Privacy Policy

Privacy Policy

This policy explains what personal data EquityFlowX holds about you, why it holds it, how long it keeps it, and what you can do about it. Where it states a retention period or lists a cookie, that figure is read from the platform’s own configuration rather than written out by hand, so it describes the system as it is now rather than as it was when somebody last edited this page.

Who we are

EquityFlowX operates this platform and decides how and why the personal data described below is used. In data-protection language we are the controller of that data. The company is incorporated in DE, United States.

Questions about this policy, or about the data we hold on you, should go to the contact address at the end of this document. You do not need to give a reason for asking.

Which laws apply

EquityFlowX is a United States platform, and United States federal and state law governs how it handles personal data. Several state privacy statutes give residents specific rights — California, Colorado, Connecticut, Virginia, Utah and Texas among them — and those are set out under Rights in your state below.

Because the platform handles financial information, some of what we hold is also subject to federal financial-privacy and securities recordkeeping rules. Where those rules require a record to be kept, they take precedence over a request to delete it. That conflict is real, and we would rather state it here than have you discover it later.

If you are in the United Kingdom or the European Economic Area and we offer you services there, the UK GDPR or EU GDPR may also apply. In that case the lawful bases in the next section are the ones we rely on, and you keep the rights those regimes give you in addition to anything described here.

What we collect

Only what the platform needs to do the thing you asked it to do.

• Your account — name, email address, phone number, and the status of your account.
• Verification — date of birth, address, citizenship and a tax identifier, together with the outcome of identity and accredited-investor checks. The tax identifier is stored but is redacted from the audit log and is never included in a data export.
• Transactions — listings, offers, negotiations and completed transfers you are a party to, including the issuer approvals behind them.
• Support — the contents of tickets and live chats you take part in. If you start a chat without an account we hold the name and email you gave, and the IP address the conversation was opened from.
• Analytics — pages viewed, but only while you have analytics cookies switched on. See below.

Why we use it

Where we rely on legitimate interests, we have considered whether our interest is outweighed by your privacy and concluded it is not — largely because the data used for those purposes is minimal and short-lived. You can object; see Your rights.

How long we keep it

These periods are enforced automatically by a scheduled job, not by anybody remembering to run one.

Cookies

You are asked once, and refusing is a single click in the same place as accepting. You can change the decision at any time from the Cookie preferences link in the footer of every page.

Strictly necessary

Required to sign in, keep you signed in, and protect forms from cross-site request forgery. The site cannot work without these.

Required for the site to work, and not offered as a choice.

• equityflowx_session — Keeps you signed in and holds your session (2 hours)
• XSRF-TOKEN — Protects every form against cross-site request forgery (Session)
• efx_guest_chat — Lets you return to a support chat you started without an account (30 days)
• efx_cookie_consent — Remembers this choice, so you are not asked again (12 months)
• efx-theme (local storage) — Remembers light or dark mode — written only when you change it (Until cleared)

Analytics

Would tell us which pages people find useful and where they get stuck. Nothing is set unless you turn this on, and nothing is running today.

Optional — off unless you turn it on.

Nothing in this category is set at the moment.

Who we share it with

• The issuing company, when you transact in its shares. A private company controls who appears on its own cap table, so when a transfer is put to it for approval or for a right of first refusal, it is shown the parties and the terms. This is inherent to how private-share transfers work, and it is not something you can opt out of while still transacting.
• The other party to a transaction you enter. A counterparty sees what a counterparty must see. They are not shown your verification evidence.
• Service providers who process data on our instructions and are contractually bound to use it for nothing else — hosting, email delivery, identity and accreditation verification, and financial-crime screening.
• Regulators, auditors and law enforcement, where we are required to produce records or to respond to a lawful request.
• Professional advisers — lawyers, accountants, insurers — where they need it in order to advise us.
• A successor, if the business or part of it is acquired. This policy would continue to apply to data transferred that way until you were told otherwise.

That list is exhaustive. We do not share personal data with anybody else, and we do not sell it.

Decisions made automatically

Some things here are decided by software rather than by a person, and you are entitled to know which:

• Messages you send us are scored for spam. A message scoring highly is refused outright and never stored; a middling score is accepted but held back for a person to look at.
• Messages that appear to contain a card number or a national identifier are refused before being written anywhere, because a support desk should not be holding either.
• Identity, accreditation and sanctions checks return an outcome from a verification provider, and that outcome affects what you can do on the platform.

None of these is final. If an automated decision has gone against you, contact us and a person will look at it — including where the spam filter has refused a message you genuinely wrote. Say so, and we will find it.

How we protect it

• Passwords are stored only as a one-way hash. Nobody at EquityFlowX can read yours, and we will never ask for it.
• Two-factor authentication is available on every account, and we recommend it.
• Sessions expire after 120 minutes of inactivity, and session data is encrypted.
• Verification documents are never stored in a publicly reachable location and have no guessable address. Each retrieval is permission-checked, expires after 10 minutes, and is written to the access log.
• Actions taken on your account are recorded in an append-only audit log kept for 7 years. Passwords, two-factor secrets and tax identifiers are redacted from it rather than recorded.
• Staff access is limited by role, and reading a compliance record is itself logged.

No system is perfectly secure, and we would rather say so than imply otherwise. If you believe somebody else has reached your account, contact us immediately.

Your rights

All of these are available from your account, under Privacy, without having to ask anybody.

• See what we hold — download everything as a single file. It excludes information about other people, so the name of whoever sat on the other side of a trade is not in it.
• Withdraw consent — switch analytics off. Collection stops immediately, and what was already collected about your account is removed when you erase it.
• Erasure — we will do as much of this as the law permits, which is most but not all of it.

What erasure does not remove

This is set out plainly here rather than discovered afterwards. Completed transfers, the issuer approvals behind them, and the audit log of actions taken on your account are retained. They are the record a regulator would ask to see, and a platform that destroys them on request has destroyed the evidence it exists to produce.

Everything else goes: analytics, watchlist, notifications and guest support conversations are deleted outright, and your name, email, phone, date of birth, address and tax identifier are overwritten so the remaining records identify nobody.

Rights in your state

If you live in a state with a general privacy statute — California, Colorado, Connecticut, Virginia, Utah and Texas among them — you have the right to know what we hold, to obtain a copy, to correct it, to delete it subject to the retention limits above, and not to be treated worse for exercising any of them. Exercising these rights is free and does not change the service you receive.

California residents. We do not sell personal information and we do not share it for cross-context behavioural advertising, so there is no "Do Not Sell or Share My Personal Information" control to offer — there is nothing for it to switch off. You may use an authorised agent to make a request for you; we will ask for proof of that authority. Note that some financial information is exempt from the California statute because federal financial-privacy law already governs it, which is part of why some of your record survives a deletion request.

We answer verifiable requests within the period your state's law allows. To protect your data we do have to confirm a request came from you, which usually means replying from the email address on the account.

Children

EquityFlowX is not intended for anyone under 18, and we do not knowingly collect data about children. Transacting requires identity verification, which would not succeed for a minor. If you believe a child has given us personal data, tell us and we will delete it.

Where your data is held

Personal data is processed and stored in the United States. If you are outside the United States, using the platform means your data is transferred there, where privacy law differs from your own. Where a transfer out of the United Kingdom or the European Economic Area requires a safeguard such as Standard Contractual Clauses, we put one in place, and you can ask us for a copy.

What we do not do

• No third-party analytics. There is no Google Analytics, no advertising pixel and no session recorder on this platform. Measurement is first-party and the data does not leave our systems.
• We do not sell personal data, and we do not share it with advertisers or data brokers.
• Your data is not used to train AI models. Public marketing and legal pages may be read by crawlers, as any published web page may be. Accounts, transactions and support conversations are not.
• We will never ask for your password, card number or full bank details by email or in a support conversation. The contact form actively refuses messages that appear to contain a card number or a national identifier.

Complaints

If you think we have handled your data badly, tell us first — we would rather fix it than have you go elsewhere, and a complaint here reaches a person rather than a queue.

You can also complain to a regulator. In the United States that may be your state Attorney General or the Federal Trade Commission. In the United Kingdom it is the Information Commissioner's Office; in the European Economic Area, your national supervisory authority. Coming to us first is not a precondition for going to them.

Contact

Questions about this policy, or about the data held on you, can be sent to support@equityflowx.test or raised through the contact form, which opens a tracked support ticket rather than a message in an inbox.

Status of this platform

EquityFlowX is not a registered broker-dealer or alternative trading system. It holds no customer funds and transfers no real securities.

Changes to this policy

An administrator publishes a new version through the CMS. Earlier versions are retained so that any acceptance recorded against them continues to refer to the wording that was actually accepted.