Privacy Policy

1. What this policy covers

Capital Compass (“we,” “us,” or “our”) operates the Capital Compass web application, which helps small business owners prepare lender-ready loan packages. This policy explains what personal information we collect, how we use it, and what rights you have over it. By using the service you agree to these practices.

2. Information we collect

We collect information you provide directly and information generated by your use of the service:

• Account information. Your email address, used only to authenticate you via a magic link. We do not collect passwords.
• Business and financial information. Business name, industry, revenue figures, loan parameters, expense data, and other information you enter while building your loan package. This data is sensitive — we treat it accordingly.
• Conversation content. Messages exchanged with the AI guide are stored so the session can be resumed and reviewed.
• Team and collaborator information. Email addresses of people you invite to your loan package and the role you assign them.
• Usage information. Pages visited, actions taken, and timestamps of activity within the app. We use this to operate and improve the service.
• Technical information. IP address, browser type, and device information collected automatically by our infrastructure providers.

3. How we use your information

• To operate and deliver the service, including generating your loan package documents.
• To authenticate your account and manage sessions securely.
• To send transactional emails (magic links, invitation emails). We do not send marketing email without your explicit opt-in.
• To improve the product through aggregated, de-identified usage analysis.
• To investigate and respond to security incidents, abuse, or violations of our Terms of Service.
• To comply with legal obligations.

We do not sell your personal information to third parties. We do not use your financial data for advertising targeting.

4. AI processing

The guided conversation feature is powered by OpenAI. When you interact with the AI guide, your messages and relevant session context are transmitted to OpenAI's API for processing. OpenAI's API does not use data submitted through the API to train its models. You can review OpenAI's privacy practices at openai.com/privacy.

We do not share your business name, EIN, or personally identifying financial details in system prompts beyond what is necessary for the guide to answer your questions in context.

5. Service providers and data storage

We use a small number of trusted service providers who process data on our behalf:

• Supabase— database and authentication. Your data is stored in Supabase's managed Postgres infrastructure. Data is encrypted at rest and in transit.
• Vercel — application hosting and edge infrastructure. Traffic is served over HTTPS.
• OpenAI — AI model API for the guided conversation feature (see Section 4).

All providers are contractually required to protect your data and are prohibited from using it for their own purposes beyond service delivery.

6. Collaborators and sharing

If you invite someone to your loan package, they will be able to view or edit the package according to the role you assign them. You control who has access and can remove collaborators at any time. Invitees will receive an email containing a link to accept the invitation.

7. Data retention

We retain your data for as long as your account is active. If you delete your account, we will delete or anonymize your personal information within 30 days, except where we are required to retain it by law (for example, billing records). Audit logs associated with your sessions are retained for 12 months and then purged.

8. Security

We use industry-standard security practices: HTTPS everywhere, encryption at rest, row-level security in the database so no user can access another's data, and access control policies enforced at the database layer. Despite these measures, no system is perfectly secure. If you discover a vulnerability, please report it to support@cptlcompass.com.

9. Your rights

You have the right to:

• Access the personal information we hold about you.
• Correct inaccurate information in your account.
• Delete your account and associated data.
• Export the data you have entered into your loan packages.
• Object to processing in certain circumstances.

To exercise any of these rights, email us at support@cptlcompass.com. We will respond within 30 days.

10. California residents (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act: the right to know what personal information we collect, the right to delete it, and the right to opt out of sale (we do not sell personal information). To exercise these rights, contact us at support@cptlcompass.com.

11. Children

Capital Compass is not directed at children under 18. We do not knowingly collect personal information from anyone under 18. If you believe we have inadvertently collected such information, contact us and we will delete it promptly.

12. Changes to this policy

We may update this policy as the product evolves. If we make a material change, we will notify you by email or by a prominent notice in the app at least 14 days before the change takes effect. The effective date at the top of this page reflects the most recent version.

13. Contact

Questions about this policy or your data? Email us at support@cptlcompass.com.