Privacy Policy

What does this Privacy Policy cover?

This Privacy Policy covers our treatment of personally identifiable information ("Personal Information") that we gather when you are accessing or using our Services, but not to the practices of companies we don't own or control, or people that we don't manage. We gather various types of Personal Information from our users, as explained in more detail below, and we use this Personal Information internally in connection with our Services, including to personalize, provide, and improve our services, to allow you to set up a user account and profile, to contact you and allow other users to contact you, to fulfill your requests for certain products and services, and to analyze how you use the Services. In certain cases, we may also share some Personal Information with third parties, but only as described below.

We do not knowingly collect or solicit personal information from anyone under the age of 13. If you are under 13, please do not attempt to register for the Services or send any personal information about yourself to us. If we learn that we have collected personal information from a child under age 13, we will delete that information as quickly as possible. If you believe that a child under 13 may have provided us personal information, please contact us at support@totemvc.com.

Our role in handling Personal Information

When we process Personal Information within Customer Data to provide the Services on a customer's behalf, we act as a processor or subprocessor under the applicable customer agreement and documented instructions.

When we determine how and why Personal Information is used to manage our own business relationships—for example, account administration, billing, and business communications—we act as a controller.

If your Personal Information was provided by a Totem customer, please direct privacy requests to that organization. We assist customers in responding to these requests. You may also contact support@totemvc.com, and we will help route your request appropriately.

Will Totem ever change this Privacy Policy?

We're constantly trying to improve our Services, so we may need to change this Privacy Policy from time to time as well, but we will alert you to changes by placing a notice at totemvc.com, by sending you an email, and/or by some other means. Please note that if you've opted not to receive legal notice emails from us (or you haven't provided us with your email address), those legal notices will still govern your use of the Services, and you are still responsible for reading and understanding them. If you use the Services after any changes to the Privacy Policy have been posted, that means you agree to all of the changes.

What Information does Totem Collect?

Information You Provide to Us

We receive and store any information you knowingly provide to us. For example, through the registration process and/or through your account settings, we may collect Personal Information such as your name, email address, employer, photo, job title, phone number, and third party account credentials (for example, your login credentials for Gmail, Outlook, or other third party sites). If you provide your third party account credentials to us, you understand some content and/or information in those accounts ("Third Party Account Information") will be transmitted into your account with us, and that Third Party Account Information transmitted to our Services is covered by this Privacy Policy; for example, if you link your Outlook or Gmail to your Totem account, certain information from those third party accounts will be transmitted to and displayed within your Totem account. Third Party Account Information may also include read-only access to your calendar, and explicitly forwarded emails to our system.

We also collect information you provide about a fund manager's funds and investments ("Fund Information"), including investment details, fund performance, limited partners, cap tables, financial performance, and company contacts. Fund Information is Customer Data and may also contain Personal Information. Where it does, both the Customer Data protections and the Personal Information provisions of this Privacy Policy apply. Certain information may be required to register with us or use particular features.

If you connect your own meeting-notes account, we receive the transcripts, notes, and related meeting information you authorize that provider to send to Totem. Totem also uses Granola to record, transcribe, and summarize meetings conducted by Totem. Meeting information may include what participants say, including participants who are not Totem users. When you record meetings or share meeting information with the Services, you are responsible for providing any notices and obtaining any consents required by applicable law.

We may communicate with you if you've provided us the means to do so. For example, if you've given us your email address, we may email you about your use of the Services. If you do not want to receive communications from us, please indicate your preference by sending us an email at support@totemvc.com.

Information Collected Automatically

Whenever you interact with our Services, we automatically receive and record information on our server logs from your browser or device, which may include your IP address, geolocation data, device identification, "cookie" information, the type of browser and/or device you're using to access our Services, and the page or feature you requested. "Cookies" are identifiers we transfer to your browser or device that allow us to recognize your browser or device and tell us how and when pages and features in our Services are visited and by how many people. You may be able to change the preferences on your browser or device to prevent or limit your device's acceptance of cookies, but this may prevent you from taking advantage of some of our features.

To understand how the Services are used and how they perform, we use Amazon CloudWatch RUM, a monitoring service provided by Amazon Web Services, our hosting provider. It records information such as the pages you view within the Services, page load performance, and errors your browser encounters. We use this information to operate, troubleshoot, and improve the Services—for example, to learn how often a particular feature is used or which pages are slow to load.

When you send communications to your investors or other contacts through the Services, those emails may contain a small tracking pixel that tells us, and you, whether and when each email was delivered and opened. We use this information only to show delivery and engagement status to the sender.

If you click on a link to a third party website or service, a third party may also transmit cookies to you. This Privacy Policy does not cover the use of cookies by any third parties, and we aren't responsible for their privacy policies and practices.

Do Not Track

Your browser may offer you a "Do Not Track" option, which allows you to signal to operators of websites and web applications and services that you do not wish such operators to track certain of your online activities over time and across different websites. Because there is no common industry standard for responding to these signals, our Services do not currently respond to Do Not Track requests.

How does Totem use Customer Data and Usage Data?

"Customer Data" means content you upload, enter, or connect to the Services, including fund and portfolio records, documents, email contents and attachments, and meeting recordings, transcripts, and notes. It also includes information derived from that content, such as extracted financial data and summaries.

"Usage Data" means technical information about use and performance of the Services, such as feature-use counts, event timestamps, page load times, error rates, and browser or device information. Usage Data excludes Customer Data. Customer Data captured in a technical log remains Customer Data. Usage Data may contain Personal Information and is subject to the applicable protections in this Privacy Policy. Account and billing information is described separately under the information we collect.

We do not use Customer Data for AI training or combine it across customers to create benchmarks or aggregated insights for Totem, our partners, or other customers. These restrictions also apply to deidentified versions of Customer Data and to service providers processing it on our behalf.

We may analyze and aggregate Customer Data at your direction to provide reports, summaries, and other features for your own use. We may use and aggregate Usage Data to operate, secure, troubleshoot, and improve the Services.

How does Totem use artificial intelligence?

Some features of the Services use AI models provided by our sub processors (listed below) to read and analyze the content you bring into the Services—for example, to extract data from documents and financial statements, summarize emails and meetings, and answer questions about your portfolio. To provide these features, content such as uploaded documents, Fund Information, emails, and meeting content is sent to those providers for processing on our behalf.

We do not use your content to train AI models, and we use AI providers under terms that do not permit them to train their models on your content.

Will Totem Share Any of the Personal Information it Receives?

We do not rent or sell your Personal Information in personally identifiable form to anyone. We may share your Personal Information with third parties as described in this section:

Usage Data

We may share aggregated Usage Data with service providers that help us operate, secure, troubleshoot, and improve the Services, solely for those purposes on our behalf. This information excludes Customer Data and is not shared in a manner that identifies you as an individual. We do not provide deidentified Customer Data or aggregated insights derived from it to partners for their own use.

Affiliated Services

In certain situations, businesses or third party websites we're affiliated with may provide services to you through or in connection with the Services (either alone or jointly with us). You can recognize when an affiliated business is associated with such a transaction or service, and we will share your Personal Information with that affiliated business only to the extent that it is related to such transaction or service. One such service may include the ability for you to automatically transmit Third Party Account Information to your Services profile or to automatically transmit information in your Services profile to your third party account; for example, information may be regularly and automatically transferred to and from you Outlook account and your Services Account as a result of your use of the Services. We have no control over the policies and practices of third party websites or businesses as to privacy or anything else, so if you choose to take part in any transaction or service relating to an affiliated website or business, please review all such business' or websites' policies.

Tools and Integrations You Connect

You may choose to connect your own tools to your Totem account. For example, you may connect an AI assistant such as Claude to the Services through the Model Context Protocol (MCP), retrieve information from your Totem account into your own Microsoft Excel or Google Sheets environment, import transcripts and meeting notes from your own Fireflies or Granola account, or build automated workflows using a service such as Zapier. When you do, Totem shares the information you authorize with that tool, or receives the information that tool sends to us, at your direction.

These tools are selected, configured, and managed by you or your organization under your own agreements with their providers. They are not sub processors that Totem engages, and the provider's own terms and privacy policy govern how it handles information once it receives it. You can disconnect these tools at any time.

Agents

We employ other companies and people to perform tasks on our behalf and need to share your information with them to provide products or services to you; for example, we may use a payment processing company to receive and process your credit card transactions for us. The service providers that process customer data on our behalf are listed under "Sub Processors" below. Our agents may use the Personal Information we share with them only as necessary to assist us. Service providers processing Customer Data on our behalf remain subject to the Customer Data restrictions described in this Privacy Policy.

User Profiles and Submissions

Certain user profile information, including your name, employer, job title, photo, location, and certain content that such user has uploaded to the Services, may be displayed to other users to facilitate user interaction within the Services or address your request for our services. Your account privacy settings may allow you to limit the other users who can see the Personal Information in your user profile and/or what information in your user profile is visible to others. Please remember that any content you upload to your user profile, along with any Personal Information or content that you voluntarily disclose online in a manner other users can view (for example, by other users within your organization) becomes available to those other users, and can be collected and used by them.

Business Transfers

We may choose to buy or sell assets, and may share and/or transfer customer information in connection with the evaluation of and entry into such transactions. Also, if we (or our assets) are acquired, or if we go out of business, enter bankruptcy, or go through some other change of control, Personal Information could be one of the assets transferred to or acquired by a third party.

Protection of Totem and Others

We reserve the right to access, read, preserve, and disclose any information that we believe is necessary to comply with law or court order (including lawful requests by public authorities to meet national security or law enforcement requirements); enforce or apply our Terms of Service and other agreements; or protect the rights, property, or safety of Totem, our employees, our users, or others.

Is Personal Information about me secure?

Your account is protected by a password for your privacy and security. You must prevent unauthorized access to your account and Personal Information by selecting and protecting your password appropriately and limiting access to your computer or device and browser by signing off after you have finished accessing your account.

We maintain an information security program designed to protect the Personal Information, Third Party Account Information, and Fund Information we hold. Among other safeguards, customer data is encrypted at rest (AES-256) and in transit over public networks (TLS); access to customer data is restricted to personnel with a business need and requires authentication, and multi-factor authentication is enforced for production systems.

We notify affected customers, individuals, and regulators of security incidents or personal-data breaches as required by applicable law and our contractual commitments, without undue delay. To report a suspected security issue, please contact us at security@totemvc.com.

We endeavor to protect the privacy of your account and other Personal Information we hold in our records, but unfortunately, we cannot guarantee complete security. Unauthorized entry or use, hardware or software failure, and other factors, may compromise the security of user information at any time.

How long does Totem keep my information?

We retain Personal Information only for as long as we have a legitimate business purpose for it, or as needed to meet legal, regulatory, or contractual requirements. When information is no longer needed, we take steps to delete or de-identify it. How long we keep particular information depends on what it is and why we hold it; for example, customer data is kept while your account is active, while system logs, backups, and records held by our sub processors follow their own retention periods. Technical logs that exclude Customer Data follow their own retention schedules. Customer Data contained in logs remains subject to the Customer Data deletion requirements.

Following termination of your contract, we delete your customer account and Customer Data from active systems within 60 days, except where retention is required by law. Residual copies in backups expire within our documented backup retention period and are kept beyond normal use until they expire. If a backup is restored, we reapply prior deletions before returning the restored data to normal use. Any retained Customer Data remains subject to the protections in this Privacy Policy.

We will also delete your Personal Information in response to a verified request, unless we have a legitimate business interest or legal obligation to retain it. Information subject to a legal hold may be retained for as long as that hold requires.

What Personal Information can I access?

Through your account, you may access, and, in some cases, edit or delete the following information you've provided to us:

• Name
• Employer
• Job title
• Photo
• Email address
• Mailing address
• Phone number

The information you can view, update, and delete may change as the Services change. If you have any questions about viewing or updating information we have on file about you, please contact us at support@totemvc.com. Under California Civil Code Sections 1798.83-1798.84, California residents are entitled to contact us to prevent disclosure of Personal Information to third parties for such third parties' direct marketing purposes; in order to submit such a request, please contact us at support@totemvc.com.

Your privacy rights

Depending on your location and applicable law, you may have rights to access and obtain a copy of your Personal Information; correct inaccurate information; request deletion; restrict or object to processing; and receive information in a portable format. You may also have rights to opt out of certain processing, including sale, targeted advertising, or certain profiling, and to limit certain uses of sensitive personal information.

Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of earlier processing. You may also have the right to appeal a denied request or lodge a complaint with the relevant privacy regulator.

To exercise your rights, contact support@totemvc.com. We may need to verify your identity and, where applicable, an authorized agent's authority. We respond within the time required by applicable law, subject to applicable exceptions, and do not unlawfully discriminate against you for exercising your rights.

For Personal Information we process on a customer's behalf, we assist that customer in handling your request as described above.

Transfers of Personal Data

Totem is based in the United States, where the Services are hosted and operated. Personal Information may also be processed in other countries where our service providers operate. Those countries may have data protection laws that differ from those in your location. The protections described in this Privacy Policy continue to apply to information we process.

Contact support@totemvc.com for information about international transfers and the safeguards applicable to your information.

What choices do I have?

You can always opt not to disclose information to us, but keep in mind some information may be needed to register with us or to take advantage of some of our features. You may be able to add, update, or delete information as explained above. When you update information, however, we may maintain a copy of the unrevised information in our records. You may request deletion of your account by emailing us at support@totemvc.com. Some information may remain in our records after your deletion of such information from your account, subject to the retention practices described in this Privacy Policy. Our restrictions on using Customer Data for AI training and cross-customer insights continue to apply after you update or delete information or close your account.

Sub Processors

Totem uses the following sub processors to provide the Services. This list does not include tools that you or your organization connect to the Services yourselves (see "Tools and Integrations You Connect" above).

• Amazon Web Services – cloud hosting, infrastructure, backups, and usage and performance analytics (Amazon CloudWatch RUM)
• MongoDB – database services
• Aiven – managed caching
• Serverless – deployment tooling and deployment history
• GitHub – source code hosting and deployment workflows
• Uploadcare – file upload processing and document storage
• Imgix – image processing and delivery
• Postmark – sending and receiving email, including email content and attachments
• OpenAI – AI-powered document analysis, data extraction, and summarization
• Google (Gemini) – AI-powered document analysis, data extraction, and summarization
• Google Workspace – business email, customer communications, and document storage and collaboration
• Granola – recording, transcription, and summarization of meetings conducted by Totem
• Diffbot – company information and news retrieval using company website URLs
• Calendly – scheduling meetings with Totem
• Stripe – payment processing
• Sequence – billing and invoicing

What if I have questions about this policy?

If you have any questions or concerns regarding our privacy policies, please send us a detailed message to support@totemvc.com, and we will try to resolve your concerns.