← Back to home

Privacy Policy

Last Updated: March 9, 2026

CastleFort Technologies Inc. ("CastleFort," "we," "us," or "our") operates the CastleFort Fundraise QB platform (the "Service"). This Privacy Policy explains how we collect, use, store, and protect your information when you use our Service.

By accessing or using the Service, you agree to the terms of this Privacy Policy. If you do not agree, please do not use the Service.

1. Information We Collect

1.1 Account Information

When you create an account, we collect:

  • Name and email address provided during registration
  • Authentication credentials managed through our identity provider (Clerk)
  • Role and permissions assigned within your organization's workspace

1.2 Organization and Workspace Data

To deliver the Service, we store data your organization creates within its workspace, including:

  • Organization details (company name, workspace configuration)
  • Team member information (names, emails, assigned roles)

1.3 CRM and Pipeline Data

The core of the Service involves managing fundraising relationships. Your organization may enter and manage:

  • VC firm profiles (firm name, website, location, notes)
  • Contact records (names, roles, email addresses, phone numbers, LinkedIn profiles, locations)
  • Portfolio company records (company name, industry, stage, website)
  • Deal and investment history (round types, amounts, dates, lead investor status)
  • Pipeline leads (status, tier, probability, commitment amounts, custom fields)
  • Interaction history (type of interaction such as calls, emails, meetings, or notes; date; and a user-provided summary describing the interaction)

We collect and store this CRM data solely to power the features you use every day -- including relationship tracking, pipeline management, and actionable insights that help your team raise capital more effectively. This data belongs to your organization. We do not sell, license, or share your CRM data with third parties for their own commercial purposes.

1.4 Virtual Data Room

The Service includes a virtual data room (VDR) that allows your organization to share confidential documents with potential investors. In connection with the VDR, we collect and store:

  • Uploaded documents (files up to 50 MB, stored in Cloudflare R2 cloud storage, keyed by your organization's tenant identifier)
  • Document metadata (file name, type, size, category, uploader identity, upload date)
  • Access grants (email address, contact name, access scope, expiration date, revocation status, and the identity of the team member who granted access)
  • Access activity logs (login events, document views, document downloads, and search queries, each recorded with the accessor's email, IP address, user agent, and timestamp)
  • NDA acceptance records (email, acceptance timestamp, IP address, and user agent, stored as proof of agreement)
  • AI-generated document summaries and highlights (see Section 5)

When an external party (such as a potential investor) accesses your data room via a magic link, their email address, IP address, user agent, and all viewing and download activity are logged and made available to your organization's administrators. Search queries submitted by external viewers are stored verbatim and visible to administrators.

1.5 Collaboration Data

When team members collaborate within the Service, we store:

  • Comments and notes attached to pipeline leads
  • Connection strength assessments between team members and contacts
  • "Raised hand" signals from advisors indicating potential introductions

1.6 System and Usage Data

To maintain and improve the Service, we automatically collect:

  • Activity logs (actions taken within the platform, for audit trail purposes)
  • User preferences (display settings, column visibility, sort preferences)
  • Technical data (browser type, IP address, device information for security monitoring)

2. How We Use Your Information

We use the information we collect to:

  • Provide and operate the Service, including CRM management, pipeline tracking, and fundraising coordination
  • Deliver personalized insights, such as relationship summaries, interaction timelines, and pipeline analytics that help your team make better fundraising decisions
  • Enable team collaboration, including shared notes, connection mapping, and advisor coordination
  • Maintain security and integrity, including authentication, access control, tenant isolation, and audit logging
  • Communicate with you about account matters, service updates, security alerts, and support inquiries

We do not use your CRM data, interaction history, or pipeline data to improve the Service or develop new products. Service improvement relies solely on aggregate, anonymized usage patterns.

3. What We Do Not Do

We believe transparency about what we will never do is as important as disclosing what we do:

  • We never share data between tenants. Your organization's data is completely isolated from every other organization on the platform.
  • We never sell your data to third parties. Not to data brokers, not to advertisers, not to investors -- not to anyone.
  • We never use your data to train AI models. Your CRM data, interaction history, pipeline information, and any other content you create is never used as training data for any machine learning or artificial intelligence model, whether our own or a third party's. When AI-assisted features are available, your data may be processed by our AI provider to generate responses for your organization only -- it is never retained by the AI provider for model improvement (see Section 5).
  • We never use tracking pixels or third-party advertising cookies.
  • We never access your data without a legitimate operational reason (e.g., support requests you initiate, security incident response).

4. How We Protect Your Information

4.1 Multi-Tenant Isolation

Every organization's data is logically isolated at the database level. Every database query is scoped to your organization's tenant identifier. No organization can view, access, or modify another organization's data under any circumstances.

4.2 Role-Based Access Control

Within each organization, access is governed by role-based permissions (Admin, Member, Advisor). Each role has defined capabilities, and sensitive operations require appropriate authorization. Permission checks are enforced server-side on every API request.

4.3 Infrastructure Security

  • Encryption at rest: Data is stored on Cloudflare's D1 database infrastructure with default encryption at rest
  • Encryption in transit: All data transmitted between your browser and our servers is encrypted using TLS/SSL (Full Strict mode)
  • Authentication: Managed through Clerk, an enterprise-grade identity platform with support for multi-factor authentication
  • API security: All endpoints enforce authentication, tenant-scoped authorization, and input validation via parameterized queries (preventing SQL injection)
  • Code security: Static analysis via GitHub CodeQL on every deployment
  • Error monitoring: Application errors are tracked via Sentry for rapid resolution, with sensitive data scrubbed from error reports

4.4 Data Minimization

We collect only the data necessary to provide the Service. CRM data such as interaction history is entered voluntarily by your team and is used exclusively to deliver the features your organization relies on.

5. AI-Assisted Features

5.1 How AI Features Work

The Service includes AI-assisted features that use third-party large language models to help you query, summarize, and analyze your fundraising data. These features include document summarization in the virtual data room, natural language search over data room documents, and conversational AI tools. When you use an AI feature:

  • What is sent: Your query and the minimum contextual data from your workspace necessary to generate a relevant response are transmitted to our AI provider. For document summarization, the extracted text content of uploaded documents is transmitted. For natural language search, the search query and relevant document excerpts are transmitted.
  • What is not sent: Authentication credentials, payment information, and data belonging to other organizations are never transmitted to AI providers.
  • What is stored: AI-generated summaries, highlights, and search results are stored within your workspace as part of your organization's data, subject to the same retention and security policies as all other data. These summaries may be visible to external parties who have been granted data room access.

5.2 AI Provider Data Handling

Our AI features are powered by Anthropic's Claude API under Anthropic's Commercial Terms of Service, which contractually prohibit Anthropic from using your data to train AI models. Specifically:

  • No model training: Data transmitted to Anthropic is not used to train, improve, or fine-tune any AI model.
  • Limited retention: Anthropic may retain transmitted data for a short period (currently up to 7 days) solely for abuse prevention and safety monitoring, after which it is automatically deleted. Zero Data Retention arrangements are available for organizations with heightened compliance requirements.
  • No cross-tenant exposure: Your data is never used to generate responses for other customers, whether of CastleFort or of Anthropic.
  • Tenant-scoped queries: AI features query only your organization's data, enforcing the same tenant isolation that applies throughout the Service.

5.3 AI Content in the Virtual Data Room

AI-generated document summaries, highlights, and search results may be visible to external parties who have been granted access to your organization's virtual data room. These outputs are generated from the content of uploaded documents and are provided for convenience only. They do not replace the underlying source documents and should not be relied upon for investment decisions, legal analysis, or due diligence without independent verification. External viewers are presented with a notice acknowledging the limitations of AI-generated content before accessing the data room.

5.4 Automated Decision-Making

AI features within the Service are designed as assistive tools -- they surface insights and recommendations to help your team make informed decisions. The Service does not make autonomous decisions that produce legal effects or similarly significant consequences for any individual. All investment decisions, outreach strategies, and business judgments remain with your team.

6. Third-Party Service Providers

We use the following trusted service providers to operate the Service. Each provider processes data solely on our behalf, under contractual obligations to protect your information:

Provider Purpose Data Processed
Cloudflare Infrastructure hosting, database (D1), file storage (R2), CDN, SSL, vector search All application data and uploaded documents (encrypted at rest and in transit)
Clerk Authentication and identity management User names, emails, authentication tokens
Anthropic AI-assisted features (Claude API) Queries, document text for summarization, and contextual data for AI responses
Resend Transactional email delivery Recipient email addresses and email content (invites, access links)
Sentry Error monitoring and application reliability Error reports (PII scrubbed)

We do not share your CRM data, interaction history, or pipeline data with any provider except as strictly necessary to deliver the Service features described above. We maintain a sub-processor list and will provide 30 days' advance notice before adding new sub-processors that handle customer data.

7. Data Retention

  • Active accounts: We retain your data for as long as your organization maintains an active account
  • Closed fundraising rounds: Retained for historical access until your organization requests deletion
  • Account deletion: Upon request, we will delete your organization's data within 30 days, subject to any legal retention obligations
  • Uploaded documents: Retained for as long as the associated fundraising round remains in your workspace, or until your organization deletes them
  • Data room access logs: Activity logs (views, downloads, search queries) may be retained for up to 12 months for security, compliance, and audit purposes
  • NDA acceptance records: Retained indefinitely as proof of agreement, unless deletion is requested by the accepting party and permitted by law
  • Activity logs: Audit trail data may be retained for up to 12 months for security and compliance purposes
  • AI provider retention: Data transmitted to AI providers is retained by those providers only for the limited periods described in Section 5.2

8. Data Sharing

We do not sell your data. We may share information only in the following limited circumstances:

  • Service providers: As described in Section 6, we use trusted providers to operate the Service. These providers are contractually prohibited from using your data for their own purposes
  • Legal obligations: We may disclose information if required by law, regulation, or valid legal process
  • Business transfers: In the event of a merger, acquisition, or sale of assets, your data may be transferred to the successor entity, subject to this Privacy Policy. We will notify you before your data becomes subject to a different privacy policy

9. Your Rights

Depending on your jurisdiction, you may have the right to:

  • Access the personal data we hold about you
  • Correct inaccurate or incomplete data
  • Delete your personal data (subject to legal retention requirements)
  • Export your data in a portable format -- you may request a full export of your organization's data at any time
  • Object to certain processing activities
  • Withdraw consent for optional data processing (such as AI features) without affecting the core Service

To exercise any of these rights, contact us at the address below. We will respond to all requests within 30 days.

10. Cookies and Tracking

The Service uses only essential cookies for authentication and session management. We do not use:

  • Third-party advertising cookies
  • Cross-site tracking pixels or technologies
  • Analytics services that track individual user behavior across other websites

11. Children's Privacy

The Service is designed for business professionals and is not directed to individuals under 18 years of age. We do not knowingly collect personal information from children.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy within the Service, updating the "Last Updated" date above, and where appropriate, sending notice to your organization's administrator. A changelog of material updates is maintained at LEGAL_CHANGELOG.md.

13. Contact Us

If you have questions about this Privacy Policy, our data practices, or wish to exercise your data rights, please contact:

CastleFort Technologies Inc. Email: privacy@castlefort.co