Standing is operated by Goalday Inc., doing business as Standing. This policy explains what data Standing collects, why, and what you can do about it. It is written to match what the product actually does — nothing more is collected than what's described here, and everything described here has a deletion path.
Account data. Your email address and name. If you sign in with LinkedIn, we also store your LinkedIn identifier, profile name, photo URL, and locale — we never store the LinkedIn access token, and we never post or read anything on LinkedIn.
Documents. The legal documents you upload, pick from Google Drive, or scan — and the structured data we extract from them: parties, dates, amounts, equity events, document types.
Cap-table data. Spreadsheets or Open Cap Table Format files you import, and the reconciliation results we derive.
Usage data. Pages visited, actions taken, device and browser info, IP address, and timestamps.
Each connection follows the same three-line contract, shown before you connect. In short:
Google Drive. We read only the files you pick — the picker grants file-by-file access. We keep the picked documents, same as an upload. We never browse your Drive.
Stripe (your revenue — planned). Read-only access to subscriptions, invoices, charges, and customers. We keep computed metrics and the observations behind them. We never move money and never write to your Stripe; access is revocable at any time.
Bank via Plaid (planned). Balances and transactions from accounts you connect. We keep cash metrics and categorized transactions. We never see your bank credentials and never initiate payments.
Mailbox (planned). If you connect your mailbox, we read message headers and text to detect business events — a hire, a signed agreement, a term sheet. We keep the detected events and message headers, never message bodies after processing, and never your mailbox. We never send mail as you.
You can scan documents without an account. Scan uploads are processed the same way as any document, kept for 7 days, and then permanently deleted — files, extracted data, everything — unless you create an account and claim them into your room.
We rely on (a) the contract to deliver the Service, (b) our legitimate interest in running and improving Standing, and (c) your consent for optional connections (Drive, Stripe, Plaid, mailbox).
Your documents and extracted data are private to your workspace. We share data only with the vendors that operate the Service, under contracts requiring them to protect it:
We do not sell your personal data, and we do not use your documents to train models — ours or anyone else's.
Data-room links, investor updates, and any future investor-facing disclosure happen only when you create them, to the people you name, and are revocable. One permanence rule worth knowing: an investor update you've sent, like any sent email, remains with its recipients; and if a verification snapshot is ever delivered to an investor at your request, that delivered copy is theirs — deleting your account removes our copy and yours, not theirs.
Document text is processed by large language models to extract structured information and classify document types. Prompts and responses are retained by the AI vendor for a limited period for abuse prevention, scoped to your workspace. Your content is not used to train models.
Documents and account data: life of your account. Free scans: 7 days unless claimed. Derived data (classifications, projections, reports) lives and dies with its source documents. Login codes expire in minutes; sessions in 7 days. After account deletion we retain only what financial-records and abuse-prevention law requires (for example, Stripe's record of past invoices).
Self-serve, today: export everything (one file, from Settings → Data & privacy) and delete everything (same page — immediate and final). You don't need to email anyone to leave.
EEA/UK residents have GDPR rights (access, correction, deletion, objection); California residents have CCPA rights — and we do not sell personal information, so there is nothing to opt out of. For anything the self-serve tools don't cover, use our contact form.
We use a session cookie to keep you signed in and local storage for preferences. No advertising or cross-site tracking cookies — which is why there's no cookie banner.
Encryption in transit and at rest, hashed session tokens, encrypted third-party tokens, rate-limited and lockout-protected logins, signed webhooks, revocable links. Details: security overview. Report issues via our contact form.
Standing is hosted on infrastructure in the United States. By using the Service you understand your data is processed there.
We may update this policy. Material changes will be announced via the Service or by email.
Questions about your data: use our contact form.