Privacy Center Pre-launch structure requiring legal review

PRIVACY CENTER

Your financial life is not an employer dashboard.

CapitalEvolve is designing its data practices around financial privacy, limited employer access and clear choices. This page describes the planned architecture, not a final production privacy policy.

PRIVACY COUNSEL REVIEW REQUIRED
Not a final privacy policy

Data maps, vendors, state-law applicability, financial privacy notices, retention schedules, rights workflows and contact details must be completed and approved before production processing.

Planned privacy commitment

DESIGN PRINCIPLE

CapitalEvolve’s intended policy is not to sell sensitive financial information. Employer reporting is designed to use program and aggregate information rather than expose individual investment behavior.

Financial partners and service providers will receive only the information reasonably needed to open and service accounts, process authorized contributions, prevent fraud, comply with law and operate the platform under appropriate agreements.

Categories that may be collected

DATA MAP REQUIRED

Identity

Legal name, address, date of birth, Social Security number or TIN, citizenship or tax information and identity documentation where necessary.

Employment

Employer, eligibility, compensation or payroll information, contribution elections and program terms.

Financial

Linked bank information, brokerage information, balances, transactions, contributions, withdrawals and tax-document information.

Investment profile

Objectives, time horizon, risk tolerance, liquidity needs, expected use of funds, financial circumstances and relevant experience.

Technical

Device, browser, IP address, security logs, authentication events, consent records and product interactions.

Communications

Support requests, employer-program communications and legally required records.

Why information may be used

PURPOSE REVIEW REQUIRED
  • Determine employer-program eligibility and administer contribution rules.
  • Open, maintain and service an account through the future brokerage/custody provider.
  • Verify identity, prevent fraud, screen for sanctions and support legal compliance.
  • Process authorized payroll contributions, employer contributions, transfers and withdrawals.
  • Provide portfolio-selection experiences and, only after approval, any permitted recommendation process.
  • Deliver statements, tax documents, agreements, notices and customer support.
  • Protect the platform, monitor availability and investigate incidents.
  • Meet recordkeeping, regulatory, legal and audit obligations.

Categories of recipients

VENDOR INVENTORY REQUIRED

Depending on the final service model, recipients may include the contracted broker/custodian, banking and payment providers, payroll and benefits integration providers, identity-verification and fraud-prevention vendors, cloud and security providers, professional advisers, regulators and other parties required by law.

Information may also be shared at a user’s direction or with appropriate authorization. The final policy will identify categories and purposes based on the completed data inventory.

Employer access

PRIVACY BOUNDARY

Employer dashboards are intended to show program-level information such as participating employees, participation percentage, total employer and employee contributions, average contribution and utilization.

They are not designed to show individual portfolio selections, individual balances, individual withdrawals or individual investment performance unless a specific lawful purpose, disclosure and authorization have been approved.

Data retention

SCHEDULE REQUIRED

CapitalEvolve intends to retain information only for as long as needed for the purposes described, account servicing, security, dispute resolution and applicable legal, tax, audit and regulatory obligations. Specific periods depend on the final entity roles, provider agreements and applicable law.

Internal publication gate

Insert the approved retention schedule and deletion exceptions after the data inventory and regulatory recordkeeping analysis are complete.

Security practices

PROGRAM IN DEVELOPMENT

CapitalEvolve is building its security program with controls designed to support recognized security and compliance frameworks. Planned areas include encryption, multi-factor authentication, least-privilege access, monitoring, vendor risk management, incident response and business continuity.

CapitalEvolve does not claim SOC 2 or ISO 27001 certification. See Security at CapitalEvolve.

Privacy rights

JURISDICTION REVIEW REQUIRED

Depending on location and applicable law, a person may have rights to request access, correction, deletion or a copy of certain information, to limit certain uses, to opt out of certain processing or to appeal a rights-request decision.

The production experience will explain available rights, identity-verification steps, authorized-agent procedures, response timing, exceptions and any appeal process. Financial information may be subject to different laws and exemptions than general consumer data.

Submit a privacy request

WORKFLOW REQUIRED

Privacy contact:

This placeholder must be replaced with a monitored intake channel, verification procedure, case tracking and appeal process before launch.