Privacy Policy

1. Scope

This policy explains how KapVista, based in Sydney NSW, Australia, handles personal information when you use kapvista.com and the KapVista platform. We comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles, and where applicable, other privacy laws such as the GDPR.

2. What we collect

• Account details: name, email address, password (stored as a one-way hash) or sign-in via Google.
• Founder profiles: company name, description, sector, stage, round size, traction, team and links you provide.
• Investor profiles: firm, title, investment preferences and, where provided, LinkedIn URL.
• Mailbox connection data: OAuth tokens and limited message data described in section 4.
• Email activity: drafts, sent messages, and open, click and reply events for emails sent through the Service.
• Billing: plan and payment status. Card details are handled by Stripe; we never see or store full card numbers.
• Contact and newsletter: details you send through our forms.
• Technical data: IP address, browser and device information, and essential cookies used to keep you signed in.

3. Investor database

Our investor database is compiled mainly from information investors publish about themselves in a professional capacity, such as fund websites, thesis pages, portfolio announcements and public posts, along with details from members of the KapVista network. We use it to match founders with relevant investors. Investors can ask us to correct their profile or to be excluded from matching by emailing hello@kapvista.com.

4. Google user data (Gmail)

If you connect a Gmail account, we request the gmail.send scope to send emails you have approved from your address, and the gmail.readonly scope solely to detect whether an investor has replied to a thread started through KapVista, so we can stop follow-ups and show reply status. We do not use Gmail data for any other purpose.

KapVista's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• we only use Gmail data to provide and improve user-facing features that are visible in the KapVista app;
• we do not transfer Gmail data to others except as needed to provide the Service, to comply with law, or as part of a merger or acquisition with your notice;
• we do not use Gmail data for advertising, and we do not sell it;
• we do not use Gmail data to develop, improve or train generalised AI or machine-learning models; and
• humans do not read your Gmail data unless you give explicit consent for specific messages, it is needed for security purposes, or it is required by law.

5. Microsoft user data (Outlook)

If you connect a Microsoft account, we use the Microsoft Graph API with the Mail.Send, Mail.Read, User.Read and offline_access permissions. These let us send emails you approve from your address, read your mailbox address, and check threads started through KapVista for replies. We apply the same limits as for Google data: no advertising use, no sale, no use for training generalised AI models, and no human access without your consent except for security or legal reasons.

6. How we use information

• to provide the Service: matching, drafting emails, sending, tracking and the marketplace;
• to process payments and manage your plan and credits;
• to respond to enquiries and provide support;
• to send service messages and, if you opt in, our newsletter (you can unsubscribe at any time);
• to keep the Service secure, prevent abuse and spam, and meet legal obligations; and
• to understand usage in aggregate and improve the product.

7. AI processing

To draft emails, we send your company profile and public information about the relevant investor to an AI model provider acting as our service provider. The provider processes this data only to return the draft and does not use it to train its models under our agreement. We do not send the contents of your mailbox to AI providers.

8. Email tracking

Emails sent through KapVista may include a small tracking image and tracked links so you can see when an email is opened or a link is clicked. This records the time and approximate technical details of the event.

9. Sharing and overseas disclosure

We do not sell personal information. We share it only with:

• service providers that help us run KapVista, such as hosting, database, email, payments (Stripe) and AI providers;
• investors on the marketplace, limited to the listing details you choose to publish;
• founders you request an introduction to, limited to your name, firm and message; and
• authorities where required by law.

Some providers store or process data outside Australia, including in the United States and the European Union. We take reasonable steps to ensure they protect it consistently with the Australian Privacy Principles.

10. Security and retention

We use encryption in transit, access controls and least-privilege practices to protect data. OAuth tokens are stored securely and used only for the purposes above.

We keep account and profile data while your account is open. When you disconnect a mailbox, we delete its tokens. When you close your account, we delete or de-identify your personal information within 30 days, except where we must keep records (such as billing records) for legal or tax purposes, typically up to 7 years.

11. Your choices and rights

You can access and update most of your information in the app, and download a copy of it any time from Settings → Your data. You can also ask us to access, correct or delete your personal information, or object to certain processing, by emailing hello@kapvista.com. You can revoke KapVista's access to your mailbox at any time from your Google or Microsoft account security settings. If you are unhappy with how we handle a complaint, you can contact the Office of the Australian Information Commissioner (oaic.gov.au).

12. Contact and changes

We may update this policy and will notify you of material changes. For any privacy question, email hello@kapvista.com or use our contact page. See also our Terms of Use.