Privacy

Effective: 2026-09-05

What this covers

This policy covers PASO LABS LLC ("Paso", "we"), the site at bypaso.com, the founder portal, and the materials and guides we publish. It applies to site visitors, prospective clients, clients and the people they authorize. The service is for founders and their teams and is not directed to children.

Where you have a signed engagement letter or master services agreement with Paso, that agreement governs how we handle your materials and prevails over this policy where the two differ.

What we collect

Identity and access.: Your name, email address and company name. Sign-in is by a link sent to your email; we do not store passwords.
Materials you submit.: Decks, documents and text you send us for assessment or during an engagement. After the text of a deck submitted through our screening form has been extracted, we attempt to remove the deck from storage, and a weekly sweep retries any removal that failed; the extracted text is kept. Files you upload inside your portal, and documents you send us during an engagement, are kept with your engagement.
Portal activity.: What you write and upload inside your portal, and the messages you exchange with us there.
Website interactions.: Pages viewed, referrer, country, browser and operating system, counted without cookies. We use Vercel Web Analytics for this, only on our public pages; nothing is collected on your founder pages or admin pages, and links are stripped of their tokens and query strings before anything is sent.
Error monitoring.: In production we use Sentry. A session replay is captured only when an error occurs, and access tokens are removed before anything is sent.
Correspondence.: Email we exchange with you, including sign-in links and notifications, is sent through Resend.
Billing.: We do not collect payment card information on the site. Fees are invoiced under your engagement letter.

We do not run advertising and we do not use third-party advertising cookies.

Cookies

We set first-party cookies to keep you signed in and to keep your session secure. They are marked secure and are not readable by scripts. Our analytics sets no cookies. We set no third-party cookies; video on our pages uses YouTube's no-cookie player.

Who reads your materials

Our engine extracts and organizes the text of what you submit, using an AI service from Anthropic. Under that provider's commercial terms, your content is not used to train its models by default.

A person reads what you send through our screening form. During an engagement, the people working on it have access to the materials you send, and we use what you submit only as reasonably necessary to perform our services, or as you permit in writing.

When we disclose information

To the providers that run Paso,: as needed to operate the service: Vercel (hosting), Supabase (database and file storage), Resend (email), Anthropic (AI processing), Sentry (error monitoring), Vercel Web Analytics (page counts), YouTube through its no-cookie embed (video on our pages, click to play), and Lark and Google Calendar (scheduling).
Where we see a fit,: we may, at our discretion, introduce you to investors. Introductions are never promised. We share materials with investors only with your approval for that purpose.
Anonymized, non-attributable patterns and learnings: from engagements we use to refine our methods, frameworks and tools, without disclosing your confidential information.
When required by law.: Paso is a United States company. We disclose data to a government authority only when compelled by valid legal process.
If Paso is acquired: or merges with another company, we notify you before your personal information becomes subject to a different privacy policy.

We do not disclose your materials to any other third party without your written consent.

Your rights

You can ask us to tell you what personal information we hold about you, to correct it, to delete it, or to give you a copy. Write to info@bypaso.com.

We answer within 30 days.

We may ask you to confirm your identity first. Deleting the data the service needs may end your access to the service; we say so before we act. Some information is kept after a deletion request where the law requires it, for example invoices.

How we secure your data

Everything between your browser and us travels over HTTPS. Our database and file storage are encrypted at rest by our provider. Sign-in uses one-time links, and sessions live in cookies marked secure and unreadable by scripts. Details are on our Security page.

If we learn of a security incident that affects your data, we notify you.

How long we keep data

Materials you submit, and what we write about them: for the life of your engagement and for twelve months after it ends.

Invoices and contracts: seven years.

Sign-in sessions: seven days for internal accounts; thirty days for investor, member, participant and ecosystem-contact access; ninety days for board and report-viewer access.

Aggregated and de-identified information: retained.

Where your data is held

Our database, file storage and analytics are held in the United States. If you use the service from elsewhere, your information is transferred to and held in the United States.

Changes and questions

Changes are posted on this page with a new effective date.

Questions about this policy or about your data go to info@bypaso.com.

Adapted from the 37signals open-source policies, CC BY 4.0.