Privacy Policy

Hemrock (hemrock.com) is a dba of Unstructured Ventures, LLC, a Delaware LLC ("Unstructured Ventures", "our," "us," "me," "I", or "we"). This Privacy Policy is to let you know what information we collect when you visit this site (the "website", "this site") and/or other services offered via our website (collectively, the "services"), why we collect it, and how it is used. The terms of use for this website is at Terms.

What information I collect

I collect limited personal information about who you are and where you are, as well as technical data about how you are accessing this site. This personal information can be deleted or edited by you at anytime, except for anonymized information that is impossible for us to delete. We work hard to keep your information private, however, because the Internet can never be completely secure, you give me your info at your own risk. When you put your private information on the Internet, it can be collected and used for others, and we are not responsible for keeping that information provate or secure. If I have a security breach, I will email you within 72 hours of identification of a breach.

Your rights to the data I collect about you

• We abide by the terms of California Consumer Privacy Act (CCPA) and the European Union's General Data Protection Regulation (GDPR), and apply the principles of transparency about how I collect and use data, and the right to access and delete your data, to all users.
• You can request access to and deletion of your personal information by emailing hello at hemrock.com or calling +1.646.770.0052. If you request your information under the right to access, it will be provided within 30 days, and will include the categories of data, sources, the purpose of collecting said data, and the specific pieces of data collected over the past 12 months.
• You may only make a verifiable consumer request for access or data portability twice within a 12 month period. The verifiable consumer request must provide sufficient information to allow us to reasonably verify you are the person whom we collected personal information, or an authorized representative, and describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.
• You will not be discriminated against if you exercise your rights to access and/or delete your data.
• I do not sell any personal information to any parties, and have not in the past 12 months.
• I engage third parties to perform functions and provide services to me, including hosting, email, product downloads and website analytics. I may share data with those services, but only to the extent necessary to perform those functions and services, and require those third parties to maintain the privacy and security of your personal information.

How this site collects and uses data

This site uses a few services to manage this site and its services:

• Purchases and downloads. You can buy directly on this site or through Gumroad. Direct purchases on this site are processed by Stripe (for cards) and PayPal (for PayPal payments). I never see or store your card number. Your payment details are tokenized and handled inside Stripe's and PayPal's PCI-compliant systems, and the only thing stored on my side is a record of the purchase itself: the products, the amount, your email, and any billing details you choose to provide for an invoice. Purchases made through Gumroad are processed by Gumroad, which keeps its own customer and order records and sends those customers their receipts and product emails; anything Gumroad collects is governed by its own privacy policy and isn't available to me beyond what you provided at purchase. You are not required to create an account to buy. I store records of paid purchases so I can offer you ongoing access to what you bought, and I can delete records of free transactions on request.
• User accounts. Accounts and sessions are handled by Supabase and displayed on this site, and I store your email and a record of the products you own in Supabase so you can access your downloads and receipts.
• Email and the mailing list. If you submit your email through a form on this site it is stored in Supabase. The mailing list is double opt-in, meaning you confirm your subscription before any newsletter is sent. Account and transactional emails (your sign-in code, receipts, invoices, and booking confirmations) are sent through Resend. Marketing emails and newsletters are sent through Resend, and every one carries a one-click unsubscribe; you can also contact me to be removed. Opting out of marketing never stops the transactional emails you're entitled to. If you purchased through Gumroad, your receipts and product emails for that purchase are sent by Gumroad, and you can manage those in your Gumroad settings. I do not sell or share your email address.
• Analytics. I use Fathom Analytics to understand the usage of this website. This data is collected in a GDPR-compliant way and I cannot access or use this information in any personally-identifiable way.
• Download tracking. When you access product downloads or Google Sheets links from your product page, we record the date, time, and an anonymized location (a one-way hash of your IP address) for your protection and for dispute resolution. Your download links are unique to you and tied to your account. We use this information to help verify legitimate access if there is a dispute about unauthorized sharing or account access. This data is stored in Supabase and is not shared with third parties except as needed to operate the service. You can contact me to request details of download access records associated with your account.
• Affiliate tracking. If you arrive via an affiliate link (a link containing ?ref=), I set a cookie (__Host-affiliate_ref) for 60 days so a purchase can be attributed to that affiliate if you buy. This is the only personally identifiable data I store via cookies on this site. If you buy through Gumroad, Gumroad may also set its own affiliate cookies under its policy, which I don't have access to. You can clear the cookie anytime in your browser settings.
• Ratings and reviews. Star ratings you submit on product pages are private and are not displayed publicly. If you choose to submit a written review along with your name, title, company, or profile link, that information may be displayed publicly on our website. By submitting a written review, you agree that your name and review text may be shown publicly. You can edit or delete your review at any time from your product page. Review data is stored in Supabase and is not shared with third parties except as needed to operate the service.

Services used to manage the site

I use a few services to manage this site and its services:

• Vercel (Vercel Inc.). Vercel hosts this website. For operation and maintenance it may process technical data such as your IP address and system logs that record interactions with the site. Place of processing is the US, and here is their Privacy Policy.
• Fathom Analytics (Conva Ventures Inc.). Fathom is a privacy-first analytics company, and is used by this site to collect data on the usage of this website. Here is their Privacy Policy. Here's a referral code to Fathom if you're interested in using them as well.
• Gumroad (Gumroad Inc.). Gumroad is an ecommerce service used for purchases made through Gumroad. Personal data includes email address and any information captured by Gumroad for the operation of their service. Place of processing is the US, and here is their Privacy Policy.
• Stripe (Stripe, Inc.). Stripe processes card payments made directly on this site. Card details are tokenized by Stripe and are never stored by me. Personal data includes your payment information and email. Place of processing is the US, and here is their Privacy Policy.
• PayPal (PayPal, Inc.). PayPal processes PayPal payments made directly on this site. Personal data includes your payment information and email. Place of processing is the US, and here is their Privacy Policy.
• Luma (Luma Labs, Inc.). Luma processes workshop registrations and payments via Stripe. Personal data includes your payment information and email. Place of processing is the US, and here is their Privacy Policy.
• Loom (Loom, Inc.). Loom is a video recording and hosting services and is used by this site to embed videos. Place of processing is the US, and here is their Privacy Policy.
• Calendly (Calendly LLC). Calendly is a calendar booking service, and is used by this website to schedule meetings. Place of processing is the US, and here is their Privacy Policy.
• X (X Corp.). X is a social network, and is used by this site only to embed posts and follow buttons. Place of processing is the US, and here is their Privacy Policy.
• YouTube (Google Inc.). YouTube is a video distribution website, and is used by this site only to embed videos. Place of processing is the US, and here is their Privacy Policy.
• Resend (Plus Five Five, Inc.). Resend is an email service, used to send transactional email such as sign-in codes, receipts, invoices, and booking confirmations. Personal data includes your email address. Place of processing is the US, and here is their Privacy Policy.
• Supabase (Supabase Inc.). Supabase is the managed database and authentication service for this site. It stores your account, your purchases and the products they entitle you to, mailing-list subscriptions, invoices and invoice payments, workshop registrations, reviews, and records of product downloads (including a one-way hash of your IP address). Place of processing is the US, and here is their Privacy Policy.

Model APIs and MCP

Beyond the model downloads, we run software and API services on our own infrastructure, and this surface is expanding. Today that includes a compute API and an MCP server for the model engines. The cap table, exit waterfall, and fund economics engines are callable over a REST API at www.hemrock.com/v1 and as MCP tools at mcp.hemrock.com. When you make a call, we process the inputs you send, such as cap table events, an exit valuation, or fund assumptions, to compute and return the result. We may log request metadata, such as the time, the endpoint, and your key's identifier, for security, rate limiting, and billing. API keys are created in your account settings, and only a one-way hash of a key is stored, so we never hold the raw token. These services run on the same infrastructure as the rest of this site (Vercel and Supabase), described above.

Portfolio Reporting Platform

We also offer the Portfolio Reporting Platform (the "Platform"), our open-source venture capital reporting software. You can self-host it, have us deploy it for you, or use it on our hosted service, and how your data is handled depends on which you choose.

Self-hosted deployments

If you deploy the Platform on your own infrastructure, we do not collect, store, access, or process any of your data. Your portfolio data, company information, metrics, user accounts, documents, and everything else reside entirely on your own systems. We have no access to your database, your API keys, or anything your instance processes. Your data is subject to the policies of the third-party services you choose to run it on, such as Supabase, Anthropic, OpenAI, OpenRouter, Vercel, Netlify, Postmark, and Mailgun.

Managed deployment

If we set up the Platform on your infrastructure, we receive access to your deployment during setup. After that, access is optional and provided only at your request, to help with maintenance, updates, or support. We will not access, use, or share your portfolio data except as necessary to fulfill those requests. Your data resides on your own infrastructure and accounts.

Managed hosting

We also offer a hosted option where your fund shares infrastructure with other funds. Your data is stored on shared resources, and the Platform enforces strict isolation between funds at the database level through row-level security, so no fund can reach another fund's data. We may access the shared infrastructure for maintenance and support, but will not access your portfolio data except as necessary to provide the service. Specific data-handling terms are set in a separate managed hosting agreement.

Demo

The demo at portfolio.hemrock.com contains fictitious sample data and requires no account. Demo sessions use Supabase authentication with anonymous tokens.

AI providers

The Platform sends data to an AI provider (Anthropic, OpenAI, or OpenRouter) to extract metrics, write summaries, run analysis, and draft letters. That data can include email content, company metrics, documents, and other portfolio information. Each provider has its own data-handling and privacy terms. On a self-hosted deployment you choose the provider and are responsible for understanding its practices.

Third-party services

The Platform integrates with third-party services, each with its own privacy policy: Supabase (database, authentication, and file storage), Vercel and Netlify (application hosting), Anthropic and OpenAI (AI processing), Postmark and Mailgun (inbound email), Gmail, Resend, Postmark, and Mailgun (outbound email), and Google Drive (optional file storage). Review the policies of any service you configure for your deployment.

Data security

The Platform includes role-based access controls, row-level security for fund-data isolation, encrypted storage of API keys, and authentication through Supabase Auth with optional multi-factor authentication. On a self-hosted deployment, the security of your infrastructure and configuration is your responsibility, and no system is completely secure.

Data retention and your rights

For self-hosted and managed deployments, retention is entirely under your control, and you can access, modify, or delete any data directly in your own database at any time. For managed hosting, retention is governed by the managed hosting agreement. The Platform is not directed at children under 18, and we do not knowingly collect their personal information. Questions about Platform data we can reach go to hello at hemrock.com, and we will respond within 30 days.

If you get to this site through another site or click to another site from this site, they might collect your personal info. We are not responsible for those privacy policies.

This policy was last updated July 24, 2026.

If you have questions, you can contact us:

hello at hemrock.com

Unstructured Ventures, LLC
Attn: Taylor Davidson
6360 Broad St., #5226, Pittsburgh, PA, 15206