CapStack Data Processing Addendum
Last updated: October 16, 2026
This Data Processing Addendum ("DPA") is part of the CapStack Terms of Service (the "Agreement") between Cartooli Business Ventures Inc., [to be provided], [to be provided] ("CapStack," "Processor") and the Customer ("Customer," "Controller"). It applies when CapStack processes Customer Personal Data on Customer's behalf. If this DPA and the Agreement conflict about the processing of personal data, this DPA controls.
1. Definitions
"Data Protection Laws" means U.S. federal and state privacy laws that apply to the processing, including the California Consumer Privacy Act as amended (CCPA) and the Virginia Consumer Data Protection Act (VCDPA) and similar state laws. "Customer Personal Data" means personal data inside Customer Data that CapStack processes on Customer's behalf. "Security Incident" means a confirmed breach of security that leads to unauthorized access to, or accidental or unlawful destruction, loss, alteration, or disclosure of, Customer Personal Data. "Subprocessor" means a third party that CapStack engages to process Customer Personal Data.
2. Roles and instructions
Customer is the controller (or business). CapStack is the processor (or service provider) for Customer Personal Data. CapStack will process Customer Personal Data to provide the Service as the application is built: storing models, computing scenarios in the modeler, exporting, and sending the account emails the product sends.
CapStack will not sell Customer Personal Data or combine this application with an advertising network. The application does not include a process that trains machine-learning models on Customer Data. Customer is responsible for having a lawful basis for the processing and for notices to people named in models.
3. Details of processing (Annex 1)
| Subject matter | Providing the CapStack cap table and fund modeling Service |
|---|---|
| Duration | Term of the Agreement plus the deletion period in Section 9 |
| Nature and purpose | Hosting, storing, displaying, exporting, and transmitting models and related workspace data. Scenario math in the modeler runs in the browser. |
| Data subjects | Customer's users; people named in Customer's models |
| Categories of data | Names, email addresses, roles, and the equity and fund fields Customer chooses to store in a model |
| Sensitive data | Not requested. Do not upload government ID numbers or financial account numbers. |
4. Confidentiality
People who operate the Service should be bound by confidentiality obligations. A written staff confidentiality program is [to be provided].
5. Security
Measures that are actually present in this application are listed in Annex 2. Customer model data is stored as JSON in Neon Postgres. This application does not add a separate encryption layer around that JSON. CapStack does not publish a security certification or a third-party audit attestation for this product, and it does not offer a service-level agreement.
6. Subprocessors
The current application uses the providers below. Their contracting legal entities are [to be provided]. Vendor DPAs are [to be provided].
| Subprocessor | Service | Data processed by this app | Location checked |
|---|---|---|---|
| Vercel | Application hosting | Requests the app handles | Production deployment region iad1 on October 16, 2026 |
| Neon | Managed Postgres | Stored account, workspace, and model JSON | AWS us-east-1 on October 16, 2026 |
| Resend | Sign-in, invite, contact, and operator feedback email | Email addresses and message text. Model JSON is not attached in these sends. | [to be provided] |
| Stripe | Checkout, subscriptions, customer portal, webhooks | Billing identifiers and customer email. The Checkout Session this app creates does not include model JSON. | [to be provided] |
Notice before a new subprocessor starts processing is [to be provided]. If a change cannot be resolved, Customer may stop using the Service and request the pro-rated refund described in the Refund Policy for discontinuation.
7. Assistance and data-subject requests
Send data-subject requests to [to be provided]. Customers can export models as JSON. The workspace UI does not currently include deleting a model.
8. Security incidents
CapStack will notify Customer after it becomes aware of a Security Incident. The notice window is [to be provided]. The notice will include the information then reasonably available. Notifying Customer is not an admission of fault.
9. Return and deletion
Customer may export JSON during the term, subject to the export route being available to a signed-in member. Deletion from active systems after termination is [to be provided]. Neon's point-in-time restore window for this project, confirmed on October 16, 2026, is 6 hours (21,600 seconds) on the Free plan.
10. Audits
CapStack has no third-party audit report to provide for this product. Written questions about the measures in Annex 2 can be sent to [to be provided].
11. International transfers
The regions checked on October 16, 2026 were AWS us-east-1 for Neon and iad1 for the production Vercel deployment. This DPA does not add EU, UK, or Swiss standard contractual clauses.
12. Liability and governing law
Each party's liability under this DPA is subject to the limitations in the Agreement. This DPA is governed by the laws of the State of Delaware. Disputes are subject to the exclusive venue of the state and federal courts in Delaware, as set out in the Agreement.
Annex 2: Security measures in this application
The following are present in the CapStack App repository and, where noted, were checked on the live project on October 16, 2026. This list does not describe vendor certifications or controls we did not verify.
- Sign-in is a one-time email link. The application does not use passwords.
- Model, fund, and export queries for a signed-in user are limited to that user's firm. A fund id on a model must be one of that firm's funds.
- Checkout and team invites require an admin or owner role. Creating or revoking an investor link requires an admin or owner role. The customer-portal route checks firm membership and does not also check that role.
- Invited users are not added to the firm until they accept. The invite token is stored only as a SHA-256 hash.
- Investor links are unguessable tokens stored only as SHA-256 hashes. Revoking a link stops the read-only model view and result export for that token. The modeler document is not available anonymously.
- Stripe webhooks are processed only after Stripe signature verification. Processed event ids are stored so a duplicate event is not applied again.
- A failed invoice or a past_due, unpaid, or incomplete_expired subscription sets the firm plan to past_due, which does not have paid write access.
- Magic-link sends, the contact form, and checkout are rate-limited.
- Responses send Content-Security-Policy, X-Frame-Options SAMEORIGIN, X-Content-Type-Options nosniff, Referrer-Policy, and a Permissions-Policy that disables camera, microphone, and geolocation. The modeler page still needs unsafe-inline so its existing inline scripts can run.
- Checkout stays disabled until an unchecked annual-renewal consent box is checked, and the checkout API accepts that request only from an admin or owner. The audit log stores the consent time, plan, and text version. The audit log also records plan changes from billing events, firm JSON exports, invites, and investor-link create and revoke.
- Application secrets are read from environment variables. The repository env example contains names only.
- Production traffic is served over HTTPS.
- Neon history retention for project capstack-app, read back on October 16, 2026, is 21,600 seconds (6 hours) on the Free plan. That is the point-in-time restore window. No other Neon project setting was changed for this document.
Signatures
If the parties sign this DPA separately: Cartooli Business Ventures Inc. Name / Title / Date: ____________. Customer Name / Title / Date: ____________.