Privacy Policy

Last updated: July 25, 2026

1. Data Collection

We collect business information, contact details, and usage data necessary to provide our services. We do not sell personal data to third parties.

2. Data Storage

Your account and application database is hosted by Supabase on AWS in the ap-south-1 (Mumbai, India) region. Uploaded documents and generated media (data room files, AI-generated videos) are stored separately on Cloudflare R2, which is not India-locked. We are designed with Digital Personal Data Protection Act (DPDPA) 2023 principles in mind; we do not claim formal regulatory certification of DPDPA compliance.

3. Data Security

We use AES-256 encryption at rest and TLS 1.3 in transit, provided by our infrastructure providers (Supabase, Cloudflare). Access is role-based (row-level security). Structured audit logging today covers cap table changes (shareholders, share certificates, funding rounds); logging of authentication, payment, and document-access events is on our roadmap, not yet comprehensive.

4. Third-Party Services

We use Supabase (database), Cloudflare R2 (file/media storage), Razorpay and Stripe (payments), Brevo/Resend (email), WhatsApp Business API/WATI (messaging, where enabled), Google (Drive/Calendar sync, where you connect it), DocuSign (e-signature, where used), HeyGen/ElevenLabs/Sarvam (AI avatar video, voice, and translation, where used), and Groq/Anthropic (AI). Each has their own privacy policy.

5. Your Rights

You have the right to access, correct, export, or request deletion of your data. Today this is fulfilled manually — email privacy@capitalsync.net and we will act on your request; there is not yet a self-service export/delete tool in the product.

6. Contact

For privacy queries: privacy@capitalsync.net | CapitalSync Technologies Pvt. Ltd., India.