Claim Founders Pass

Privacy notice

Privacy.

How Kaptal collects, uses and shares personal data when you visit the site, buy a Challenge, complete KYC or request a reward.

Last updated 15 September 2026

1. Who we are

This notice is issued by the Kaptal operating entity identified on the Platform (the controller). Because the firm is in formation, the legal name, registration number and contact address will be added here before paid Challenges go live. Until then, use the contact methods published on the Platform for privacy requests.

Terms used here follow the Terms and, where they apply, the GDPR, UK GDPR and similar laws (including, where relevant, the CCPA/CPRA). “Personal data” means information that identifies you or can reasonably be linked to you.

2. What we collect

You give us

  • Name, email, country, date of birth and profile settings.
  • KYC data: government ID images, liveness/selfie, and where required address evidence, tax identifiers, or source-of-funds explanations.
  • Support messages, complaint files and survey replies.
  • Wallet addresses you attach for payouts or login.

Payments

Card and bank details are collected by the payment processor, not stored in full by Kaptal. We receive limited tokens, last-four digits, expiry month, billing country, and payment status.

Trading and device data we generate or log

  • Simulated and Live account identifiers, balances, orders, positions, hold times, news-window flags, IP, device fingerprint, user-agent, approximate location derived from IP, and VPN indicators.
  • Referral codes, Season/Arena progress, and marketing attribution (first referrer, campaign IDs).
  • Cookie and similar IDs as described below.

3. Why we use it

  • Contract — create the profile, deliver a Challenge, enforce the Rulebook, pay rewards, operate Live Kaptal.
  • Legitimate interests — security, abuse detection, product analytics, anonymised statistics, and defending claims. You may object as set out below.
  • Legal obligation — sanctions, tax, accounting, consumer and complaint records.
  • Consent — optional marketing email and non-essential cookies, where the law requires consent. You can withdraw consent without affecting earlier lawful use.

We do not sell personal data for money. We do not use KYC biometrics for marketing.

4. Who we share with

We share personal data only as needed with:

  • KYC, screening and fraud vendors.
  • Payment processors and payout rails (including on-chain networks you choose, which are public).
  • Cloud hosting, email, analytics and support tools that process data on our instructions.
  • Professional advisers and insurers.
  • A buyer or successor if Kaptal is reorganised, under confidentiality.
  • Authorities when the law requires it or to protect rights, safety or the Services.

Group affiliates, when they exist, may process data as controllers or processors for the same purposes. On-chain payouts you request will reveal the amount and destination address to the public internet. That is inherent to public ledgers, not a Kaptal “sale” of data.

5. International transfers

Vendors and infrastructure may sit outside your country, including outside the UK/EEA. Where required we use approved transfer tools such as the European Commission Standard Contractual Clauses, the UK addendum, or an adequacy decision, plus supplementary measures where they are needed.

6. How long we keep it

  • Open profile and trading records — for the life of the account plus a period needed for disputes and risk (typically up to 7 years after closure).
  • KYC and sanctions files — for the period required by AML and sanctions law, often 5–7 years after the last payout or close.
  • Payment records — as required by tax and accounting law.
  • Marketing consents and cookie logs — until withdrawal or the cookie expiry, then a short suppression record.
  • Server logs — typically 12 months unless needed for an investigation.

We may keep anonymised statistics indefinitely. They are no longer personal data.

7. Your rights

Depending on your location you may have the right to access, correct, delete, restrict or object to processing, to portability, to withdraw consent, and to complain to a supervisory authority (for example the ICO in the UK or your EU lead authority). California residents may have rights to know, delete, correct and to opt out of “sharing” for cross-context advertising if we ever enable it. We will not discriminate for exercising a privacy right.

We may need to refuse a deletion request where we must keep data for contract, fraud, sanctions or law. Send requests through Platform support. We may need to verify you, and we will answer within the statutory period (usually one month under GDPR).

8. Cookies and similar tech

We use strictly necessary cookies for login, security and load balancing. With consent where required we may use analytics and attribution cookies. You can block cookies in the browser; some features will then fail. We will publish a granular cookie list before marketing pixels go live.

9. Children

The Services are for adults 18 and over. We do not knowingly collect data from children. If you believe we have, contact us and we will delete it.

10. Changes

We will post updates on this page and change the date. Material changes will be notified in-product or by email where we have one.