Privacy Policy

1. Introduction

Kapitalyze Technologies Private Limited ("Kapitalyze," "we," "us," or "our") is committed to protecting your personal data and privacy. This Privacy Policy describes how we collect, use, store, and protect your personal data when you use our platform, website, and services. This policy is compliant with the Digital Personal Data Protection Act, 2023 (DPDP Act), the Information Technology Act, 2000, and applicable rules thereunder. By using Kapitalyze, you consent to the practices described in this Privacy Policy.

2. Information We Collect

We collect the following categories of personal data:

• Account Information: Name, email address, phone number, company name, designation, and login credentials provided during registration.
• Company Data: Corporate information including shareholder details, director information, financial data, compliance records, and other corporate governance data uploaded to or generated within the Platform.
• Fund Data: Limited partner information, portfolio company data, capital call records, distribution records, and NAV data for fund management users.
• Usage Data: Information about how you use the Platform, including pages visited, features used, time spent, and interaction patterns.
• Device Information: IP address, browser type, operating system, device identifiers, and other technical information collected automatically.
• Communication Data: Records of communications with our support team, feedback, and survey responses.
• Payment Information: Billing address, payment method details (processed securely through our payment processor; we do not store full payment card numbers).

3. How We Use Your Information

We use your personal data for the following purposes: providing and maintaining the Platform and its features; processing subscriptions and payments; sending important service notifications and updates; providing customer support; improving and personalizing the Platform; generating anonymized analytics and insights; ensuring platform security and preventing fraud; complying with legal and regulatory obligations; sending marketing communications (with your consent); and facilitating Professional Services you have requested.

4. Legal Basis for Processing

Under the DPDP Act, 2023, we process your personal data based on the following grounds: your consent provided at the time of registration and use of the Platform; performance of the contract (subscription agreement) between you and Kapitalyze; compliance with legal obligations under Indian law; and our legitimate interests in improving and securing the Platform, provided such interests do not override your fundamental rights.

5. Data Storage and Security

Your data is stored on secure servers located in India, hosted by cloud infrastructure providers with appropriate security certifications. We implement industry-standard security measures including: encryption of data in transit (TLS 1.3) and at rest (AES-256); role-based access controls; regular security audits and penetration testing; monitoring and alerting systems for unauthorized access; employee security training and background checks; and incident response procedures. While we take all reasonable precautions, no method of electronic transmission or storage is 100% secure, and we cannot guarantee absolute security.

6. Data Sharing and Disclosure

We do not sell your personal data. We may share your data with: authorized service providers who assist in operating the Platform (hosting, payment processing, email delivery) under strict data processing agreements; professional service providers (Company Secretaries, Chartered Accountants, Lawyers, Valuers) when you use our Professional Services; regulatory authorities when required by Indian law or legal process; and in connection with a merger, acquisition, or sale of assets, with appropriate notice to you. We require all third parties to maintain the confidentiality and security of your data.

7. Data Retention

We retain your personal data for the duration of your subscription plus an additional period as required by applicable Indian law (including requirements under the Companies Act, Income Tax Act, and other regulatory frameworks). Account data is retained for 3 years after account closure. Financial transaction records are retained for 8 years as required by tax laws. Usage logs are retained for 2 years. You may request earlier deletion of your data subject to our legal retention obligations.

8. Your Rights Under DPDP Act

Under the DPDP Act, 2023, you have the following rights as a Data Principal:

• Right to Access: You may request confirmation of whether your personal data is being processed and access to such data.
• Right to Correction: You may request correction of inaccurate or incomplete personal data.
• Right to Erasure: You may request deletion of your personal data, subject to our legal retention obligations.
• Right to Grievance Redressal: You may raise grievances regarding our data processing activities with our Grievance Officer.
• Right to Nominate: You may nominate another individual to exercise your rights in case of your death or incapacity.
• Right to Withdraw Consent: You may withdraw your consent at any time, without affecting the lawfulness of processing carried out prior to withdrawal.

9. Children's Privacy

The Platform is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from children. If we learn that we have collected personal data from a child, we will take steps to delete such data promptly. In compliance with the DPDP Act, we do not process the personal data of children without verifiable consent of the parent or lawful guardian.

10. Cookies and Tracking

We use cookies and similar technologies to maintain session state, remember preferences, understand usage patterns, and improve the Platform. Essential cookies are required for the Platform to function and cannot be disabled. Analytics cookies help us understand how users interact with the Platform. You can manage cookie preferences through your browser settings. Our use of cookies is in accordance with the IT Act and DPDP Act requirements.

11. Cross-Border Data Transfers

Your data is primarily stored in India. In certain cases, data may be transferred to countries outside India for processing by our service providers (such as cloud infrastructure or email services). Such transfers are conducted in compliance with the DPDP Act and are subject to appropriate safeguards, including contractual protections that require the receiving party to maintain equivalent data protection standards. We will not transfer personal data to any country that the Central Government of India has restricted or notified under the DPDP Act.

12. Third-Party Services

The Platform may integrate with third-party services including payment processors, cloud storage providers, email services, and AI services (Anthropic for Oris AI). Each third-party service has its own privacy practices, and we encourage you to review their privacy policies. We only share the minimum data necessary for these services to function and require them to maintain appropriate security standards.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email and in-platform notification at least 15 days before taking effect, as required under the DPDP Act. The "Last updated" date at the top of this page indicates when the policy was last revised. Continued use of the Platform after such notice constitutes acceptance of the updated policy.

14. Grievance Officer

In accordance with the DPDP Act, 2023, and the Information Technology Act, 2000, the details of our Grievance Officer are:

15. Contact Us

For any questions or concerns about this Privacy Policy or our data practices, contact us at: