Privacy
Privacy policy
Last updated: March 4, 2026 · Contact: capital@canfundcapital.com
This policy explains what CanFund Capital collects when you apply, how uploaded bank and processor data is used, how long records are kept, and how to request deletion.
What data we collect
Application data you submit (business identity, contact details, funding need), financial data contained in the business bank statements you upload, credit report data obtained under a soft or hard inquiry, and standard technical data such as IP address and device type.
How financial account connections work
We do not connect to your bank accounts and never request online banking credentials, so nothing we hold can initiate a transfer. Uploaded statements are encrypted in transit and at rest and retained only as long as required for underwriting and regulatory recordkeeping.
How we use data
To evaluate applications, price and structure offers, verify identity and prevent fraud, service active positions, meet legal and regulatory obligations, and improve underwriting model performance.
Who we share data with
Service providers acting on our behalf (data aggregation, identity verification, payment processing, cloud infrastructure), bank partners where a partnership structure applies, and regulators or law enforcement where legally required. We do not sell personal information.
Retention
Application and servicing records are retained for the period required by applicable law and internal policy — seven years after final settlement. Connection tokens are deleted upon revocation or account closure.
Your rights
Depending on jurisdiction, you may have rights to access, correct, delete, or port your data, and to opt out of certain processing under statutes such as the CCPA/CPRA in California.
Security
Data is encrypted in transit and at rest, access is role-restricted and logged, and third-party providers are subject to security review.