends on your cookie choice — see “Cookies and similar technologies” below. See how Google uses information from sites that use its services.

Some of these providers are US companies or run global networks, so your data may be processed outside the UK and EU. Where that happens, they rely on recognised legal safeguards, such as the EU–US Data Privacy Framework or standard contractual clauses.

How long we keep it

• Account and profile: for as long as your account is open. You can delete your account yourself in Account settings, or ask us to. Deleting it removes your profile, your pitch applications, and the introduction requests you sent (including any sent from the same email address while signed out) or received.
• Files you upload: files you replace or remove are deleted within a day, unless your public page still shows them while your changes wait for our review, or a pitch application under review still uses them. Deleting your account deletes your files at once, though a copy saved by a browser can keep showing for up to an hour.
• Introduction requests: until you or the member you contacted deletes their account, or until you ask us to remove them. The emails we send about a request stay in the recipients’ inboxes.
• Pitch applications: while your account is open, and at least until the end of the event’s calendar year, because we use them to apply our once-a-year pitching rule — unless you delete your account sooner.
• Contact messages: while we deal with your message, and until you ask us to delete them. Deleting your account also deletes the messages sent from the email address the account has at that moment. Ask us about any you sent from another address.
• Waitlist: until you ask us to delete your email address.
• Security records: deleting your account also deletes the ones that carry your account ID or its email address, and our authentication provider’s audit log entries and sign-in flow records for your account. Records that hold only an IP address are not tied to your account, so they are not deleted with it. We do not yet delete those automatically; ask us and we will remove them.
• Analytics: cookies last as long as listed under “Cookies and similar technologies”. Google keeps Google Analytics data for the retention period set in our Google Analytics account.

Your rights

You can ask us to give you a copy of your data, correct it, delete it, export it, restrict how we use it, or object to our use of it where we rely on legitimate interests. Where we rely on your consent, you can withdraw it at any time; this does not affect anything we did before you withdrew it. You can also delete your account yourself in Account settings. To exercise any of these rights, email [email protected] — we will action it within 30 days (usually much sooner). You also have the right to complain to your local data protection authority.

Cookies and similar technologies

When you first visit, a banner asks whether you accept cookies. You can change your choice at any time with the cookie icon at the bottom of the page.

Temporarily: our cookie banner is switched off while we fix a problem with it. Until it is back, no banner is shown, no cookie choice is stored and no analytics or advertising cookies are set. The cookieless measurement described below continues.

Essential cookies are always on: the sign-in cookies set by our authentication provider, Supabase, which the platform cannot work without; a cookie of our own (ec-recovery), set only when you open a password-reset link, which keeps that sign-in out of your dashboard until you have chosen a new password and is deleted once you have (or after 400 days at most); and a CookieScript cookie (CookieScriptConsent) that remembers your cookie choice for 30 days.

Analytics and advertising cookies are set only if you click “Accept all”: Google Analytics cookies (_ga and _ga_F3BNL22R0D, kept for up to 400 days) that count visits and show how people move around the site, and a Google advertising cookie (_gcl_au, 90 days) that shows whether one of our online ads brought you here.

If you decline, or before you choose, no analytics or advertising cookies are set. Google Analytics and Google’s advertising measurement still send Google basic information about each page you view — the page address, your IP address and browser information — without cookies, which we use to count visits.

These Google tools are started only on our public information pages: the home page and the Pitch, Investors, Mentors, Partners and Catalogue pages. They are not started on any other page, including individual innovator profiles, sign-in, registration, password reset, your dashboard and our forms. They record which page you are on, not what you type.

Our own page-view statistics (Vercel Web Analytics) are cookieless and do not identify you.

Before we add any other tool that uses cookies or tracks you, we will update this notice first.

Children

The platform is intended for professionals and is not directed at anyone under 18. We do not knowingly collect data from children.

Changes to this notice

We will update this notice as the platform grows and post the new “last updated” date above. This notice is written in plain language and is not legal advice; we will formalise it further as we handle more real user data.