CapStack Privacy Policy
Last updated: October 16, 2026
This Privacy Policy explains how Cartooli Business Ventures Inc. ("CapStack," "we," "us"), [to be provided], collects, uses, and shares personal information in connection with CapStack App at https://app.capstack.space (the "Service"). The Service is a business tool for cap table and fund modeling. It is not directed to children under 18.
1. Two roles
- Account and business data. For data about our customers' users, such as sign-in email, billing contacts, and request handling, we decide how the data is used. This Policy covers that data.
- Customer Data in models. Models that customers upload or build can contain personal information about other people, such as shareholders, employees, option holders, investors, or limited partners. For that data, we act as a service provider / processor for our customer, as described in the Data Processing Addendum. If your information is in a customer's model, contact that customer directly about it.
2. Information we collect
| Category | Examples | Source |
|---|---|---|
| Account information | Work email address, name if provided, firm or workspace name, role, invitations | You or your workspace admin |
| Authentication data | One-time sign-in tokens, database session record, session cookie | Generated by the Service |
| Customer Data | Cap table and fund models stored as JSON, CSV/JSON imports, scenario inputs | You |
| Billing information | Plan, subscription status, Stripe customer and subscription ids. Card details are collected by Stripe, not stored in this application's database. | You and Stripe |
| Communications | Contact-form messages, and email replies received for the operator feedback desk | You |
| Technical data | Request handling by the hosting provider, including addresses and logs that provider keeps | The hosting provider |
Cookies. Sign-in uses a session cookie so the Service can recognize the browser session. The application dependencies do not include an advertising SDK or a product-analytics SDK.
3. How we use information
To provide, operate, and secure the Service. To send sign-in links, invite emails, and contact-form messages. To process checkout and manage subscriptions. To respond to support requests and product feedback. To apply rate limits on magic links, contact, and checkout. To comply with the law and enforce our Terms. This repository does not include a process that trains machine-learning models on Customer Data. We do not sell personal information in this application, and the application does not include a cross-context advertising integration.
4. How we share information
We share personal information with the providers this application calls, with other members of the same firm workspace, and when the law requires it. Contracting legal entities beyond the product names below are [to be provided].
| Provider | Purpose in this app | Data the app sends |
|---|---|---|
| Vercel | Application hosting | Requests the app handles, including data those requests contain |
| Neon | Managed Postgres database | Account data, workspace data, model JSON, billing identifiers stored by the app |
| Resend | Sending magic-link and invite email; delivering the contact form; operator feedback email | Email addresses and the text of those messages. Model JSON is not attached to those sends in this code. |
| Stripe | Checkout, subscription billing, customer portal, webhooks | Firm id, plan, price id, customer email, and Stripe customer id. Model JSON is not included in the Checkout Session this app creates. |
Stripe processes payment data under its own terms. Workspace members can see models in their firm. Investor links, while unrevoked, can open a read-only view of one model.
5. Storage and security
- Model JSON is stored in Neon Postgres as JSON. The application does not apply additional application-level encryption to it.
- The production site is served over HTTPS.
- A signed-in user's model and fund queries are limited to that user's firm. A model's fund id must belong to that firm.
- This product does not publish a SOC 2 or ISO 27001 report. We do not claim those certifications.
No method of storage or transmission is completely secure. Do not upload Social Security numbers or bank account numbers.
6. Data location
On October 16, 2026, the Neon project for this Service was in AWS us-east-1, and the production Vercel deployment that was checked ran in region iad1 (US East). Provider regions can change. Processing in other countries is [to be provided].
7. Retention
- How long account and Customer Data are kept after cancellation, after an unconverted trial, or after a deletion request is [to be provided].
- How long billing records are kept is [to be provided].
- Hosting-provider log retention is [to be provided].
- Neon point-in-time restore for this project, confirmed on October 16, 2026, is 6 hours (21,600 seconds). That is the Free plan maximum. The application does not operate a separate backup copy.
8. Your choices and rights
You can export firm models as JSON while signed in. The workspace UI does not currently include deleting a model. Depending on where you live, you may have rights to access, correct, delete, or receive a copy of personal information, and to opt out of sale or targeted advertising. This application does not include a sale or targeted-advertising integration. To make a request, email [to be provided]. If your information is in a customer's model, we will need that customer to handle the request.
9. Marketing emails
The application sends sign-in links, firm-invite emails, and contact-form delivery. It does not include a marketing-campaign sender. Whether any marketing email is sent outside this application is [to be provided].
10. International users
The Service is operated from the United States. This policy does not add EU, UK, or Swiss transfer terms.
11. Changes
We will post updates on this page and change the "Last updated" date.
12. Contact
Cartooli Business Ventures Inc., [to be provided], [to be provided].