Data Processing & Compliance
Last Updated: July 2026
1. Our role
For personal data you provide directly (your own account, profile, and verification information), Capmatter acts as the Data Fiduciaryunder the Digital Personal Data Protection (DPDP) Act, 2023. For data you enter about others through the platform - shareholders, employees, or founders you add to your company's cap table - you act as the data fiduciary for that data, and Capmatter processes it on your behalf as a service provider.
2. Legal basis for processing
We process personal data on the following bases:
- Consent - given when you create an account, as described in our Privacy Policy, and withdrawable at any time (subject to processing already lawfully underway not being affected).
- Performance of a contract - processing necessary to provide the cap table, ESOP, funding-round, and Founder Circle features you've signed up to use.
- Legal obligation - retention of financial, audit, and tax-relevant records as required by applicable law.
- Legitimate interests - fraud prevention, abuse detection, platform security, and service reliability.
3. Sub-processors
We use the following categories of sub-processors to operate the platform. We do not sell personal data to any third party, and no sub-processor is permitted to use your data for their own marketing purposes.
| Category | Purpose |
|---|---|
| Cloud hosting & database (Supabase / Postgres) | Application hosting, database, authentication, row-level data isolation |
| Payment processor (Razorpay) | Subscription billing for the Financial OS |
| Transactional email (Resend) | Account, verification, billing, and community notification emails |
| AI provider (Google Gemini) | Powers the AI Founder feature - only invoked when you actively trigger it, using context you provide |
4. Cross-border data transfers
Our infrastructure providers may process and store data in jurisdictions outside India. Where this occurs, we rely on our providers' own compliance certifications and contractual safeguards, and only transfer data to jurisdictions not restricted by the Central Government under the DPDP Act. By using the platform, you consent to this processing, as described in our Privacy Policy.
5. Automated decision-making
We do not use fully automated decision-making that produces legal or similarly significant effects about you without human involvement. Founder/investor/mentor/operator verification applications are always reviewed and decided by a human administrator, never auto-approved or auto-rejected.
6. Your rights and how to exercise them
- Access & correction - most of your data is directly viewable and editable in your account settings.
- Export - download a complete copy of your data on demand from Settings.
- Erasure - request account deletion from Settings, subject to the grace period and retention exceptions described in our Data Retention Policy.
- Grievance - contact our Grievance Redressal Officer (details below) for anything not covered by self-service tools.
7. Grievance Redressal Officer
Designation: Grievance Redressal Officer
Address: Capmatter Technology, Greater Noida, Uttar Pradesh, India
Email: support@capmatter.com
We will acknowledge and address grievances within the statutory timelines prescribed under the DPDP Act, 2023.