Privacy Policy

1. Scope and Our Role

BAAS Kit Pro is a trading name of Capstone Limited (Company Registration No. 31000313990841), registered at 5 West Mendenhall Street, Suite 202, Bozeman, MT 59715, United States. We (“we”, “us”, or “our”) operate the website at baaskitpro.com and provide software template products for the fintech industry.

Controller vs. processor. For personal data collected when you contact us, enquire about our products, or use our Platform as a customer, we act as the data controller — we determine the purposes and means of processing. This Privacy Policy governs that relationship.

Where clients deploy our Products to process the personal data of their own end-customers, we act as a data processoron their behalf. That processing is governed by a separate Data Processing Agreement (“DPA”), not this Policy. This Policy does not govern the personal data of our clients' end-customers.

We comply with applicable data protection law including the UK GDPR, EU GDPR, and relevant United States federal and state privacy laws (including CCPA/CPRA). For data protection queries, contact us at operations@capstone-online.com.

2. Personal Data We Collect

We collect the following categories of personal data. We do not seek or knowingly collect special-category (sensitive) data.

2a. Information You Provide

When you contact us, submit an enquiry, provide a platform brief, create an account, or purchase a product, you may provide: full name, work email address, phone number, company name and role, the contents of your enquiry or brief, account credentials, and billing details. Card payment data is processed directly by our payment processor and is not stored by us.

2b. Information Collected Automatically

When you visit the Platform, we automatically collect technical and usage data including: device type, browser type and version, operating system, IP address, pages visited, time and duration of visits, and referring URLs. This data is collected via cookies and analytics tools — see our Cookie Policy for details.

2c. Information from Third Parties

We may receive limited data about you from analytics providers, marketing platforms, and identity/verification providers. This is typically aggregated or pseudonymous data used to improve the relevance of our communications and to meet compliance obligations.

3. How and Why We Use Personal Data

We use your personal data for the purposes and on the legal bases set out in the table below.

4. Sharing and Disclosure

We do not sell your personal data. We do not share your personal data for cross-context behavioural advertising as defined under the CPRA. We may share data only as follows:

• Service providers and sub-processors: hosting, payment processing, email delivery, and analytics providers, each bound by contract to process data only on our instructions and to maintain appropriate security.
• Professional advisers: lawyers, accountants, and auditors where necessary to protect our legal rights or comply with regulatory obligations.
• Authorities: law enforcement, regulators, or courts where we are legally required or permitted to disclose.
• Sumsub: for AML/KYC technology where applicable to our compliance programme. Sumsub processes data under their own privacy policy and pursuant to a data processing agreement with us.

5. International Transfers

Some service providers are based outside the UK or EEA. Where we transfer personal data internationally, we rely on adequacy decisions, Standard Contractual Clauses (SCCs) approved by the ICO or European Commission, and (for UK transfers) the International Data Transfer Agreement or UK Addendum to SCCs. Where required, we apply supplementary technical and contractual measures to ensure an essentially equivalent level of protection.

6. Retention

We retain personal data only as long as necessary for the purpose for which it was collected, or as required by law:

• Enquiry and prospect data: 3 years from last contact, unless a contract is formed.
• Account and contract records: for the duration of the relationship plus five (5) years from the end of the relationship, or such longer period as required by applicable law.
• Financial and tax records: 7 years from the relevant transaction.
• Newsletter subscriptions: until you unsubscribe, then deleted within 30 days.
• Analytics data: as configured in the analytics platform (typically 14–26 months).

After the applicable period, data is securely deleted or irreversibly anonymised.

7. Security

We implement administrative, technical, and organisational measures proportionate to the risk, including: encryption in transit (TLS/HTTPS) and at rest, access controls and least-privilege principles, password hashing, and ongoing security monitoring and review.

No method of transmission over the internet or electronic storage is completely secure. While we take reasonable steps to protect your data, we cannot guarantee absolute security. If you become aware of a potential security issue, please notify us at operations@capstone-online.com.

8. Your Rights

Subject to applicable law, you have the following rights in respect of your personal data:

• Access: to request a copy of the personal data we hold about you.
• Rectification: to correct inaccurate or incomplete data.
• Erasure: to request deletion of your data in certain circumstances.
• Restriction: to limit how we use your data in certain circumstances.
• Object: to processing based on legitimate interests or for direct marketing.
• Data portability: to receive your data in a structured, machine-readable format.
• Withdraw consent: where processing is consent-based, you may withdraw at any time without affecting the lawfulness of prior processing.

CCPA/CPRA rights (California residents). You have the right to know what personal information we collect and how it is used, to request deletion or correction, and to opt out of the sale or sharing of personal information. We do not sell or share personal information as defined under the CPRA.

To exercise any right, contact us at operations@capstone-online.com. We will respond within the timeframes required by applicable law (generally 30 days, or 45 days for CCPA requests). We may verify your identity before processing your request and will not discriminate against you for exercising your rights.

If you are not satisfied with our response, you may lodge a complaint with your supervisory authority — for UK residents, the Information Commissioner's Office (“ICO”) at ico.org.uk.

9. Children

Our Platform is not directed at individuals under the age of 16. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data about a child, please contact us at operations@capstone-online.com and we will delete it promptly.

10. Changes and Contact

We may update this Privacy Policy from time to time. Material changes will be flagged with a revised “Last updated” date at the top of this page. We encourage you to review this page periodically. Continued use of the Platform after an update constitutes acceptance of the revised Policy.