Legal
What we collect, what we don't, and who answers for what.
CloudLink Capital provides AI and technology services for small businesses and is developing a platform for registered investment advisers. This policy distinguishes website inquiries from any client data processed under a separate service agreement:
The rest of this page is the detail.
CloudLink Capital Corporation ("CloudLink," "we," "us") is a Massachusetts corporation that provides AI and technology services and is developing a governed data and workflow platform for registered investment advisers. We are not an investment adviser, we do not provide investment, legal, tax, or accounting advice, and we do not take custody of client assets.
For privacy questions, contact support@cloudlinkcapital.com.
Most privacy policies describe one relationship. Ours describes two, and the distinction matters because it determines who you should ask about your own information.
| Context | Our role | Governed by |
|---|---|---|
| Our website, marketing, and business contacts | We decide how the information is used | This policy |
| An advisory firm's client information inside our platform | We act only on the firm's instructions, as its service provider | Our data processing agreement with that firm |
If you are a client of an advisory firm that uses CloudLink: your adviser, not CloudLink, is the right point of contact for questions about your information, requests to access or correct it, or requests to delete it. We are contractually required to help your adviser answer you, and we will — but the relationship, and the decision, belongs to them. Please contact your adviser directly.
If you submit our contact form, we receive the information you enter — typically your name, email address, business or firm name, selected service, message, and optional website and service area. We also record the page or outreach link you used. We use this information to review your inquiry, respond to you and follow up about CloudLink. We may inspect the public website you supply and use AI to help prepare a reply for human review. We do not add you to unrelated marketing lists, and we do not sell or share your inquiry with anyone for their own marketing.
For AI-assisted follow-up drafts, we request that the model provider not store the response as application state. This does not eliminate separate security and abuse-monitoring retention. Drafts and review decisions are stored in our private workflow records; approving a draft is separate from sending a reply.
Our hosting provider records standard server and security logs, including IP address, timestamp, requested page, referring page, and browser user-agent. These exist to serve the site, keep it available, and defend against abuse.
The following providers support the website and inquiry workflow:
| Provider | Purpose | What it sees |
|---|---|---|
| Vercel | Website hosting, delivery and analytics on some RIA pages | Server and security logs, including IP address; site-usage information where analytics is loaded |
| Tally | Inquiry forms and submission storage | What you submit, routing information, and a conversation reference if you share a chat |
| Twenty (self-hosted) | Contact records and follow-up | Your submitted inquiry and any chat transcript you choose to share |
| OpenAI | Website chat answers and follow-up drafts for human review | Chat messages, relevant inquiry details, visitor messages from a shared conversation, and observations about a submitted public website |
| Google Fonts | Typeface delivery | IP address, when your browser requests a font file |
Each acts on our behalf and is not permitted to use the information for its own purposes.
When an advisory firm engages CloudLink, our platform reads data from systems the firm already uses — its CRM, portfolio accounting, financial planning tools, custodial data feeds, email, and calendar — into a data model that the firm owns. That data can include nonpublic personal information about the firm's clients.
We handle it under a written data processing agreement with the firm. Our commitments in that agreement include:
The authoritative version of these commitments is the executed agreement with the firm, not this page. Firms and their compliance officers can request our data processing agreement, security architecture, written information security program, and sub-processor register at support@cloudlinkcapital.com. Our Security & Trust page answers the standard due-diligence questionnaire.
Contact-form submissions, qualification decisions, follow-up drafts, review records and business correspondence: as long as needed for the business relationship, and then as needed for our records. Suspicious inquiries may be held in a private review queue before a CRM contact is created. Server and security logs: a short rolling window, then discarded. Advisory-firm client data: for the term of the agreement with that firm, then exported and deleted per that agreement and the firm's instructions.
We encrypt data in transit and at rest, hold per-firm encryption keys in a managed key service, enforce least-privilege and time-bound access for our own personnel with multi-factor authentication, log administrative access, and maintain a written information security program. Our security architecture is documented and available to prospective customers under a confidentiality agreement.
No system is perfectly secure. We will not claim otherwise.
For information you have given us through this website, you may ask us to provide a copy of it, correct it, or delete it. Email support@cloudlinkcapital.com and we will respond as required by applicable law. Depending on where you live, you may have additional rights; we honor those that apply to us, and we do not discriminate against anyone for exercising them.
For information held inside an advisory firm's environment, please contact that firm. See section 2.
This website and our platform are for business use. We do not knowingly collect information from children through this website.
We are a United States company. Tally stores website form submissions in Europe. Shared website chat transcripts use private Vercel storage in the United States, and submitted inquiries may also be stored in our self-hosted Twenty CRM. Platform data residency is configurable by contract.
Where we link out, that site's privacy practices are its own.
If we change this policy we will update the date below. Where a change materially affects how we handle advisory-firm data, the notice provisions in our agreement with that firm govern, and we will notify the firm directly rather than relying on a website update.
Last updated: 24 September 2026
CloudLink Capital Corporation
20 Corporate Drive
Burlington, MA 01803
United States
support@cloudlinkcapital.com
The optional website assistant sends your messages and recent conversation to OpenAI through our server to generate an answer. Please do not enter confidential information, passwords, financial records or customer data. AI answers can be inaccurate and do not constitute a quote, appointment or advice.
The conversation stays in this browser tab while you use chat. We request that OpenAI not store the response as application state; this does not eliminate the provider’s security and abuse-monitoring retention. Our application logs request timing, model and token usage, prompt/catalog versions and aggregate handoff events, not chat text. The browser warns about some recognizable sensitive details before sending and lets you remove them; detection is incomplete. A signed conversation receipt stays in the browser and expires after two hours. It verifies message integrity, not the truth of visitor statements. Hosting and provider services may retain operational metadata under their own policies.
Chat alone does not create a CRM contact. Choosing “Share chat & request follow-up” saves a snapshot of the conversation in private Vercel storage and opens our Tally contact form. Only a conversation reference is included in the form link; the transcript is not put in the URL. Submitting your name and email links that snapshot to your contact record in our Twenty CRM for responding and following up. We also prepare a structured brief using quoted visitor statements, with missing details marked unknown, and screen shared visitor messages before CRM delivery. Your email is self-reported, not verified by chat. Closing the form without submitting does not create a CRM contact, although the shared snapshot remains in private storage. You can use the ordinary contact form without sharing a chat. It does not subscribe you to a newsletter.