Privacy Policy

A company or other organization using the service is the customer. For most cap table, stakeholder, governance, document, and portfolio records, the customer decides what information is entered, who may access it, and how it should be used. We process that Customer Data to provide the service.

We also process some information for our own operational purposes, such as account security, billing, service administration, fraud prevention, support, and legal compliance.

• Account and administrator information. Names, email addresses, Google account identifiers, organization memberships, roles, passkey credential metadata, TOTP enrollment metadata, email confirmation state, session records, IP addresses, and user agents.
• Company and cap table records. Organization names, issuer details, equity plans, stock classes, securities, grants, vesting schedules, transactions, stakeholder rosters, director and officer information, board and stockholder approvals, meetings, compliance tasks, fundraising records, exports, and import files.
• Stakeholder and signer information. Names, email addresses, stakeholder roles, security holdings, acceptance status, signature records, magic-link audit evidence, portfolio-link access records, and related communications.
• Sensitive tax and identity information. Where a customer chooses to use tax or identity workflows, the service may store tax identifiers, dates of birth, tax-form data, and related compliance records.
• Documents and generated records. Uploaded files, generated drafts, final documents, executed records, document hashes, timestamps, signature certificates, audit certificates, and document metadata.
• Billing information. Stripe customer IDs, subscription IDs, plan state, invoice/payment status, and billing-portal activity. Payment card details are handled by Stripe, not stored directly by CapDaddy.
• Communications and support. Emails we send or receive, support requests, delivery status, and operational notices.
• Technical information. Server logs, request metadata, error references, device/browser metadata, security events, and limited cookies described below.

We use a session cookie to keep each signed-in user signed in. The session cookie holds only a random value. We use short-lived cookies to make some sign-in steps safe, such as Google sign-in and passkey sign-in. We use a theme cookie to remember light or dark mode.

When you open a link that we email to you, or a link that your company sends to you, we set a link cookie. The link cookie holds the secret part of that link. This lets the page open without the secret in the address bar. The link cookie is HttpOnly, so scripts on the page cannot read it. We do not use the link cookie for tracking.

For a signing or acceptance link, we remove the link cookie when you sign, decline or accept. If you do not use the link, the link cookie lasts until the link expires. A view link is a portfolio, board portal, meeting, round summary or data room link. For a view link, the link cookie lasts until the link expires.

Each time you open the page or submit the form, we check the link again. A link that you already used, or that the company cancels, stops working at once.

Cloudflare can add its Web Analytics script to our pages. This script measures how fast a page loads. We do not use advertising cookies. We do not use third-party analytics for behavioral advertising.

• Provide, operate, secure, debug, and improve the service.
• Authenticate users, enforce roles, support passkeys and step-up checks, and prevent unauthorized access.
• Maintain cap table, governance, document, signature, compliance, import, export, and portfolio workflows.
• Send invitations, magic links, reminders, confirmations, notifications, billing notices, and support messages.
• Process subscriptions and billing through Stripe.
• Create audit logs, document hashes, final records, and security evidence needed for trust and compliance.
• Respond to support requests, investigate abuse, enforce terms, and comply with law.

We do not sell personal information. We also do not share personal information for cross-context behavioral advertising.

• Within a customer workspace. Customer administrators and authorized members can access records according to their role. Invited stakeholders, directors, stockholders, signers, and portfolio viewers can access the limited records made available to them.
• Service providers. We use providers for hosting and databases, payment processing, authentication, email delivery, bot protection, timestamping, logging, monitoring, and similar operations. Current or supported providers are Railway, Stripe, Google, Resend, Cloudflare, Timestamp authorities, and Observability and logging providers. What each one does is listed on our security page.
• Customer-directed exports and integrations. Customers may export or share records with their lawyers, accountants, investors, auditors, employees, service providers, or other recipients.
• Legal and safety reasons. We may disclose information if needed to comply with law, enforce agreements, protect rights or safety, investigate security issues, or respond to lawful requests.
• Business transactions. Information may be disclosed in connection with a merger, financing, acquisition, reorganization, or sale of assets, subject to appropriate confidentiality protections.

We use technical and organizational safeguards designed for sensitive business records, including role-based access, row-level tenant isolation, append-only audit history, passkey and step-up controls for sensitive actions, hashed tokens, immutable final-document controls, encryption for selected sensitive fields, and monitored operational logs. No system can be guaranteed perfectly secure, and customers are responsible for securing their own accounts, devices, email inboxes, and authorized users.

We retain information for as long as needed to provide the service, maintain company records, preserve audit integrity, comply with legal obligations, resolve disputes, enforce agreements, maintain backups, and support customer exports. Because the service is designed around corporate records, final documents, transaction history, signature evidence, and audit logs may be retained or made immutable even when other information can be corrected, deleted, or de-identified.

Depending on where you live and how you use the service, you may have rights to know, access, correct, delete, restrict, object to, or export personal information. You may also have the right not to be discriminated against for exercising privacy rights.

Because much of the data in the service belongs to a customer workspace, we may direct requests from stakeholders, employees, directors, investors, or other invited users to the relevant customer unless we are required to respond directly. To make a request, contact [email protected].

The service is operated from the United States. If you use it from outside the United States, information may be processed in the United States or other locations where we or our service providers operate.

The service is intended for business use and is not directed to children. We do not knowingly collect personal information from children under 13. If you believe a child provided personal information to the service, contact [email protected] so we can address it.

We may update this Privacy Policy from time to time. If changes are material, we will provide notice through the service, email, or another reasonable method. The date at the top shows when this policy was last updated.

Questions or requests about privacy can be sent to [email protected].