Standing is operated by Goalday Inc., doing business as Standing. This policy explains what data Standing collects, why, and what you can do about it. It is written to match what the product actually does — nothing more is collected than what's described here, and everything described here has a deletion path.
Account data. You sign in with LinkedIn — it is the only way in. We store your email address, your LinkedIn identifier, profile name, photo URL, and locale. We never store the LinkedIn access token, and we never post or read anything on LinkedIn. When you sign in from a browser we don't recognise, we email a single-use code to that address to finish signing in — a second step behind LinkedIn, never a way in on its own.
People a founder invites. Investors and counsel open a founder's room by continuing with LinkedIn. We keep their LinkedIn identifier, name, photo URL and email against the invitation, so the founder sees who asked and who opened the room, plus a log of what was opened. If someone asks to see a room they weren't invited to, the founder sees the same name and photo with the request.
Messages to us. The contact page asks you to continue with LinkedIn, and your message reaches our inbox with your LinkedIn name and email attached so we can reply. The product does not store it.
Documents. The legal documents you upload, pick from Google Drive, or scan — and the structured data we extract from them: parties, dates, amounts, equity events, document types.
Cap-table data. Spreadsheets or Open Cap Table Format files you import, and the reconciliation results we derive.
Usage data. Pages visited, actions taken, device and browser info, IP address, and timestamps.
Each connection follows the same three-line contract, shown before you connect. In short:
Google Drive. We read only the files you pick — the picker grants file-by-file access. We keep the picked documents, same as an upload. We never browse your Drive.
Stripe. If you connect your Stripe account, we read your subscriptions and your charges and refunds, read-only. We ask Stripe for those two permissions and nothing else. From each subscription and charge we keep only what the numbers need: amounts, dates, status, plan and price. We never store your customers' names, emails, addresses or card details, and we keep each customer only as a one-way code that tells one customer from another. We never move money, never write to your Stripe, and you can disconnect at any time.
Your bank. If you connect a business bank account through Plaid, we read balances and transactions, read-only — for each transaction the date, the amount and its category. We keep those dated records and the cash metrics we fold out of them: cash on hand, monthly net burn, runway. We never see your bank login, we never move money, and we never store account or routing numbers. This connection is not switched on yet; it is listed here first, as every connection is.
Your mailbox. If you connect a mailbox — Outlook or Gmail — or import a mail export, we read message headers and text to detect business events — a hire, a signed agreement, a term sheet. We keep the detected events and the message headers; message bodies are discarded once the events are extracted. We never send mail as you.
We may add other connections over time. Each one is optional, is listed here before you can connect it, shows you what it reads and what we keep before you grant access, and is revocable from Settings.
The free scan is your room: you sign in with LinkedIn and your documents go straight into it, processed and kept like any other document, under your control until you delete them. Scans made without an account before October 2, 2026 that were never claimed have been permanently deleted.
We rely on (a) the contract to deliver the Service, (b) our legitimate interest in running and improving Standing, and (c) your consent for optional connections, such as Google Drive or Stripe.
Your documents and extracted data are private to your workspace. We share data only with the vendors that operate the Service, under contracts requiring them to protect it:
We do not sell your personal data, and we do not use your documents to train models — ours or anyone else's.
Data-room links, investor updates, and anything else you share happen only when you create them, to the people you name, and are revocable. One permanence rule worth knowing: anything already delivered to a recipient — a sent update, a downloaded file — is theirs. Deleting your account removes our copy and yours, not theirs.
Document text is processed by large language models to extract structured information and classify document types. Prompts and responses are retained by the AI provider for a limited period for abuse prevention, scoped to your workspace, under terms that prohibit training on your content. Your content is not used to train models.
Documents and account data: life of your account. Derived data (classifications, projections, reports) lives and dies with its source documents. One-time confirmation codes and sessions are short-lived and expire on their own; signing out ends a session at once. After account deletion we retain only what financial-records and abuse-prevention law requires (for example, Stripe's record of past invoices).
Self-serve, today: export everything (one file, from Settings → Data & privacy) and delete everything (same page — immediate and final). You don't need to email anyone to leave.
EEA/UK residents have GDPR rights (access, correction, deletion, objection); California residents have CCPA rights — and we do not sell personal information, so there is nothing to opt out of. For anything the self-serve tools don't cover, use our contact form.
We use a session cookie to keep you signed in and local storage for preferences. No advertising or cross-site tracking cookies — which is why there's no cookie banner.
Encryption in transit and at rest, hashed session tokens, encrypted third-party tokens, rate-limited and lockout-protected logins, signed webhooks, revocable links. Details: security overview. Report issues via our contact form.
Standing is hosted on infrastructure in the United States. By using the Service you understand your data is processed there.
We may update this policy. Material changes will be announced via the Service or by email.
Questions about your data: use our contact form.