Privacy Policy

1. Introduction

Capmatter ("Capmatter," "we," "our," or "us") provides equity management software: cap table and securities records, employee stock option (ESOP) administration, an employee and investor portal, liquidity programs, valuations, equity-related tax and accounting computations, statutory registers, compliance tracking, and related reporting.

This Privacy Policy explains how we collect, use, store, and disclose information when you use our platform.

By creating an account, accessing, or using Capmatter, you provide your free, specific, informed, unconditional, and unambiguous consent to the collection, usage, and processing of your personal data as described in this Privacy Policy. You may withdraw your consent at any time by contacting us, though withdrawal will not affect the lawfulness of processing based on consent before its withdrawal.

2. Information We Collect

Information You Provide

• Name
• Email address
• Phone number
• Company information
• CIN, PAN, GST, and other business identifiers
• Shareholder, employee, and investor information entered by a company (names, emails, PAN and other tax identifiers, employment dates, holdings)
• Investment and financing records
• Equity, cap table, option grant, and vesting data
• Valuation reports and fair market values
• Option exercise requests, payment references, and the tax computed on them
• Grant-letter acceptances (typed name, timestamp, and verified email)
• Board meeting, resolution, statutory register, and filing records
• Fund administration records (limited partner names, commitments, capital calls, distributions)
• Documents uploaded to the platform
• Requests for help from the Capmatter team, or for software connectors, including the requester's email and company name
• Communications sent to support

Account Information

We collect information necessary to create and maintain your account, including authentication data processed through our service providers.

Usage Information

• Device information
• Browser information
• IP address
• Log data
• Error reports
• Security events
• Product usage analytics

3. How We Use Information

We use information to:

• Provide and operate the platform
• Generate cap table calculations, statutory registers, and reports
• Show employees and investors the grants and holdings issued to them
• Compute indicative perquisite tax and share-based payment expense
• Process subscriptions and payments
• Authenticate users
• Provide customer support
• Improve product performance and reliability
• Detect fraud, abuse, and security incidents
• Comply with legal obligations
• Enforce our agreements and policies

4. Data Storage and Security

We implement administrative, technical, and organizational safeguards designed to protect information.

However, no method of electronic transmission, cloud storage, or internet communication can be guaranteed to be completely secure.

Accordingly:

• We do not guarantee absolute security.
• We cannot guarantee that unauthorized access, cyberattacks, service interruptions, or data loss will never occur.
• Users are responsible for maintaining the security of their credentials and devices.

Data Breach Notification

In the event of a confirmed personal data breach affecting your information, we will notify you and/or the applicable supervisory authority (such as the Data Protection Board of India) in accordance with the timelines, procedures, and formats prescribed under the Digital Personal Data Protection (DPDP) Act 2023 and other applicable data security regulations.

5. Service Providers

We may use third-party service providers to support platform operations, including:

• ▣ Cloud hosting providers
• ▣ Database providers
• ▣ Authentication providers
• ▣ Payment processors
• ▣ Analytics providers
• ▣ Customer support providers
• ▣ Security and monitoring providers

These providers may process information on our behalf subject to their own policies and contractual obligations.

6. Data Retention

We retain information for as long as reasonably necessary to:

• Provide services
• Maintain system integrity
• Preserve audit records
• Resolve disputes
• Prevent fraud and abuse
• Comply with legal, tax, accounting, and regulatory obligations

Certain records, including ledger, transaction, audit, security, and system integrity records, may be retained after account closure or deletion requests where necessary for legal compliance, dispute resolution, fraud prevention, or preservation of historical integrity.

7. Data Exports and Deletion Requests

Users may request access to, correction of, export of, or deletion of certain information.

Deletion requests may not result in immediate or complete removal of all records where retention is necessary for:

• Legal obligations
• Security investigations
• Fraud prevention
• System backups
• Audit integrity
• Historical financial record preservation

Your rights under the Digital Personal Data Protection Act, 2023

• Access: a summary of the personal data we process about you, and with whom it is shared. Download it from Privacy & data in the app.
• Correction and erasure: correct or update your details in the app, or ask us to erase them (see our Data Retention Policy for what the law or a company's register requires us to keep).
• Withdraw consent: as easily as you gave it. Analytics consent is changed from the cookie banner; withdrawing consent for the service itself means closing your account.
• Nominate: name someone to exercise these rights for you if you die or become unable to. Write to a Grievance Officer with their name and email.
• Grievance: write to a Grievance Officer (below). We respond within the time the DPDP Rules set. If you are not satisfied, you may complain to the Data Protection Board of India.

8. International Transfers

Information may be processed and stored in jurisdictions different from the user's location. By using the platform, users consent to such processing and storage where permitted by applicable law.

9. Children's Privacy

Capmatter is intended for business and professional use and is not directed toward individuals under the age of 18.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Continued use of the platform after changes become effective constitutes acceptance of the revised policy.

11. Grievance Redressal Officer and Contact

In accordance with the Digital Personal Data Protection (DPDP) Act 2023, you may address any queries, concerns, or grievances regarding the processing of your personal data to our designated Grievance Officer:

We will acknowledge and address your grievance within the statutory timelines prescribed under applicable law.

12. Employees, Investors, and Other Stakeholders

Companies use Capmatter to record information about their shareholders, option holders, employees, directors, and investors. For that information:

• The company that entered it decides what is recorded and why, and is responsible for having a lawful basis to share it with us. Capmatter processes it on the company's behalf to provide the service.
• If you sign in to the employee and investor portal, you see only the grants and holdings recorded against your own confirmed email address. You do not see anyone else's equity.
• When you accept a grant letter or request an exercise in the portal, we record your typed name, the time, your verified email, the quantity, the method you chose, and any payment reference you enter, and share them with the company that issued the grant.
• Requests to access, correct, or delete stakeholder records should go to the company that holds them; we will assist the company in responding, and you may also contact our Grievance Officer below.

Tax and expense figures the platform computes are indicative and are shared only with the company and, for your own grants, with you.

13. Discontinued Services

If you used an earlier service that Capmatter no longer offers, the data you created there remains stored under the retention terms described in our Data Retention Policy, and is not used for any new purpose. You can ask us to export or delete it at any time by writing to the Grievance Officer above.

14. Related Policies

This Privacy Policy works together with:

• ▣ Cookie Policy
• ▣ Data Processing & Compliance
• ▣ Data Retention Policy
• ▣ Security Policy
• ▣ Acceptable Use Policy
• ▣ Copyright Policy