Privacy Policy

1. Who we are

The controller of your personal data is GEXCAP INC, 2423 SW 147th Ave, #4006, Miami, FL 33185-4082 (“GEXCAP”, “we”). It runs the platform at gexcap.com, where people buy and sell fractional certificates in assets.

Questions or requests about your data: privacy@gexcap.com, or the form below.

2. What we collect

Account: Email address, telephone number if you give one, full name, language, and the sign-in method you use (one-time code by email, or Google). We never see a Google password.
Investor verification: Date of birth, country of residence, whether you act as an individual or a company, the company name and registration number, and the identity and address documents you upload. These are checked automatically by an AI model and, where needed, by an operator.
Sanctions and anti-money-laundering checks: The result of screening your name and country against sanctions rules, and the decision taken.
If you list an asset: The details and documents about the asset, and the payout details of the beneficiary: name, bank name and IBAN or account number.
Transactions: What you subscribe to, hold, sell or redeem; the ledger and register entries that record it; certificates and contracts issued to you; your payout details if you receive money; and, for payments through Stripe, the payment’s reference, amount, status, and the links to your invoice and receipt.
Records of your agreement: When you accept our Terms: which version, when, the IP address and the browser identifier (user agent) it came from.
Messages: What you write to the other party in a deal, and to us.
Devices and sessions: A label for each signed-in device (Phone, Computer), when it was last used, and the IP address of the sign-in, so that you can see and revoke your sessions.
Technical logs: Our web server records the IP address, time, address requested and browser identifier of each request, for security and to keep the service running.
Requests to us: What you send through the form below or by email.

We do not buy data about you from anyone, and we do not use advertising or analytics trackers.

3. Why we use it, and on what basis

To provide the service you asked for — your account, subscriptions, certificates, contracts, payouts. Basis: contract.
To meet the law — identity verification, sanctions screening, anti-money-laundering and tax record-keeping. Basis: legal obligation.
To keep the platform safe — fraud and abuse prevention, rate limits, security logs, proof that a person accepted the Terms. Basis: our legitimate interests.
To answer you — support and the requests you file. Basis: contract, or legitimate interests.
Anything else only with your consent, which you can withdraw at any time.

4. Automated decisions

An AI model (Claude, by Anthropic) reviews investor verification files and new listings against criteria set by GEXCAP, and it can approve or reject. It does not act alone and without recourse: every decision and its reasons are recorded, an operator can override it, and you can ask for a person to review it and to hear the reasons — use the form and choose “Other”.

Resend — delivers the sign-in and notification emails (your email address and the message).
Stripe — if you pay by card or bank debit: it receives your payment details directly on its own page (GEXCAP never sees your card number or bank login), and it issues your invoice and receipt.
Google — only if you choose to sign in with Google.
Anthropic — receives the verification documents and listing text that the AI review needs. If we ever change this review to another provider, this page names it first.
OpenStreetMap — the map tiles load from its servers, so it sees your IP address when you open a map.
Banks and payment partners — to receive and pay out money, to the extent needed to do so.
Our hosting and infrastructure providers — they store and run the platform for us under contract.
The other party in a deal — a beneficiary sees what a deal needs, such as your name on a certificate or a message you sent. Not your documents.
Authorities, courts and professional advisers — where the law requires it or to defend a legal claim.

We do not sell your personal data and we do not share it for cross-context behavioural advertising.

6. Transfers across borders

GEXCAP is based in the United States and so are most of the providers above, so your data is processed there. Where the law of your country requires a safeguard for that transfer, we put one in place before it happens.

7. How long we keep it

Account and profile: while the account is open, and until your erasure request is handled.
Verification files: while you are an investor, then for as long as the law requires us to keep them.
Ledger, register, certificates, signed contracts, payout and anti-money-laundering records: at least five years after the relationship ends. These records are insert-only by design and cannot be rewritten; they are exactly what we are required to retain.
Acceptance records of the Terms: for the life of the version you accepted and the period in which a claim could be made.
Server logs: a limited period needed for security and operations.
Requests you file here: for as long as needed to answer them and to show we did.

8. Your rights

Wherever you live, you can ask us to tell you what we hold about you, to give you a copy, to correct it, and to delete it. Depending on your law you may also object to or restrict a use, ask for your data in a portable format, and withdraw consent.

European Economic Area and United Kingdom (GDPR): all of the above, plus the right to complain to your data protection authority.
California (CCPA/CPRA): to know, delete and correct; to limit use of sensitive data; to not be discriminated against for using these rights. We do not sell or share personal data as those words are defined there.
Elsewhere: the rights your own law gives you.

Some records cannot be deleted while the law requires us to keep them (section 7). In that case we delete or anonymise everything else, and tell you what we kept and why.

9. Make a request

Use this form or write to privacy@gexcap.com. We will check that you are the person concerned before we act, and answer within one month, or sooner if your law says so.

10. Cookies and local storage

GEXCAP uses only what the service needs to work. There is no advertising, no analytics and no tracking, so there is nothing to opt out of and no consent banner.

Cookies gx_at and gx_rt — your sign-in session. Strictly necessary; httpOnly, Secure, SameSite=Lax; they last until you sign out, up to 30 days.
Cookie gx_pv — a ten-minute code used only while signing in with Google.
Local storage in your browser — your saved listings, light/dark choice and language. It never leaves your device.
Offline copy of the app — a service worker keeps a copy of the app’s own pages and fonts so it can open without a connection. It never stores your account data.

You can clear any of these in your browser settings; you will be signed out.

11. Security

Connections use HTTPS. Access to data is limited by database-level rules, and only operators can see the verification files. No system is perfectly secure; if a breach affects you, we will tell you and the authorities as the law requires.

12. Age

GEXCAP is for people aged 18 or over. We do not knowingly collect data about anyone younger; write to us and we will delete it.

13. Changes

This is version 2, last updated 2026-10-10. When it changes in a way that matters to you, we will say so in the app before the change takes effect.