# Privacy Policy — CloudLink Capital Source: https://cloudlinkcapital.com/privacy.html How CloudLink Capital handles information on its website, and how it handles advisory-firm client data as a service provider under a data processing agreement. Static page text. Interactive calculators, forms and chat are available on the canonical page. --- Legal ## Privacy Policy What we collect, what we don't, and who answers for what. ### The short version CloudLink Capital provides AI and technology services for small businesses and is developing a platform for registered investment advisers. This policy distinguishes website inquiries from any client data processed under a separate service agreement: - **This website.** If you fill in our inquiry form, we receive what you submit and use it to respond. Our providers process website-delivery data, and some RIA pages load Vercel Web Analytics to measure site usage. We do not use advertising trackers. - **Client data inside our platform.** When an advisory firm uses CloudLink, we handle that firm's client information strictly on the firm's instructions, under a written data processing agreement. The firm decides what we may do with it. We do not sell it, and we do not use it to train models. The rest of this page is the detail. ### 1. Who we are CloudLink Capital Corporation ("CloudLink," "we," "us") is a Massachusetts corporation that provides AI and technology services and is developing a governed data and workflow platform for registered investment advisers. We are not an investment adviser, we do not provide investment, legal, tax, or accounting advice, and we do not take custody of client assets. For privacy questions, contact [support@cloudlinkcapital.com](mailto:support@cloudlinkcapital.com). ### 2. Two roles, two sets of rules Most privacy policies describe one relationship. Ours describes two, and the distinction matters because it determines who you should ask about your own information. | Context | Our role | Governed by | | Our website, marketing, and business contacts | We decide how the information is used | This policy | | An advisory firm's client information inside our platform | We act only on the firm's instructions, as its service provider | Our data processing agreement with that firm | **If you are a client of an advisory firm that uses CloudLink:** your adviser, not CloudLink, is the right point of contact for questions about your information, requests to access or correct it, or requests to delete it. We are contractually required to help your adviser answer you, and we will — but the relationship, and the decision, belongs to them. Please contact your adviser directly. ### 3. Information we collect through this website #### What you give us If you submit our contact form, we receive the information you enter — typically your name, email address, business or firm name, selected service, message, and optional website and service area. We also record the page or outreach link you used. We use this information to review your inquiry, respond to you and follow up about CloudLink. We may inspect the public website you supply and use AI to help prepare a reply for human review. We do not add you to unrelated marketing lists, and we do not sell or share your inquiry with anyone for their own marketing. For AI-assisted follow-up drafts, we request that the model provider not store the response as application state. This does not eliminate separate security and abuse-monitoring retention. Drafts and review decisions are stored in our private workflow records; approving a draft is separate from sending a reply. #### What is collected automatically Our hosting provider records standard server and security logs, including IP address, timestamp, requested page, referring page, and browser user-agent. These exist to serve the site, keep it available, and defend against abuse. #### What we don't do - No advertising or cross-site tracking pixels. - Some RIA pages use Vercel Web Analytics to measure site usage. The small-business and audience-selection pages do not load that analytics script. - No cookies set by CloudLink. Interactive tools on this site, such as the ROI calculator, run entirely in your browser — the figures you enter are not transmitted to us or stored by us. - No sale of personal information, and no sharing of it for cross-context behavioral advertising. ### 4. Service providers for this website The following providers support the website and inquiry workflow: | Provider | Purpose | What it sees | | Vercel | Website hosting, delivery and analytics on some RIA pages | Server and security logs, including IP address; site-usage information where analytics is loaded | | Tally | Inquiry forms and submission storage | What you submit, routing information, and a conversation reference if you share a chat | | Twenty (self-hosted) | Contact records and follow-up | Your submitted inquiry and any chat transcript you choose to share | | OpenAI | Website chat answers and follow-up drafts for human review | Chat messages, relevant inquiry details, visitor messages from a shared conversation, and observations about a submitted public website | | Google Fonts | Typeface delivery | IP address, when your browser requests a font file | Each acts on our behalf and is not permitted to use the information for its own purposes. ### 5. Advisory-firm client data inside the platform When an advisory firm engages CloudLink, our platform reads data from systems the firm already uses — its CRM, portfolio accounting, financial planning tools, custodial data feeds, email, and calendar — into a data model that the firm owns. That data can include nonpublic personal information about the firm's clients. We handle it under a written data processing agreement with the firm. Our commitments in that agreement include: - **Purpose limitation.** We use the firm's data only to operate that firm's own environment and deliver the services it has configured. Nothing else. - **No training on firm data.** The firm's data is not used to train our models, any shared model, or any other firm's model. Where we route data to a third-party model provider, we do so under terms that prohibit training on it and limit retention. - **No sale, ever.** We do not sell client data or share it for anyone's marketing. - **Data minimization.** We classify data at the point of ingest and pull only what the firm's configured workflows require. - **Isolation.** Each firm's data is separated from every other firm's, structurally, with its own encryption keys. - **Encryption.** Encrypted in transit and at rest, with per-firm keys. - **Audit.** Access to and processing of firm data is recorded in a tamper-evident log the firm can inspect and export. - **Human approval.** Client-facing output our software drafts is reviewed and approved by a person at the firm before it is sent. The firm's people remain the authors of record. - **Deletion on exit.** When an engagement ends, the firm receives an export and we delete its data, including destroying its encryption keys. - **Sub-processors.** We maintain a current register of the cloud and model providers involved, disclose it to the firm, pass these obligations down to them by contract, and notify the firm before it changes. - **Breach notification.** If firm data is compromised, we notify the firm promptly and with enough detail for it to meet its own notification duties, within the timeframe set in our agreement. The authoritative version of these commitments is the executed agreement with the firm, not this page. Firms and their compliance officers can request our data processing agreement, security architecture, written information security program, and sub-processor register at [support@cloudlinkcapital.com](mailto:support@cloudlinkcapital.com). Our [Security & Trust](https://cloudlinkcapital.com/security.html) page answers the standard due-diligence questionnaire. ### 6. How long we keep things Contact-form submissions, qualification decisions, follow-up drafts, review records and business correspondence: as long as needed for the business relationship, and then as needed for our records. Suspicious inquiries may be held in a private review queue before a CRM contact is created. Server and security logs: a short rolling window, then discarded. Advisory-firm client data: for the term of the agreement with that firm, then exported and deleted per that agreement and the firm's instructions. ### 7. Security We encrypt data in transit and at rest, hold per-firm encryption keys in a managed key service, enforce least-privilege and time-bound access for our own personnel with multi-factor authentication, log administrative access, and maintain a written information security program. Our security architecture is documented and available to prospective customers under a confidentiality agreement. No system is perfectly secure. We will not claim otherwise. ### 8. Your choices For information you have given us through this website, you may ask us to provide a copy of it, correct it, or delete it. Email [support@cloudlinkcapital.com](mailto:support@cloudlinkcapital.com) and we will respond as required by applicable law. Depending on where you live, you may have additional rights; we honor those that apply to us, and we do not discriminate against anyone for exercising them. For information held inside an advisory firm's environment, please contact that firm. See section 2. ### 9. Other things worth stating plainly #### Children This website and our platform are for business use. We do not knowingly collect information from children through this website. #### Where data is held We are a United States company. Tally stores website form submissions in Europe. Shared website chat transcripts use private Vercel storage in the United States, and submitted inquiries may also be stored in our self-hosted Twenty CRM. Platform data residency is configurable by contract. #### Links to other sites Where we link out, that site's privacy practices are its own. ### 10. Changes to this policy If we change this policy we will update the date below. Where a change materially affects how we handle advisory-firm data, the notice provisions in our agreement with that firm govern, and we will notify the firm directly rather than relying on a website update. **Last updated:** 24 September 2026 ### 11. Contact CloudLink Capital Corporation 20 Corporate Drive Burlington, MA 01803 United States [support@cloudlinkcapital.com](mailto:support@cloudlinkcapital.com) ### Website AI chat The optional website assistant sends your messages and recent conversation to OpenAI through our server to generate an answer. Please do not enter confidential information, passwords, financial records or customer data. AI answers can be inaccurate and do not constitute a quote, appointment or advice. The conversation stays in this browser tab while you use chat. We request that OpenAI not store the response as application state; this does not eliminate the provider’s security and abuse-monitoring retention. Our application logs request timing, model and token usage, prompt/catalog versions and aggregate handoff events, not chat text. The browser warns about some recognizable sensitive details before sending and lets you remove them; detection is incomplete. A signed conversation receipt stays in the browser and expires after two hours. It verifies message integrity, not the truth of visitor statements. Hosting and provider services may retain operational metadata under their own policies. Chat alone does not create a CRM contact. Choosing “Share chat & request follow-up” saves a snapshot of the conversation in private Vercel storage and opens our Tally contact form. Only a conversation reference is included in the form link; the transcript is not put in the URL. Submitting your name and email links that snapshot to your contact record in our Twenty CRM for responding and following up. We also prepare a structured brief using quoted visitor statements, with missing details marked unknown, and screen shared visitor messages before CRM delivery. Your email is self-reported, not verified by chat. Closing the form without submitting does not create a CRM contact, although the shared snapshot remains in private storage. You can use the ordinary contact form without sharing a chat. It does not subscribe you to a newsletter.