Privacy Policy

Information we collect

• Account information. When you sign in with Google, we receive account details such as your name, email address, profile image, and account identifier. Authentication services maintain session information so you can stay signed in. We do not receive your Google password.
• Workspace information. We store your watchlist, research notes, alert rules and notifications, briefing read status, email preferences, and agent-token records, such as token names, hashes, expiry dates, and usage information.
• Private-markets applications. If you submit an interest form, we collect your name, account email, country or region, self-reported accredited-investor status, optional notes, consent record, and review history.
• Usage and technical information. We record account activity for product analytics and operational records such as email delivery status and administrator actions. Hosting and authentication providers may process IP addresses, browser or device information, and request logs to deliver and secure the service.
• Communications. We receive information you provide when you contact us. Please do not send passwords, access tokens, or financial identity documents.

How we use information

We use information to authenticate accounts, provide and maintain your workspace, retrieve relevant research, evaluate alert rules, send emails you enable, review private-markets interest, respond to requests, understand product usage, prevent misuse, and meet legal obligations. Private-markets answers are used for an internal review of interest; they do not verify investment eligibility.

Service providers and sharing

We use Google for sign-in, Convex for application data and backend services, Vercel for hosting, and Resend for email delivery. These providers process information needed to perform their services. Email delivery includes your email address and the content of the message, which may reflect your watchlist or alert activity. Market and filing services receive the security identifiers or research requests needed to retrieve data.

Authorized administrators can review private-markets submissions and product analytics. Technical operators may access information as needed to maintain the service, handle support, or investigate abuse. We do not make your private workspace publicly accessible or sell your personal information. We may disclose information when legally required, to protect rights and safety, or as part of a business transfer subject to appropriate protections.

Connected agents

If you give an agent a Capitalyst access token, it can retrieve the market and private workspace information allowed by that token, including watchlists, research notes, briefings, and alerts. Tokens with write access can also change your watchlist, notes, alert rules, and read states. Your agent provider handles retrieved information under its own terms and privacy policy. You can revoke a token in Account → Agent access. Revocation stops future access through that token; it does not delete information already received by an agent.

Cookies and browser storage

Authentication uses cookies or similar session technologies. Browser storage remembers preferences such as your theme and stores sample workspace data in preview mode. Blocking cookies may prevent sign-in. You can clear browser storage through your browser settings; doing so does not delete data saved to your account.

Email choices

Weekly newsletters and alert emails are separate, optional settings and are off by default. Enable or disable either in Account settings, or use the unsubscribe link in the relevant email. Turning off email does not remove in-app alerts. Account, security, or administrator-invitation messages may still be sent when needed to provide the service.

Retention and security

We retain account and workspace information while needed to provide the service, respond to requests, resolve disputes, and satisfy legal or security needs. Some operational records are periodically removed; retention depends on the record and provider. Backups or records required for legal and security purposes may remain after a deletion request. We use access controls and other safeguards, but no system can guarantee complete security.

Your choices and requests

You can change supported workspace settings, manage email preferences, and revoke agent tokens in the app. To request access, correction, a copy of your information, or account deletion, contact team@turbolobster.com from your account email. We may need to verify your identity. Available rights and exceptions depend on applicable law; where provided, you may also object to or restrict processing or complain to your local privacy authority.

International use and age limits

Our service providers may process information outside the country where you live. Privacy protections may differ by location. Capitalyst is intended for adults aged 18 or older. If you believe a child has provided personal information, contact us so we can investigate and take appropriate action.

Changes and contact

We may update this policy as the service changes and will update the date above. For material changes, we will provide additional notice when required by law. For privacy questions or requests, contact Capitalyst by TurboLobster at team@turbolobster.com.