Privacy Policy

1. Scope

This policy applies to information we process about visitors, trial users, paying customers, and individuals who contact us through forms, email, or support channels.

If you use CapSignal on behalf of a company, you represent that you have authority to share company and team information with us and to bind that organization to this policy where applicable.

2. Information we collect

We collect information in three broad categories:

• Information you provide — name, email address, company name, role, fundraising stage, sector, raise amount, business description, deck or data-room uploads, investor lists, message templates, billing details submitted through our payment provider, and any content you send through onboarding, checkout, or support.
• Information collected automatically — IP address, browser type, device identifiers, pages viewed, referral URLs, UTM campaign parameters, session duration, scroll depth, button clicks, form interactions, and similar usage events. We may compile session summaries when you leave a page.
• Information from third parties — payment and subscription status from Stripe; email delivery events from our email provider; and, where configured, analytics signals from tools such as Google Tag Manager, Meta Pixel, or Microsoft Clarity.

3. How we use information

We use personal information to:

• Provide, operate, and improve the Service, including investor matching, outreach workflows, campaign analytics, and data-room features.
• Process subscriptions, free trials, refunds, and billing through Stripe.
• Respond to access requests and support inquiries.
• Send transactional messages (account confirmations, billing receipts, product updates you opt into).
• Monitor site performance, diagnose errors, understand marketing effectiveness, and prevent abuse.
• Comply with law, enforce our Terms of Service, and protect the rights and safety of CapSignal, our users, and others.

4. Legal bases (EEA, UK, and Switzerland)

Where GDPR or similar laws apply, we rely on: (a) performance of a contract when providing the Service you signed up for; (b) legitimate interests for analytics, security, and product improvement, balanced against your rights; (c) consent where required for non-essential cookies or marketing; and (d) legal obligation where we must retain or disclose data.

5. How we share information

We do not sell personal information. We do not share campaign data, investor contacts, or raise materials with third parties for their independent marketing.

We share information with service providers that help us run the Service, subject to contractual confidentiality and security obligations. Current categories include:

• Hosting and infrastructure (e.g., Vercel, cloud storage providers)
• Payment processing (Stripe)
• Email delivery and notifications (e.g., Resend)
• Analytics and advertising measurement (e.g., Google Tag Manager, Meta Pixel, Microsoft Clarity — only when enabled in your environment)
• Customer support and CRM tools we may use to respond to leads

6. Campaign and raise data

Fundraising data — including investor relationships, outreach sequences, reply tracking, and diligence files — is processed solely to deliver the Service on your behalf.

You control which investors receive outreach and which documents are shared. CapSignal team members may access campaign data only as needed for support, deliverability troubleshooting, or security review.

Upon account closure or a verified deletion request, we delete or anonymize campaign data within 30 days unless we must retain a limited subset for billing, legal, or dispute-resolution purposes.

7. Website analytics and session reports

On our marketing site, we log page views, navigation paths, scroll depth, CTA clicks, and related events in your browser session. When you leave a page, we may send an internal session summary email to our team so we can follow up on interest in the product.

Session reports may include landing page, referrer, UTM tags, pages visited, events triggered, session length, and browser user-agent. They do not include passwords or full payment card numbers.

You can limit some tracking through cookie settings (see our Cookie Policy) or browser controls. Essential cookies required for checkout and authentication may still be used.

8. Data retention

We retain account and campaign data while your subscription is active and for a reasonable period afterward to support exports, billing reconciliation, and legal obligations.

Marketing lead data from forms is retained until you ask us to delete it or it is no longer needed for the purpose collected.

Analytics and server logs are typically retained for 12–24 months unless a shorter period is required by law or internal policy.

9. Security

We use encryption in transit (TLS), encryption at rest for sensitive campaign data, access controls, and monitoring designed to protect your information. No method of transmission or storage is completely secure; please use a strong password and enable team access controls where available.

See our Security page for more detail on our technical and organizational measures.

10. Your rights and choices

Depending on where you live, you may have the right to:

• Access, correct, or delete personal information we hold about you
• Export data you provided through the Service
• Object to or restrict certain processing
• Withdraw consent where processing is consent-based
• Lodge a complaint with your local data protection authority

California residents may have additional rights under the CCPA/CPRA, including the right to know what categories of information we collect and to opt out of "sale" or "sharing" as defined by California law. CapSignal does not sell personal information.

Submit privacy requests to hello@getcapsignal.com. We may verify your identity before fulfilling a request.

11. International transfers

CapSignal is operated from the United States. If you access the Service from outside the U.S., your information may be transferred to, stored in, and processed in the U.S. and other countries where our providers operate.

Where required, we use appropriate safeguards such as Standard Contractual Clauses for transfers from the EEA or UK.

12. Children

The Service is intended for founders and business professionals. We do not knowingly collect personal information from anyone under 16. Contact us if you believe a child has provided information and we will delete it.

13. Changes to this policy

We may update this Privacy Policy from time to time. We will post the revised version on this page and update the "Last updated" date. Material changes may also be communicated by email or in-product notice where appropriate.