The LPGP Data-Use Constitution

This document governs what LPGP may and may not do with data. It is not a privacy policy written by a vendor to protect the vendor. Every clause below is enforced somewhere in the codebase, and each enforcement point is listed in /CONSTITUTION.md in the public repository.

Any material change to this document requires 60 days' notice and gives every customer a right of termination, full export, and a pro-rata refund. Changes are versioned in /legal/constitution/ with a public changelog.

---

1. We do not sell, license, rent or share identifiable customer data.

Not to data vendors, not to GPs, not to LPs, not to affiliates, not in aggregate form that permits re-identification. There is no commercial arrangement under which your name, your firm's name, or your firm's activity is a product.

2. We do not compete with our customers.

LPGP will not operate as a placement agent, a broker, a secondaries intermediary, a fund-of-funds, an investment adviser, or a direct investor. We will not accept success fees, retainers, or carried interest on any transaction that touches the platform. We do not take a position on any fund on this platform.

3. Your pipeline is yours.

The funds you evaluate, your notes, your scores and your decisions are visible only to your own organization. LPGP staff cannot read them except on your written, per-incident request or where compelled by law, and every such access is logged and shown to you in your audit trail.

4. A GP never learns that a specific LP is looking at them.

Not through a notification, not through an analytics dashboard, not through a support conversation, not by inference from any number we display. A GP is told only that an allocator has their materials, never which one, and never how many below our disclosure threshold.

5. Aggregates are k-anonymous.

No statistic, count, benchmark or ranking is displayed unless it draws on at least five distinct organizations, and never where the composition of the cohort would allow an individual contributor to be identified. Where the threshold is not met, we show nothing rather than something noisy.

6. Peer references are structured, never free-text, and always attributed to no one.

Contributors are pseudonymous by design, and we do not hold a mapping we would be able to surrender casually. GPs have a structured right of reply and a documented dispute process.

7. We do not train models on your data, and neither do our subprocessors.

Model providers are engaged under zero-retention terms. Your documents are not used to improve any model, ours or anyone else's.

8. You can leave with everything.

Full structured export (JSON + CSV + original files) available on demand, self-service, at any time, on every plan including free. Deletion completes within 30 days across backups.

9. Data lives in the EU.

Primary storage and processing in the European Union. Any transfer outside is disclosed in the subprocessor register at lp.gp/subprocessors, which is versioned and publicly diffable.

10. We audit this and publish the result.

An annual independent review against these ten clauses, published in full including any findings. A breach of this constitution entitles any customer to immediate termination, full export, and a pro-rata refund.

---

FAQ — the honest limits

Clause 6 says you cannot deanonymize contributors. Is that literally true?

Not literally, and we would rather say so than overclaim. Peer references are stored against contributor_hash = HMAC(org_id ‖ gp_firm_id, PEPPER). There is no org_id column on the references table. PEPPER is held in a key management service with a separate access path, and is not present in the application database or in the application's environment.

The practical consequence: an attacker holding a full database dump cannot deanonymize a contributor at all. An attacker holding the database and the pepper can confirm a guess — "did Org X review Firm Y?" — but cannot enumerate contributors, because the hash input requires knowing the organization already. We consider confirm-a-guess an acceptable residual risk for the enforcement it buys (one reference per organization per firm). We do not claim it is zero.

Clause 5 says k=5. Where is that number?

K_ANON_THRESHOLD is a single constant in packages/shared/src/constants.ts, read inside security definer Postgres functions. It is not a check in the user interface, so it cannot be bypassed by calling the API directly. Changing it requires an architecture decision record and a constitution changelog entry.

Clause 4 — how can a GP not infer an LP from timing?

Claim notifications are delayed by a randomized 48–120 hour offset from ingest, rate-limited to one per firm per 90 days, and suppressed entirely when a single low-volume allocator is the only source. A GP who emails one family office and gets a notification twenty minutes later has been told who it was; the delay exists precisely to break that correlation.

Clause 2 forecloses a real business line. Why?

Because you cannot hold this trust asset and also broker. The obvious precedent in this market accumulated exactly this dataset and then used it to feed its own brokerage, and destroyed the trust required to hold it. This clause is the price of the peer signal, and we would rather pay it in public.