Privacy Policy

Effective date: March 2, 2026 · Last updated: March 2, 2026

This Privacy Policy explains how Ase Studios, LLC (“Capitalyx”, “we”, “our”, “us”) collects, uses, discloses, and protects personal data in connection with capitalyx.com and related services.

1. Data We Collect

• Account data: name, email, authentication identifiers.
• Organization and business data: company profile and operating details you provide.
• Financial input data: figures, assumptions, scenarios, and model content submitted by you.
• Usage and device data: logs, diagnostics, feature usage, IP/device metadata.
• Billing metadata: subscription and payment status (full card data handled by Stripe).

2. How We Use Data

• Provide and operate the Service, including AI outputs.
• Authenticate users, secure accounts, prevent abuse/fraud.
• Process billing and subscription lifecycle.
• Maintain reliability, monitor performance, and improve features.
• Communicate service updates, security notices, and support responses.
• Comply with legal and regulatory obligations.

3. Legal Bases (EEA/UK)

Where required, we process personal data under one or more lawful bases: contract performance, legitimate interests, legal obligation, and consent (where applicable).

4. AI Processing Notice

To generate outputs, we may send relevant prompts/content to AI infrastructure providers. We do not sell your financial data. Provider handling is governed by our vendor agreements and security controls.

5. Subprocessors and Sharing

We share data only as needed to deliver the Service, including with providers such as authentication, hosting, analytics, AI inference, and billing vendors (e.g., Clerk, Vercel, Neon, Stripe, model providers). We may update subprocessors over time.

6. Data Retention

We retain data while accounts are active and for a reasonable period afterward for legal, tax, audit, security, and backup purposes. Upon verified deletion requests, we delete or anonymize data subject to lawful retention requirements.

7. Security

We use administrative, technical, and organizational safeguards (encryption in transit, access controls, least-privilege practices, and monitoring). No method is 100% secure, but we continuously improve protections.

8. International Transfers

If data is transferred across borders, we use lawful transfer mechanisms as required (such as contractual safeguards) and apply appropriate protections.

9. Your Privacy Rights

EEA/UK: access, correction, deletion, portability, restriction, objection, and withdrawal of consent where applicable.

California (CCPA/CPRA): right to know, delete, correct, and non-discrimination rights, subject to legal exceptions.

10. Cookies and Tracking

We use essential cookies for login/session operation and limited analytics/performance cookies. We do not sell personal data and do not use cross-context behavioral advertising cookies by default.

11. Children

The Service is not intended for children under 18, and we do not knowingly collect their personal data.

12. Security Incidents

If we confirm a data incident requiring notice, we will notify affected users and regulators as required by applicable law.

13. Changes to this Policy

We may update this Policy from time to time. Material changes will be communicated via in-app notice, email, or both.

14. Contact and Requests