Privacy Notice

1. Who we are

CapFlow is operated by My Advisor Jimmie Howard, LLC ("CapFlow", "we", "us"). We are the data controller for personal information we collect through the CapFlow website and application.

Contact for privacy questions or requests: privacy@capflow.app.

2. Personal data we collect

You provide

• Account data — name, email address, password (hashed), profile details.
• Company and financial data you enter — company profile, invoices, expenses, cap-table entries, forecasts, scenarios, investor reports, and any other content you upload.
• Support communications — messages and attachments you send to us.

Collected automatically

• Usage and telemetry — pages viewed, features used, errors, timestamps.
• Device and connection data — IP address, browser type, operating system, device identifiers.
• Cookies and similar technologies — see the Cookies section below.

From third parties

• From Paddle — order confirmations, subscription status, and limited transaction metadata (not full payment card details).
• From identity providers — if you sign in with Google or another supported provider, we receive your name, email, and provider user ID.

Payment card details are collected and processed by Paddle as Merchant of Record. CapFlow never sees or stores full card numbers.

3. How we use personal data

• Provide the Service — create and secure your account, deliver features, sync data across devices. Legal basis: performance of a contract.
• Billing and subscription management — coordinate with Paddle to process payments, apply trials, and update your plan. Legal basis: performance of a contract; legal obligation.
• Security, fraud prevention, and abuse detection — monitor for suspicious activity, protect the Service and its users. Legal basis: legitimate interests.
• Customer support — respond to your inquiries and diagnose issues. Legal basis: performance of a contract; legitimate interests.
• Product improvement — aggregate usage analytics to fix bugs and improve features. Legal basis: legitimate interests.
• Communications — send transactional messages (billing, security, service updates). Marketing messages, if any, are sent only with your consent and you can opt out at any time. Legal basis: contract; consent.
• Legal and compliance — enforce our terms and meet legal obligations. Legal basis: legal obligation; legitimate interests.

4. How we share personal data

We share personal data only with the following categories of recipients:

• Merchant of Record — Paddle, which processes payments, handles taxes and invoicing, and manages subscriptions on our behalf.
• Service providers / subprocessors — cloud hosting, database, authentication, email delivery, error monitoring, and analytics vendors that operate the Service on our behalf under written agreements requiring appropriate safeguards.
• Identity providers — when you choose to sign in with a third-party provider (e.g. Google), that provider processes the sign-in event.
• Professional advisers — legal, accounting, and insurance advisers, under confidentiality obligations.
• Authorities — regulators, law enforcement, or courts where required by law or to protect our rights and users.
• Successors — in the event of a merger, acquisition, financing, or sale of assets, subject to standard confidentiality protections.

We do not sell personal data.

5. International transfers

We and our service providers may process personal data in the United States and other countries. Where personal data is transferred out of the UK or the EEA, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (or the UK equivalent) and, where applicable, adequacy decisions.

6. Data retention

We retain personal data for as long as your account is active and for a limited period afterwards to meet legal, tax, accounting, and dispute-resolution obligations. When it is no longer needed for these purposes, we delete or anonymize it. You can request deletion earlier as described below.

7. Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict, or object to processing of your personal data, to receive a portable copy, and to withdraw consent where processing is based on consent. Users in the UK and EEA also have the right to lodge a complaint with their local supervisory authority. We respond to verified requests within one month.

To exercise any of these rights, email privacy@capflow.app.

8. Security

We use appropriate technical and organizational measures to protect personal data, including encryption in transit, access controls, row-level authorization in our database, and separation of production credentials. No system is completely secure, and we cannot guarantee absolute security.

9. Cookies

We use a small number of cookies and similar technologies:

• Essential — required to keep you signed in and to remember your session and consent choices. These cannot be disabled.
• Analytics — help us understand how features are used so we can improve them. Aggregated and pseudonymous where possible.

You can control cookies through your browser settings. Blocking essential cookies will break sign-in and other core functionality.

10. Children

CapFlow is not directed to children under 16 and we do not knowingly collect personal data from them. If you believe a child has provided us with personal data, contact us and we will delete it.

11. Changes to this notice

We may update this Privacy Notice from time to time. Material changes will be communicated by email or in-app notice. The "Last updated" date at the top of this page indicates when it was last revised.

12. Contact

My Advisor Jimmie Howard, LLC — privacy@capflow.app.