Privacy Policy

Version 1.2 · Effective 25 September 2026

Capradix LLC, an Illinois limited liability company ("Capradix," "we," or "us"), operates the website at capradix.com (the "Site") and the Capradix software platform, including its investor portal (together with the Site, the "Service"). This Privacy Policy (this "Policy") describes the personal information Capradix collects in connection with the Service, the purposes for which it is used, the circumstances in which it is disclosed, and the rights and choices available to individuals. This Policy is incorporated by reference into the Capradix Terms of Service (the "Terms"). Capitalized terms not defined in this Policy have the meanings given in the Terms. The technical and organizational measures Capradix applies to personal information are described in its Security Policy.

1. Scope; Roles of the Parties

1.1 Customer Personal Data. The Service is provided to organizations such as angel groups, venture funds, and similar investment organizations (each, a "Customer") under a written agreement. Personal information that a Customer or its Authorized Users enter into or upload to the Service, including information relating to the Customer's investors, their investment entities, and personnel of the companies in which the Customer invests ("Customer Personal Data"), is processed by Capradix solely on behalf of and in accordance with the documented instructions of the Customer. With respect to Customer Personal Data, the Customer is the controller (or, under applicable U.S. state privacy law, the business) and Capradix is a processor (or service provider). The Customer determines what Customer Personal Data is entered, which Authorized Users may access it, and when it is exported or deleted.

1.2 Capradix-Controlled Data. Capradix determines the purposes and means of processing only for the limited categories of personal information described in Sections 2.1, 2.4, and 2.5 ("Capradix-Controlled Data"), which it collects to administer user accounts, secure the Service, and respond to communications.

1.3 Requests Relating to Customer Personal Data. Individuals seeking to exercise rights with respect to Customer Personal Data, including rights of access, correction, deletion, or portability, should direct their request to the relevant Customer. Capradix will assist the Customer in responding to such requests to the extent required by its agreement with the Customer and by applicable law, and may refer requests received directly to the Customer.

2. Personal Information Collected

2.1 Account Information. For each Authorized User, Capradix maintains a name, sign-in email address, role designation, and a one-way cryptographic hash of the user's password. Capradix also maintains time-limited tokens issued for account invitations and password resets, the date and version of the Terms most recently accepted by the user, and the user's notification preferences.

2.2 Customer Personal Data Relating to Investors. A Customer may record, with respect to an investor or an individual associated with an investor: contact information, including email address, telephone number, and postal address; the legal name, type, and taxpayer identification number of each entity through which the individual invests; the investments, capital contributions, and distributions attributed to those entities; and, where the Customer elects to collect such information, date of birth, gender, and race or ethnicity. A Customer may additionally record free-text notes, values in fields the Customer defines, and documents, including tax workpapers, that identify an individual or entity. Gender and race or ethnicity are collected by certain Customers for the purpose of reporting on the composition of their membership and of the founders they support; such information constitutes sensitive personal information under certain privacy laws. It is entered by the Customer and not by Capradix, is encrypted at rest, and is not used for automated decision-making or profiling.

2.3 Customer Personal Data Relating to Portfolio Company Personnel. A Customer may record the name, title, contact information, and, where the Customer elects to collect such information, gender and race or ethnicity of founders and executives of the companies in which the Customer invests. Where a Customer enables automatic portfolio updates, the Service also receives the updates those companies send to the Customer's update address, which may name or describe other individuals, such as a company's employees, customers, or people it asks to be introduced to.

2.4 Technical Information. When an individual accesses the Service, Capradix's servers record the individual's IP address, browser type, the pages requested, and the date and time of each request in standard server logs. If the Service encounters an error, Capradix's error-monitoring provider receives the error type, the request path, and a stack trace; this provider is configured to exclude personal information from the data it receives. The authenticated portion of the Service does not employ analytics services, advertising technologies, tag managers, or third-party scripts. The public pages of the Site load typefaces from Google Fonts, and Google receives the IP address of a visitor to those pages in the course of serving them.

2.5 Communications. If an individual corresponds with Capradix, Capradix retains the correspondence and its response.

3. Cookies and Similar Technologies

The Service uses only the following cookies: a session cookie that maintains an authenticated session; a persistent cookie that maintains the session across browser restarts where the user has elected the "remember me" option; and a cookie used to protect forms against cross-site request forgery. Capradix does not use advertising or analytics cookies and does not engage in cross-site tracking. Because the Service does not track individuals across third-party websites or services, it does not alter its behavior in response to browser "Do Not Track" signals.

4. Purposes of Processing

Capradix processes personal information for the following purposes:

to provide, operate, and maintain the Service, including to authenticate Authorized Users, to display to each Authorized User the records the Customer has authorized that user to access, and to compute the figures the Service presents;
to transmit communications generated by the Service, including account invitations, password resets, security and account notices, and notifications the Authorized User has enabled;
to protect the security and integrity of the Service, including to detect and limit credential-guessing attempts, to investigate suspected misuse, and to respond to security incidents;
to provide support to Customers and to respond to inquiries;
to comply with applicable law, legal process, and governmental requests, and to establish, exercise, or defend legal claims and enforce Capradix's agreements; and
to analyze and improve the Service using de-identified, aggregated data from which no Customer, individual, or portfolio company can reasonably be identified.

Capradix does not sell personal information, does not share personal information for purposes of cross-context behavioral advertising, and does not use Customer Personal Data or other personal information to develop or train artificial intelligence or machine learning models.

5. Disclosure of Personal Information

Capradix discloses personal information only as follows:

To the Customer. Customer Personal Data, together with contact and entity information that an Authorized User maintains in the Service, is accessible to the Customer that invited that user. Administrators of a Customer may access all records of that Customer's organization; Authorized Users in the investor role may access only records relating to their own investor account.
To Sub-processors. Capradix engages third-party service providers to host and operate the Service on its behalf. Each such provider, its purpose, and the location in which it processes data are identified in the Security Policy, and each is bound by written contract to process personal information solely for the purpose of providing its services to Capradix. Capradix provides advance notice to Customers of any addition or replacement of a sub-processor in accordance with its data processing agreement.
To the Document-Reading Provider. The Service includes a feature by which an administrator of a Customer may submit a document already uploaded to the Service — such as an investment agreement, a capitalization table, an operating agreement, or a schedule of investors — to be read, so that the facts it states are proposed for the administrator's review. When, and only when, an administrator elects to read a document, the full contents of that document are transmitted to Anthropic, PBC, in the United States, which operates the language model that performs the reading, and Anthropic returns the facts it identified. Anthropic is engaged as a sub-processor under written terms that prohibit it from using the document contents to train or improve its models and limit its retention of them to a short period for the purpose of detecting misuse, after which they are deleted; the current retention period is stated in the Security Policy. The facts returned are held in the Service as a proposal until the administrator confirms or discards them, and no record is created or changed on the basis of a reading without the administrator's confirmation. No uploaded document is transmitted for reading automatically or on upload. The one automatic reading is of portfolio updates: where a Customer enables automatic portfolio updates, each email received at the Customer's update address, with its attachments, is filed in the Service as a document and transmitted to Anthropic to be read on receipt, and the same confirmation requirement applies to the facts it returns.
As Required by Law. Capradix may disclose personal information where it reasonably believes disclosure is required by applicable law, regulation, legal process, or governmental request; is necessary to protect the rights, property, or safety of Capradix, a Customer, or any other person; or is necessary to enforce Capradix's agreements.
In a Corporate Transaction. Capradix may transfer personal information to a successor or acquirer in connection with a merger, acquisition, reorganization, or sale of all or substantially all of its assets or of the Service, in which case this Policy will continue to govern the information transferred.

6. Data Location; International Transfers

All Customer personal data is stored in the United States. Individuals who access the Service from outside the United States acknowledge that their personal information will be transferred to, stored in, and processed in the United States, where data protection laws may differ from those of the jurisdiction in which they reside.

7. Retention

7.1 Customer Personal Data is retained for the duration of Capradix's agreement with the Customer, or until earlier deleted by the Customer through the Service. Because the Service maintains an auditable financial record, a Customer cannot delete a record of a person or entity while other records depend on it, such as a distribution allocated to that entity; the dependent records must first be removed by the Customer. Upon termination of a Customer's agreement, Customer Personal Data remains available to the Customer for export for a period of thirty (30) days and is deleted within sixty (60) days following the Customer's request.

7.2 Backups containing personal information are retained for a limited period following deletion from the live Service and thereafter expire. Data held in a backup is restored to the live Service only for the purpose of recovering from a system failure.

7.3 Account Information is retained for the life of the account and for a limited period thereafter for security and audit purposes. Technical Information in server and error logs is retained for a limited period and thereafter expires.

7.4 Documents Submitted for Reading remain in the Service as documents under Section 7.1. The copy transmitted to the document-reading provider under Section 5(c) is retained by that provider only for the short period stated in the Security Policy and is then deleted. The facts the provider returns, and the record of the reading (which documents, when, by whom, and the outcome), are retained as part of the Customer's records under Section 7.1, because they document how a record came to be entered.

7.5 Portfolio Updates received at a Customer's update address and assigned to a portfolio company are retained as documents under Section 7.1. An email that is not assigned to a portfolio company, or that the Service identifies as unsolicited, is deleted thirty (30) days after it is received.

8. Security

Capradix maintains administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, disclosure, alteration, and destruction, including application-level encryption of sensitive personal information at rest and encryption of all data in transit. These measures are described in the Security Policy. No method of transmission or storage is entirely secure, and Capradix cannot guarantee absolute security.

9. Rights and Choices

9.1 Information Maintained by the Authorized User. An Authorized User in the investor role may review and update the contact information and entity information associated with that user's own investor record through the Service. Other Customer Personal Data is maintained by the Customer's administrators.

9.2 Notifications. An Authorized User may enable or disable optional notifications through the Service. Security and account notices are not optional while an account remains active.

9.3 Statutory Rights. Depending on the jurisdiction in which an individual resides, the individual may have the right to request access to, correction of, deletion of, or a portable copy of personal information held about them, and to be free from discrimination for exercising such rights. Requests relating to Customer Personal Data should be directed to the relevant Customer in accordance with Section 1.3. Requests relating to Capradix-Controlled Data may be submitted to legal@capradix.com. Capradix may take reasonable steps to verify the identity of the requester before responding.

9.4 Account Deactivation. Requests to deactivate an account should be directed to the administrator of the relevant Customer.

10. Children

The Service is not directed to, and Capradix does not knowingly collect personal information from, individuals under eighteen (18) years of age. The Terms require each Authorized User to be at least eighteen years of age.

11. Changes to This Policy

Capradix may amend this Policy from time to time. Any amended Policy will be posted on the Site with a revised version number and effective date. Where Capradix holds an individual's email address, notice of a material amendment will be provided by email or by notice within the Service before the amendment takes effect.

12. Contact

Inquiries and requests concerning this Policy may be directed to legal@capradix.com. Security matters may be reported to security@capradix.com. General inquiries may be directed to hello@capradix.com.