Privacy policy

1. Who we are and scope

Capital Ally LLC, a Wyoming limited liability company ("Capital Ally", "we", "us") runs the Capital Ally app, a membership app where small business owners keep their business finances, credit readiness and funding applications in one place. When a member submits a funding request, we share it with third-party lenders and financing providers to review, and we may receive a referral fee when financing closes. This policy applies to https://www.capitalally.net (the "Site"), the Capital Allymobile app (the "App"), our eligibility check and application forms, and our communications with you by phone, text message and email. It does not apply to any lender's website or to a lender's handling of your information once you apply with that lender, which is governed by that lender's own privacy notice.

Our services are for businesses and business owners seeking commercial financing. They are not directed to consumers seeking credit for personal, family or household purposes, and they are not directed to children under 18. We do not knowingly collect information from anyone under 18.

2. Information we collect

Information you provide

• Contact details: name, business name, email address, mobile and business phone numbers, mailing address, state of operation.
• Business and financing details: industry, time in business, revenue range, requested amount, use of funds, existing debt, and any information you choose to include in messages or on a call.
• Documents you send us to support a request, such as bank statements, tax returns, financial statements, invoices, equipment quotes and identification, which may contain account numbers and government identifiers.
• Communications: the content of emails, text messages, calls and voicemails with us. Calls may be recorded for quality and compliance where the law permits, with notice.

Information you provide in the App

• Account details: your full name, email address and mobile number, which we verify with a one-time code.
• Business and request details: legal business name, entity type, industry, business start date, business address, requested amount and use of funds.
• Identity details needed by lenders: your Social Security number, your business's Employer Identification Number and your date of birth.
• Your home address. When you search for an address in the App, the text you type is sent to Google to suggest matching addresses.
• If you add another company to your account, its details, its bank connection and its own membership. Your own details (your Social Security number, date of birth and home address) are reused for it, so you do not enter them again.
• Documents you upload in the App when a lender or our team requests them, and messages you send our team in the App.

Information from your bank, through Plaid

When you connect your business bank account in the App, we use Plaid Inc. ("Plaid") to retrieve, with your permission, the address on the account you choose, its transactions and its bank statements, and Plaid gives Stripe a secure token for that account so your membership can be paid from it. We never receive or store your full account or routing numbers. We use your transactions to estimate your average monthly business revenue, and your statements so lenders can review your request. Plaid's own collection and use of your information is governed by the Plaid End User Privacy Policy.

Payment information

Membership payments are processed by Stripe, Inc. Stripe receives your name, email address and a token for your bank account. We do not store full bank account or payment card numbers.

Information collected automatically

• Device and usage data: IP address, browser and device type, operating system, pages viewed, time on page, links clicked, referring URL and approximate location derived from IP address.
• App security data: your device type, operating system, App version, IP address and sign-in history, used to protect your account, including to notify you of sign-ins from new devices. If you use Face ID, Touch ID or your device passcode to unlock the App, that check happens on your device; we never receive your biometric data.
• Advertising identifiers and campaign parameters: on the Site, the utm and click identifiers attached to the link you arrived on (for example from Meta or Google). In the App, your device's advertising identifier (the Google Advertising ID on Android) and the install referrer that Google Play and Meta record when you install the App after seeing an advertisement, used to measure which advertising led to the install, as described in Section 6.
• Session activity on the Site, including interactions with our forms, recorded through Microsoft Clarity as described in Section 6.
• Session activity in the App: the screens you view, your taps, scrolls and the time you spend on each screen, recorded as session replays and heatmaps through Microsoft Clarity and linked to an internal account identifier (not your name or phone number), as described in Section 6.
• Consent records: when you give a consent in the App we record the time, the consent language shown to you, your IP address and your device type, so we can demonstrate that consent was given.

Information from other sources

• Lenders and financing providers that review your request may tell us its status or outcome.
• Referral partners (for example an accountant or equipment dealer) may pass us your contact details with your permission.
• Public records, business databases and identity or fraud-prevention services used to verify the information you provide.

3. How we use information

• To review your financing request and share it with the lenders and financing providers that can consider it.
• To contact you about your request, by phone, text and email, and to schedule and conduct calls with your advisor.
• To send you the information a lender needs and to relay offers, requests for documents and status updates.
• To verify identity, prevent fraud, and comply with anti-money-laundering, know-your-customer and other legal obligations.
• In the App, to create and secure your account, retrieve your bank statements and estimate your revenue through Plaid, prepare your application for lenders, and set up and collect your membership payments through Stripe.
• If you add Insights Pro in the App, a Capital Ally advisor on our staff reviews the transactions of your connected business bank account every month to look for funding or savings opportunities, and messages you about them in the App's Messages. Staff view these transactions only to provide that service, and doing so does not share them with anyone else.
• To operate, secure and improve the Site, including measuring which pages and advertisements lead to enquiries.
• To send marketing about our services where you have agreed to receive it. You can opt out at any time (Section 8).
• To establish, exercise or defend legal claims and to enforce our Terms of Use.

4. Consent to calls, texts and emails

When you check the consent box as you create your account, you agree that Capital Ally may call, text and email you at the numbers and address you provided about your Capital Ally account, including using an automatic telephone dialing system and prerecorded or artificial voice messages. When you submit a funding request, the lender reviewing it may contact you about that request by phone, text or email. Consent is not a condition of purchasing any goods or services. Message and data rates may apply. Message frequency varies. Reply STOP to any text to opt out, or HELP for help. Full program terms are in our SMS terms.

We do not sell or share your mobile number or text message consent with third parties for their own marketing. Text messaging originator opt-in data and consent will not be shared with any third parties.

If you do not consent, you can still reach us by email at [email protected].

5. How we share information

• Lenders and financing providers. When you submit a funding request, we share the information in it, and the documents you provide, with the lenders and financing providers that review it so they can evaluate it and, with your agreement, contact you. When you submit an application in the App, this includes, with your authorization, your Social Security number, Employer Identification Number, date of birth, bank statements and bank account activity. Each lender is responsible for its own use of your information.
• Service providers that host the Site and App, store data, send email and text messages, provide call handling and recording, verify identity and provide analytics, acting on our instructions. These include Plaid (bank connections), Stripe (payments), DigitalOcean (hosting), Google (address suggestions in the App), Microsoft (Clarity session analytics on the Site and in the App), AppsFlyer (measuring which advertising led to an install of the App) and Meta (measuring the results of our advertising on the Site and in the App).
• Advertising and analytics partners (Meta and Microsoft) as described in Section 6.
• Referral partners who introduced you to us, limited to the status of your request, where you were referred through them.
• Legal and safety. Regulators, courts, law enforcement and other parties where required by law, subpoena or legal process, or to protect the rights, property or safety of Capital Ally, our clients or others.
• Business transfers. A buyer or successor in a merger, acquisition, financing or sale of assets, subject to this policy.

We do not sell your personal information for money. Sharing information with advertising partners to measure and improve advertising may be treated as a "sale" or "sharing" under some state laws; you can opt out of that as described in Section 8.

6. Cookies, pixels and tracking

We and our partners use cookies, pixels, local storage and similar technologies on the Site, and similar technologies in the App:

• Meta Pixel and Conversions API to measure whether our advertising on Facebook and Instagram results in enquiries, and to build audiences for advertising. When you submit a form we send Meta an event that may include hashed contact details, your IP address and browser information.
• Microsoft Clarity to record how visitors use the Site (mouse movement, scrolling, clicks and form interaction, with typed personal information masked) and to produce heatmaps, so we can improve the Site.
• Microsoft Clarity in the App to record how the App is used (the screens you view, taps, scrolls and time on each screen) as session replays and heatmaps, so we can see where people have trouble or stop and improve the App. Clarity masks what you type, so the numbers and details you enter are not visible in recordings. Sessions are linked to an internal account identifier, never your name or phone number. Microsoft processes this data under the Microsoft Privacy Statement.
• Meta in the Appto measure whether our advertising on Facebook and Instagram results in installs, accounts and memberships, and to help Meta deliver and measure our advertising. The App may send Meta an install identifier, your device's advertising identifier, device information and events such as account created, funding request sent and membership started; the first membership payment is reported to Meta from our servers. We do not send Meta your name, phone number, Social Security number, bank data or the details of any funding request.
• AppsFlyer in the App to measure which advertising network or link led to an install of the App, so that we can pay advertising partners for the installs they generated and detect fraudulent installs. AppsFlyer receives your device's advertising identifier, device information, the install referrer and the times the App is opened, never your name, contact details or financial information. AppsFlyer processes this data under the AppsFlyer Services Privacy Policy.
• Essential storage to remember the answers you have given in a multi-step form during your visit and the campaign parameters you arrived with.

You can control cookies through your browser settings and can opt out of Meta's ad personalisation in your Facebook settings. On Android you can delete or reset your advertising identifier in your device's Google settings, which stops advertising measurement linked to it. Blocking essential storage may prevent the forms from working. We do not currently respond to browser "Do Not Track" signals; we do honour Global Privacy Control signals for opt-out of sharing where required by state law.

7. How long we keep information

We keep request and consent records for as long as needed to fulfil the purposes above and to meet legal, regulatory and audit obligations, typically for five years after your last interaction with us, and longer where a claim or investigation is open. Documents you provide are deleted or returned when they are no longer needed for a live request unless the law requires us to keep them.

In the App, if you do not submit your application within 90 days of your last activity, we automatically delete your Social Security number, Employer Identification Number, date of birth, bank statements and uploaded documents, and disconnect your bank from Plaid. When you delete your account in the App, we disconnect your bank from Plaid, delete your bank statements, documents and identity numbers, and remove your name and contact details from your profile. We keep records of the consents you gave and of membership payments for as long as the law requires.

8. Your choices and rights

• Marketing. Unsubscribe from marketing email using the link in any message. Reply STOP to any text message. Ask us not to call you at [email protected]. We will still contact you about an active request where necessary.
• Access, correction, deletion and portability. You may ask us for a copy of the personal information we hold about you, ask us to correct it, ask us to delete it, or ask for it in a portable format. You can also delete your App account at any time in the App, under Profile, which disconnects your bank and deletes your bank data.
• Opt out of sale or sharing and targeted advertising. Email [email protected]with the subject "Do not sell or share my personal information", or send a Global Privacy Control signal from your browser.
• No discrimination. We will not treat you differently for exercising these rights.

These rights are available to residents of California (under the CCPA as amended by the CPRA), Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana and other states with comprehensive privacy laws, and we extend them to everyone. We will verify your identity before acting on a request, usually by matching the information you give us to our records, and respond within 45 days (extendable once by 45 days where the law allows). You may appeal a decision by replying to our response; we will explain the outcome of the appeal and, where applicable, how to contact your state attorney general. An authorised agent may make a request on your behalf with written permission.

California notice at collection. In the past 12 months we have collected the categories of personal information listed in Section 2 (identifiers, including government identifiers; financial information, including bank account information and statements; commercial information; internet activity; professional information; and inferences), for the purposes in Section 3, and disclosed them to the categories of recipients in Section 5. We do not use or disclose sensitive personal information other than to provide the services you request. We do not sell personal information of anyone under 16.

9. Security

We encrypt information in transit, and we additionally encrypt Social Security numbers, Employer Identification Numbers, dates of birth, bank statements and bank connection tokens at rest with AES-256. Staff access requires multi-factor authentication, access to identity numbers and statements requires a fresh multi-factor sign-in and is logged, and we limit access to staff and providers who need it. The App can be locked with Face ID, Touch ID or your device passcode, notifies you of sign-ins from new devices, and asks for a one-time code before your bank account or phone number is changed. No method of transmission or storage is completely secure. Please send sensitive documents only through the secure links we provide, not by unencrypted email, and never share account passwords with us.

10. Other important information

• Third-party sites. Links to lenders and other sites are provided for convenience; their privacy practices are their own.
• International visitors. The Site is operated in the United States and information is processed there.
• Changes.We will post any changes to this policy here with a new "last updated" date, and give notice of material changes by email where we have your address.

11. Contact

Questions, requests or complaints about privacy: [email protected]. Please include "Privacy" in the subject line.