Privacy Policy

Last updated: November 8, 2026

1. Who we are

CohortDeck is built by Mentornity and is developed and operated by Plademy Oy, a company registered in Finland (Business ID 3386328-3, Lapinlahdenkatu 16, 00180 Helsinki, Finland). In this policy, "we" and "us" mean Plademy Oy.

This policy covers the cohortdeck.com website, the early access list and the CohortDeck application. Mentornity's own products are covered by the Mentornity Privacy Policy.

2. Who is responsible for your data

Website and early access. Plademy Oy is the data controller for what you send us through cohortdeck.com, such as an early access request.

Program data in CohortDeck. When an accelerator, incubator or other organisation runs a program on CohortDeck, that organisation is the data controller for the program's data, including applications, judge scores and startup records. We process this data on the organisation's behalf and only on its instructions. If you applied to a program or were invited by one, contact that organisation first about your data. We will help it respond.

3. What we collect on this website

If you join early access, we receive what you type into the form:

• your name, work email, organisation and country;
• what kind of program you run, how many startups it supports a year and, if you tell us, which tools you use today;
• the page you sent the form from, and the campaign tags in its address (utm_source and utm_campaign) if you arrived from a link that has them.

To stop automated spam, the form uses Cloudflare Turnstile, which processes your IP address and browser signals when you start filling in the form. It is not used for anything else.

This website has no analytics, advertising pixels or social media trackers. Our web server does not keep a log of visits to cohortdeck.com. Fonts are served from our own server, so viewing the page does not contact Google or other third parties.

4. How we use early access requests

• to contact you about early access, set up your workspace and help you import your data;
• to understand which kinds of programs are interested, so we can plan what to build first.

We use your request because you asked us to contact you (steps at your request before a contract) and, for spam protection, on the basis of our legitimate interest in keeping the form usable. We only email you about CohortDeck early access. We do not add you to other newsletters unless you ask, and every email we send has a way to opt out.

5. What we process in the application

• Account data: name, email address, sign-in details (passwords are stored only as secure hashes), language and time zone.
• Program data: what your organisation and its applicants, founders, judges and partners add, such as applications, form answers, scores and comments, startup records, updates, files and messages.
• Founder workspace data: what founders add to their own workspace. Founders choose what their programs can see. Financial figures are shared with programs as ranges.
• Technical data: IP address, browser and device type, and error reports, used to run, secure and fix the Service.
• Connected services: if you connect a service such as Google, Airtable, Notion or Slack, the data needed for that connection to work.

We use this data only to provide and support the Service, send service emails (such as judge invitations and reminders), keep the Service secure, fix problems and meet our legal obligations.

6. What we do not do

• We do not sell personal data.
• We do not use program data for advertising or to market to applicants, founders or judges.
• We do not use your data to train AI models.

7. Where data is stored

CohortDeck is hosted in the European Union. The website, application, database and file storage run in Amazon Web Services' Frankfurt region in Germany. Some service providers below are based outside the EU, mainly in the United States. When data is transferred outside the EU, we rely on safeguards recognised by law, such as the EU Standard Contractual Clauses or the EU-US Data Privacy Framework.

8. Service providers

We share data only with providers that help us run CohortDeck, and only as much as they need. They may use it only to provide their service to us.

Before we turn on a feature that sends personal data to a provider not listed here, such as a new AI model provider, we will add it to this list.

9. How we protect data

All connections use HTTPS. Access to production systems is limited to authorised people. The database is backed up daily, and backups are encrypted and stored separately in the EU. No system is completely secure, and we keep improving our security as the Service grows. If a breach affects personal data, we will notify the affected organisations without undue delay and, where we are the controller, the supervisory authority and the people affected as the law requires.

10. How long we keep data

• Early access requests: until 24 months after our last contact with you, or sooner if you ask us to delete them.
• Program data: while the workspace is in use. When a workspace is closed, we delete or anonymise its data within 90 days unless the law requires us to keep it longer.
• Accounts: you can ask us to delete your account at any time. We anonymise your personal data within 30 days.
• Backups: overwritten after about one week, so deleted data also disappears from backups.

11. Your rights

Depending on where you live, you have the right to access, correct, delete, restrict or move your personal data, and to object to some uses of it. For program data, contact the organisation that runs the program first. For anything else, email privacy@mentornity.com. We reply within one month.

If you are in the European Economic Area, you can also complain to a data protection authority. Our lead authority is the Data Protection Ombudsman of Finland (tietosuoja.fi).

12. Children

CohortDeck is meant for organisations and adults running or joining startup programs. It is not directed at people under 16.

13. Cookies

This website does not set cookies of its own. See our Cookie Policy for details.

14. Changes to this policy

We may update this policy when the Service or the law changes. We will post the new version here with a new date. If a change is significant, we will also tell workspace administrators and people on the early access list by email.

15. Contact

Plademy Oy, Lapinlahdenkatu 16, 00180 Helsinki, Finland
Email: privacy@mentornity.com · Data Protection Officer: dpo@mentornity.com