Privacy Policy

This Privacy Policy explains what information CapFit collects when you use the platform, why we collect it, how we handle it, and the choices and rights available to you. It applies to the CapFit website, your account and the assessment service.

CapFit determines the purposes and means of processing the personal data described here and is responsible for it. Where Indian data protection law applies, we act as the data fiduciary for that data.

1. Information we collect

Account information. Your name, email address and account status, together with authentication information created when you register or sign in.

Business information. Details about the business you represent, such as its name, sector, structure, location, stage and the financing objective you are pursuing.

Financial information. Figures you enter or confirm, such as revenue, costs, assets, liabilities, borrowings and cash position, and the financial statements or supporting documents you choose to upload.

Documents. Files you upload, and the text and figures extracted from them so the platform can present them for your confirmation.

Assessment and report data. The answers you give, the observations and outcomes the platform derives, and the reports it produces.

Transaction information. A record of purchases, including amount, currency, status, timestamps and references supplied by the payment gateway. We do not collect or store your full card number, CVV, UPI PIN, net-banking credentials or any equivalent payment secret.

Operational information. Technical and usage records generated when you use the platform, including log and error information used to keep the service secure and working, and records of notification emails the platform has attempted to send you.

2. How we collect it

Most of the information above comes directly from you, when you register, complete an assessment, upload a document or make a purchase.

Some information is generated by the platform as you use it, such as derived figures, assessment outcomes, audit records of changes made to your account by our operators, and technical logs.

Some information comes from the service providers we use, such as a payment status returned by the payment gateway.

3. Why we use it

To provide the service: to create and secure your account, run assessments, produce reports, and make purchased features available to you.

To process payments and manage entitlements, refunds and related records.

To communicate with you about your account, your assessments, your purchases and material changes to the service.

To operate, secure and improve the platform, including diagnosing faults, preventing misuse and maintaining audit records of privileged actions.

To meet legal, accounting and regulatory obligations, and to establish, exercise or defend legal claims.

We do not sell your personal data. We do not use your business or financial information to make automated decisions that produce legal effects for you: the platform's output is informational and is not a lending decision.

4. The basis on which we process it

We process your information because it is necessary to provide the service you have asked for and to perform our contract with you, because you have consented where consent is required, or because we have a legitimate or legal reason such as securing the platform or complying with an obligation.

Where we rely on consent, you may withdraw it. Withdrawing consent does not affect processing already carried out, and it may mean we can no longer provide part of the service.

5. Sharing your information

We share information with service providers who process it on our behalf and under our instructions: cloud hosting and database providers, file storage, authentication, the payment gateway, and our email delivery provider. They may access your information only as needed to perform their function.

We may disclose information where we are required to by law, court order or a lawful request from an authority, or where disclosure is necessary to protect our rights, the platform, or the safety of others.

If our business is reorganised, merged or transferred, information may be transferred as part of that transaction, subject to this Policy continuing to apply.

We do not share your business or financial information with any lender, investor or institution unless you choose to share your report with them yourself.

6. Payment information

Payments are processed by a third-party payment gateway. Your payment credentials are provided directly to that gateway and are handled under its own privacy policy and security standards.

CapFit receives only the outcome of the payment and the references needed to reconcile it, such as the order and payment identifiers, amount, currency and status.

7. Storage and location

Your information is stored using cloud infrastructure and may be processed on servers located outside India, depending on where our service providers operate.

Where information is transferred outside India, we take reasonable steps to ensure it remains protected to a standard consistent with this Policy and with applicable law.

8. Security

We use technical and organisational measures appropriate to the sensitivity of the information, including encrypted transport, access controls that limit which roles can see which records, ownership checks so that an account can reach only its own assessments, and audit records of privileged operator actions.

No system can be guaranteed completely secure. You are responsible for keeping your account credentials confidential and for telling us promptly if you believe your account has been compromised.

9. Retention: how long we keep it

Our retention approach is to keep your information for as long as you hold an account, and for as long afterwards as is necessary for the purposes described here, including to meet legal, tax, accounting and audit obligations and to resolve disputes.

Transaction and audit records are kept for the period required by applicable law, which may be longer than the life of your account. Where information is no longer needed, we delete it or render it no longer attributable to you.

10. Your rights

Subject to applicable law, you may ask us for access to the personal data we hold about you and for a summary of how it is processed; ask us to correct data that is inaccurate, incomplete or out of date; ask us to erase data we no longer need; and withdraw a consent you have given.

You may also nominate another individual to exercise your rights in the event of your death or incapacity, where the law provides for it.

To exercise any of these rights, or to raise a grievance about how your information has been handled, contact us using the details published on our contact page. We may need to verify your identity before acting. If you are not satisfied with our response, you may complain to the relevant data protection authority.

11. Cookies and similar technologies

The platform uses cookies and equivalent browser storage that are necessary for it to work, principally to keep you signed in and to maintain the security of your session.

We do not use advertising cookies and we do not sell information collected through cookies. You can control cookies through your browser, but disabling those necessary for sign-in will prevent the platform from working.

12. Children

The platform is intended for business use by adults and is not directed at children. We do not knowingly collect personal data from a child. If you believe a child has provided us with personal data, contact us and we will take appropriate steps.

13. Changes to this Policy

We may update this Policy. The version published on this page, with its effective date, is the version that applies. Where a change is material, we will take reasonable steps to notify you.

14. Contact and grievances

Questions about this Policy, requests to exercise your rights, and grievances about the handling of your information can be raised using the details published on our contact page. We aim to acknowledge a grievance within a reasonable period and to resolve it promptly.