Privacy notice

Version v1-2026-08-06 · Cordero Management ApS · CVR 44895048, Copenhagen

The short version. If you send us an application, we use it to assess your company and to talk to you about the outcome. An AI produces the assessment; a person reviews it before any investor sees it. We keep it for 36 months. You can ask for a copy or ask us to delete it at any time, and we will.

Who is responsible

VCOS is operated by Cordero Management ApS (CVR 44895048), Copenhagen, Denmark. We are the data controller for the personal data described here. Contact: raul@corderomgmt.com.

What we collect, why, and for how long

Data	Purpose	Lawful basis	Retention
Your application — company details, problem, solution, traction, team, risks	Assess investment readiness and produce an explainable score	Consent	36 months
Your name and email	Tell you the outcome and next steps	Consent	36 months
Investor name, email, firm	Operate the investor portal and match deals to mandate	Contract	60 months
Investor mandate parameters	Compute founder–capital fit	Contract	60 months
Which deals an investor viewed, passed on, or asked for an intro to	Improve matching quality from recorded decisions	Legitimate interest	24 months
Assessments about your company	Evidence the reasoning behind a score, for audit	Legitimate interest	60 months
Audit log of agent actions	Demonstrate accountability and reconstruct decisions	Legal obligation	72 months

We do not collect data we have no stated purpose for. The table above is generated from the same policy record the software enforces — it is not a separate description of intent.

Automated assessment

Applications are assessed by AI agents running on Mistral, an EU provider. The assessment produces a score across five dimensions, an outcome-trajectory classification, and written reasoning for each.

Every output is labelled as a model inference, not a verified fact.
A person at VCOS reviews and releases feedback before it reaches you or an investor.
No investment decision is made automatically. Investors decide.
Where evidence is missing we record it as missing rather than scoring it as weakness.

If you disagree with an assessment, email us and a person will look at it.

Where your data lives

Hosted at Hetzner in Nuremberg, Germany. The database and application never leave the EU. Model inference runs on Mistral (France). Transactional email is sent via Resend. We do not transfer personal data outside the EU/EEA for these purposes.

Who sees it

Your application and its assessment may be shown to investors on the platform for the purpose of matching. Nothing is shared with an investor until a person at VCOS has reviewed it. We do not sell personal data and we do not use it for advertising.

Your rights

Access — a copy of everything we hold about you, in a machine-readable format.
Portability — the same, in a form you can take elsewhere.
Erasure — we delete your personal data and withdraw the associated consent.
Rectification — we correct anything inaccurate.
Withdraw consent — at any time, without affecting processing already carried out.
Object — to processing we base on legitimate interest.

Email raul@corderomgmt.com and we will respond within 30 days. You can also complain to the Danish Data Protection Agency (Datatilsynet).

One limitation, stated plainly. When we erase your data we redact your personal details from our records, but a copy of your own narrative text may still exist inside stored model output. We are fixing this. Until we have, our erasure is not yet complete, and we would rather tell you that than imply otherwise.

Changes

This notice is versioned. The version you consented to is recorded against your application. If we change it materially we will publish the new version here with its date.