If you work at an investment firm, your professional details may be in Sherlock Deal without you having given them to us. This page tells you what we hold, where it came from, and what you can do about it. It is the notice required by Article 14 of the GDPR.
Exotictarget, Lda (NIPC 515206415), [registered office — to be confirmed], Portugal. We are the controller for the information described here. You can reach us about anything on this page at [privacy contact address — to be confirmed], or through the form linked at the bottom of this page, which works today.
For people who work at investment firms: name, job title, the firm, the country or city they are based in, and a link to their public professional profile.
Where our system has produced one, we also hold a short written summary of a person's professional focus — what they appear to invest in, how a founder might best approach them, and subjects to avoid. These summaries are generated automatically from public sources and are intended to help a founder decide whether and how to make an approach. We are naming this plainly because it is the most sensitive thing here and it would be misleading to file it under "public professional data": it is profiling in the sense of Article 4(4). It is not automated decision-making with legal effects (Article 22) — no decision about you is taken by the system; a person reads it and decides for themselves.
From the firm's own website, from publicly accessible professional profiles, and in some cases from a founder who told us about a person they had met. We record the source for each entry. Entries created before we started recording it carry a source marked as inferred rather than recorded — we would rather say we are unsure than state a source we cannot stand behind.
So that founders raising capital can find investors whose stated focus matches their company, and approach the right person rather than a generic address. Our lawful basis is legitimate interests (Article 6(1)(f)): the interest is in making a professional introduction market work. We hold only information connected to a person's professional role, never anything about their private life. You can object to this at any time, and you do not have to give a reason.
Founders using Sherlock Deal see the entries relevant to the investors they are considering. Our suppliers — hosting, email delivery and AI processing — handle it only to keep the service running, on our instructions, and cannot use it for their own purposes. The current list is at our suppliers. We do not sell it.
The database and authentication run in Supabase's eu-west-2 region (London, United Kingdom, covered by an adequacy decision). The application itself runs on Vercel in the United States, and our email and AI suppliers are US-based. Transfers outside the EEA therefore exist and rest on adequacy decisions or standard contractual clauses; each supplier and its region is listed on the suppliers page.
An entry with no activity — no delivery to a customer, no contact, no correction — is deleted after 24 months. Deleted, not archived.
You can ask us for a copy of what we hold about you, have it corrected, object to us holding it at all, or ask us to delete it. Objecting is enough — you do not have to give a reason, and we will stop.
If you object or ask for deletion, we keep the minimum needed to make it stick: a record that this person asked not to be included, so that the next time we gather information from the same public sources you are not added back. That record holds no profile — only enough to recognise and skip you.
We answer within one month. If a request is complex we may take up to two months more, and if that happens we will tell you within the first month and say why.
You can also complain to a supervisory authority. In Portugal that is the CNPD (cnpd.pt).
To exercise any of these
Use the data-rights form. It takes an email address and what you would like us to do; no account is needed.
There is deliberately no way to search this page for a name. Telling anyone who asks whether a given person is in our records would itself be a disclosure. Send the request and we will reply to you, by email, once we have confirmed who you are.