Privacy Policy

This Privacy Policy explains how Thunder Labs, Inc. and its affiliates (“Thunder”, “we”, “us”) collect, use, share and protect personal information. It covers thunder.vc and its subdomains, our email and event programs, our meetings and calls, and the relationship records we maintain to run our advisory business.

It also covers Thunder X Capital, LLC, the entity through which our advisory work is conducted.

It does not cover Finalis Securities LLC, the registered broker-dealer (member FINRA/SIPC) through which securities are offered. Finalis is a separate, unaffiliated entity with its own privacy policy and its own regulatory recordkeeping obligations. When a transaction moves to Finalis, their policy governs the information they hold.

We are a business-to-business firm. Almost everything we hold is professional contact and company information about people acting in a business capacity. We do not sell consumer products, we do not run a consumer app, and we do not take payment card details on this website.

1. Quick summary

2. Who we are and how to reach us

Controller: Thunder Labs, Inc.
Mailing address: 363 Lafayette St, Floor 4, New York, NY 10012
Contact: help@thunder.vc

If you are in the European Economic Area or the United Kingdom and want to contact us about data protection matters, write to help@thunder.vc and mark your message “EU/UK data protection request”.

3. Information you give us directly

3.1 Website forms

Every form on thunder.vc submits to our customer relationship management system. What we ask for depends on which form you use.

If you are a venture fund (GP): your name, work email, firm, number of portfolio companies, fund AUM, and anything you write in the free-text field.

If you are a founder or CEO: your name, work email, company, company website, annual revenue band, what you are trying to do (raise, sell, acquire, recapitalize, review options), your timing, and anything you write in the free-text field.

If you are a capital provider, LP, family office or angel: your name, work email, firm, investor type, typical check size, stage focus, geography focus, sector focus, preferred structures, exclusions, whether you confirm you invest in a professional or accredited capacity, and anything you write in the free-text field.

If you are asking for a dinner invitation: your name, work email, firm, how you describe yourself professionally, your website and LinkedIn, and which cities you would attend. If you tell us about dietary requirements or accessibility needs, we use that only to host you at that event and we delete it afterwards. In the United Kingdom and the European Economic Area, dietary and accessibility information can reveal health or religious beliefs, which are special categories of data. We only process it with your explicit consent, given by choosing to tell us.

On every form: whether you ticked the box consenting to marketing email, the page you submitted from, and the timestamp.

Each form makes clear which fields are required. If you leave optional fields blank, we do not receive them.

3.2 Booking a call

If you book time with a partner, the scheduling page is hosted by Calendly. It receives your name, email, the meeting you selected, and your time zone and availability.

3.3 Becoming a client or a counterparty in a transaction

If we begin work together, we receive substantially more. Depending on the engagement, that can include company financials, cap tables, customer and revenue data, board and shareholder information, and personal information about founders, executives, shareholders and their advisers. Where a transaction proceeds through Finalis Securities LLC, we also collect the identity and suitability information their compliance program requires, which can include government identification, source-of-funds information and accreditation evidence.

We treat this material as confidential. We share it only as described in Section 8, and in a transaction only under a non-disclosure agreement or at your instruction.

3.4 Email, calls, events and the podcast

If you email us, call us, attend a Thunder dinner, appear on the $100M Exits podcast, or connect with us on social media, we keep a record of that interaction and its substance.

4. Information we collect from other sources, and our relationship records

This is the section most privacy policies leave out, so we are being specific.

Thunder runs on a relationship graph: an internal record of who is who in venture, private equity, private credit and strategic acquisition, and who at Thunder knows them. It is how we answer the only question that matters in our work, which is who is genuinely relevant to a given transaction and who can make a warm introduction. Most people in it are professionals we have met, corresponded with, been introduced to, or identified as relevant to a client’s transaction.

Where the records come from:

• Our own business email and calendars. With the authorization of our team, we process metadata and content from Thunder staff mailboxes and calendars (who was in contact, when, on what subject) to keep our relationship history accurate. We do this only for Thunder’s own accounts, never anyone else’s.
• Our customer relationship management system, where our team logs contacts, companies and pipeline.
• Meeting notes and transcripts from calls we record, subject to Section 5.
• Licensed market data providers, which supply company, deal, ownership, financial and professional profile data.
• Public and publicly accessible sources, including company websites, professional networking profiles, regulatory filings, news coverage and web search.
• Introductions and referrals, where a mutual contact passes on your details.
• Our own platform, where you or your firm previously registered with a Thunder product.

What the records typically contain: name, business email, job title, employer, professional profile links, city or region, a profile photo where one is public, the firms and sectors you invest in or operate in, your stated criteria, our history of contact with you, and a classification of your professional role (for example venture investor, private equity buyer, limited partner, operator, adviser, banker).

How the classification works: some of it is what you told us. Some is what a data provider told us. Some is inferred by software, including AI models, from your title, employer and public profile. Inferred values are labeled as inferred internally and are corrected when we learn better. These are business classifications used for relevance ranking. They are not credit decisions, employment decisions, or decisions producing a legal effect on you, and they are always reviewed by a person before we act on them.

Why we are allowed to do this: in the United Kingdom and European Economic Area, we rely on legitimate interests (Article 6(1)(f)) to maintain professional relationship records, because a boutique advisory firm cannot function without knowing its own market and its own contacts, the data is limited to the professional sphere, and it is not used to make decisions about you as an individual. We have assessed the balance against your rights and we will share that assessment on request. Where we contact you by email for marketing, we rely on consent or the soft opt-in as local law requires.

Your control over it: you can ask what we hold, correct it, or ask us to stop. If you tell us to remove you, we will suppress your record and keep only the minimum needed to remember not to contact you again. See Section 12.

5. Meetings, calls and transcripts

We sometimes record and transcribe calls and video meetings so that our team has an accurate record and so we can produce summaries and follow-ups. Where we do:

• You will be told at the start of the meeting, by a notice in the meeting, a visible recording indicator, or a joined notetaking assistant.
• You can decline. Say so and we will stop the recording and take written notes instead. Declining does not affect how we work with you.
• Recordings and transcripts are stored in our transcription provider’s system and in our own records, are accessible to Thunder personnel who need them, and are subject to the retention rules in Section 10.
• We do not record meetings covertly. Some jurisdictions require the consent of every participant, and we treat that as the standard everywhere.

6. How we use information, and how we use AI

We use personal information to:

1. Respond to you, qualify an inquiry, and schedule and hold meetings.
2. Provide advisory services: run a transaction process, prepare materials, identify and approach counterparties, and manage the process to close.
3. Identify who is relevant to a client’s transaction and who can make a warm introduction, which is the core of what we do.
4. Maintain accurate records of our market and our relationships.
5. Invite you to dinners and events, and administer them.
6. Send you email about our work, our market view, deal flow and the podcast, where you have consented or where permitted.
7. Measure and improve the website and our marketing.
8. Keep our systems secure and prevent fraud and abuse.
9. Meet legal, regulatory, tax, accounting and recordkeeping obligations, and establish or defend legal claims.

AI and automated processing

We use artificial intelligence inside our own systems to summarize relationships and meetings, classify professional roles, rank relevance, draft introduction and outreach copy, and summarize public news about firms and companies.

What that means in practice:

• A person is always in the loop. AI output ranks, drafts and summarizes. It does not send, decide or commit. No AI system makes a decision about you that produces a legal or similarly significant effect.
• Enterprise services only. Our AI processing runs through enterprise cloud services under contracts that prohibit the provider from using our inputs or outputs to train their general models.
• We do not feed client confidential transaction material into consumer AI tools.
• AI output can be wrong. If we hold something about you that a model got wrong, tell us and we will correct it.

7. Cookies, analytics and advertising

What runs on thunder.vc

Strictly necessary. A small amount of browser storage that remembers your cookie choice (thunder_consent) and the first page you landed on (thunder_first_page_seen). These are set regardless of your choice because the site cannot honor your preference without them.

Analytics and advertising, only if you accept. Google Tag Manager, which loads Google Analytics and Google Ads tags, and marketing tags from our advertising platforms.

How your choice is handled

We use Google Consent Mode v2. Every storage category (analytics, advertising, advertising user data, advertising personalization) is set to denied before any tag loads, on every page, on every visit. Nothing measuring or advertising fires until you accept.

The banner offers “Reject non-essential” and “Accept analytics”. Your choice is stored in your browser and applied on every later visit. The Cookie settings link in the footer reopens the banner so you can change it at any time. Clearing your browser storage resets you to denied.

Preference signals

We treat a Global Privacy Control signal from your browser as a request to reject non-essential cookies and to opt out of targeted advertising, and we apply it without you needing to click anything. We do not currently respond to legacy “Do Not Track” headers, which no longer have an agreed meaning.

A note on advertising

Our advertising tags let ad platforms recognize a browser across sites. Under the California Consumer Privacy Act this can be “sharing for cross-context behavioral advertising”, and under other US state privacy laws it can be “targeted advertising”, even though no money changes hands. Rejecting non-essential cookies, or sending a Global Privacy Control signal, opts you out of this. We do not sell personal information for money, and we have never done so.

8. Who we share information with

We share personal information with:

Service providers who process it on our behalf, under contract, only on our instructions:

Finalis Securities LLC, where a transaction is conducted through them as broker-dealer. Finalis is a separate, unaffiliated entity, is an independent controller of what it receives, and applies its own privacy policy and FINRA recordkeeping requirements.

Counterparties, co-advisers and professional advisers in a transaction, meaning prospective buyers, investors, lenders, lawyers, accountants and diligence providers. In a live transaction this happens under a non-disclosure agreement and at the client’s direction.

Introduction recipients. The point of a warm introduction is that we tell someone who you are and why you are relevant. We do this in the ordinary course, in a business context, and only with information appropriate to that purpose. Tell us at any time if you do not want to be introduced.

Our professional advisers, including lawyers, accountants, auditors and insurers.

Authorities and in legal proceedings, where required by law, regulation, subpoena or court order, or to establish, exercise or defend legal claims.

An acquirer, if Thunder is acquired, merges, reorganizes, or transfers substantially all of its assets. Your information would move with the business, subject to this policy.

We do not disclose personal information to anyone else for their own independent marketing.

9. International transfers

We are a United States company. Our infrastructure runs in the United States and the European Union, and our providers operate globally. Personal information you give us will be processed in the United States and may be processed in any country where we or our providers operate.

Where we transfer personal information out of the United Kingdom or European Economic Area, we rely on the European Commission’s Standard Contractual Clauses, the UK Addendum or International Data Transfer Agreement, or an adequacy decision, together with supplementary measures where needed. Ask us at help@thunder.vc for details of the mechanism covering a specific transfer.

10. How long we keep information

We review and delete beyond this where nothing requires us to keep it.

11. Security

We protect information with encryption in transit and at rest, access controls limited to personnel who need the data, single sign-on with our corporate identity provider, network restrictions on our databases, credential rotation, logging, and vendor due diligence.

No system is perfectly secure, and we do not claim otherwise. If a breach affects your personal information and the law requires notification, we will notify you and the relevant regulator within the required time.

Report a suspected vulnerability or exposure to help@thunder.vc.

12. Your rights and how to use them

Depending on where you live, you may have the right to:

• Know and access what we hold about you, where we got it, and who we shared it with.
• Correct anything inaccurate or out of date.
• Delete what we hold, subject to exceptions where we must keep it.
• Port a copy in a machine-readable format.
• Object to processing based on legitimate interests, including profiling for relevance ranking.
• Restrict processing while a dispute is resolved.
• Withdraw consent at any time, without affecting what happened before.
• Opt out of targeted advertising, of any “sale” or “sharing”, and of profiling with legal or similarly significant effects.
• Not be discriminated against for exercising any of these rights. We will not deny you service, change what we charge, or reduce the quality of what we provide.

To exercise any of these, email help@thunder.vc. Say what you want and which email address or company we would know you by. We will verify your identity proportionately, usually by confirming control of the email address we hold, and respond within the time the applicable law allows, which is generally 30 days in the United States and one month under the UK and EU GDPR. Complex requests can take longer and we will tell you if so.

Authorized agents. You may use an authorized agent where state law allows. We will ask for proof of authorization.

Appeals. If we decline your request and you are in a US state with an appeal right (including Colorado, Connecticut, Virginia, Texas, Oregon and Montana), reply to our decision with “Appeal” in the subject line. We will review and respond, and if we still decline we will tell you how to contact your state Attorney General.

Complaints. You can complain to your data protection authority. In the United Kingdom that is the Information Commissioner’s Office (ico.org.uk). In the European Economic Area it is your national supervisory authority. We would appreciate the chance to resolve it first.

California “Shine the Light”. California residents may request details of personal information disclosed to third parties for their own direct marketing purposes. We do not make such disclosures, and we will confirm that in writing on request.

13. Categories of information under US state law

For the twelve months before the date of this policy, we collected the following categories, as those categories are defined by the California Consumer Privacy Act:

Sensitive personal information. We do not collect sensitive personal information for the purpose of inferring characteristics. The only sensitive categories we may hold are identity documentation and accreditation evidence in a regulated transaction, and dietary or accessibility needs you volunteer for an event.

Sale and sharing. We have not sold personal information for money. Our advertising cookies may constitute “sharing” or “targeted advertising” as described in Section 7, and the cookie banner and Global Privacy Control are the opt-out.

14. Children

thunder.vc is a business website intended for professionals. It is not directed at children, we do not knowingly collect personal information from anyone under 16, and we have no reason to hold any. If you believe a child has given us information, write to help@thunder.vc and we will delete it.

15. Other websites and services

Our site links to third-party services, including Finalis Securities LLC, FINRA BrokerCheck, our scheduling and CRM provider, the $100M Exits podcast, and social platforms. Once you follow a link, that service’s own privacy policy governs. We do not control those services and are not responsible for their practices.

16. Changes to this policy

We will update this policy when our practices, our providers or the law change. The current version is always at this URL with the effective date at the top. If a change materially affects your rights, we will give notice on the site and, where we have your address and the law requires it, by email before it takes effect.

17. Contact

All privacy questions, requests and security reports: help@thunder.vc

Thunder Labs, Inc.
363 Lafayette St, Floor 4, New York, NY 10012

Securities are offered through Finalis Securities LLC, member FINRA/SIPC. Thunder X Capital, LLC is not a registered broker-dealer, and Finalis Securities LLC and Thunder X Capital, LLC are separate, unaffiliated entities. Nothing in this policy is an offer or solicitation to buy or sell any security.