Privacy Policy

Effective and last updated: October 14, 2026

This policy explains how Cairnul, Inc. ("Cairnul," "we," "us") collects, uses, shares and sells personal information when you:

• visit cairnul.com (the "Site");
• respond to our ads or lead forms, including Meta lead forms;
• hear from us by email, text or phone; or
• create and use a Cairnul account (the "Service").

Cairnul is a Delaware corporation based in Austin, Texas. We welcome visitors and customers from around the world. Cairnul, Inc. is the controller of the personal information described in this policy.

Customer Data. Our customers use the Service to manage their fundraising. That includes company details, tax identification numbers, cap tables, investor information, accreditation materials and documents ("Customer Data"). We process Customer Data on behalf of each customer, under our customer agreement and data processing terms, and the customer's own privacy notice applies to it. We do not sell Customer Data, and we do not use it for advertising. If you are an investor or another person whose information a customer gave us, please contact that company first. We will help them respond.

1. Information we collect

Information you give us

• Contact details: your name, email address and phone number.
• Lead form answers: for example your background, the roles or services that interest you, your preferred hours, your LinkedIn URL and your short answers.
• Messages: what you tell us by email, chat, phone or forms.
• Account information: your name, email, phone, company, role and sign-in details. Our authentication provider, Clerk, manages sign-in.

We never ask for your age, date of birth or retirement date in our marketing or recruiting forms.

Information collected automatically

• Device and usage data: your IP address, browser and device type, the pages and screens you view, the links and buttons you click, the date and time, and the website that referred you.
• Approximate location: your city or region, based on your IP address. We do not collect precise location (GPS).
• Tools on the Site, loaded through Google Tag Manager:
  • Google Analytics measures traffic and how people use the Site.
  • Microsoft Clarity records how visitors move, click and scroll so we can improve our pages.
  • The Meta Pixel and Meta Conversions API measure our Meta ads and show our ads to people who visited the Site. They send Meta information about actions you take, such as viewing a page, joining the waitlist, booking a call or submitting a form. Some of this information goes from your browser and some from our servers. It includes Meta cookie identifiers, your IP address and your browser type.
• In the Service: we record which features you use and when, to run, secure and improve the Service. We do not run advertising pixels or session recording inside signed-in areas of the Service.

Cookies. These tools use cookies and similar technologies. We group them as:

• Strictly necessary: for example sign-in and security cookies (Clerk), and the cookie that remembers your consent choice. These are always on.
• Analytics: Google Analytics and Microsoft Clarity.
• Marketing: the Meta Pixel and Meta Conversions API.

If you visit from the European Economic Area, the United Kingdom or Switzerland, we use analytics and marketing tools only after you agree in our cookie banner. Elsewhere they are on by default, and you can turn them off at any time (section 7).

Information from others

• Meta: the answers you submit on a Meta lead form.
• Scheduling and other providers: for example booking details when you schedule a call with us.
• Public sources: for example your public LinkedIn profile, if you share it with us.

2. How we use information

• To provide, run and secure the Site and the Service, and to verify your identity when you sign in.
• To contact you by email, text or phone about your inquiry, your account or roles you applied for.
• To send you marketing about Cairnul. You can opt out at any time (section 7).
• To measure and improve our ads, marketing, Site and Service. This includes understanding who did what on the Site, when, and at what approximate location.
• To show you Cairnul ads on other platforms, such as Facebook and Instagram.
• To build business insights, and to sell or share personal information as described in section 5.
• To create de-identified and aggregated data (section 6).
• To meet legal obligations, prevent fraud and abuse, and protect our rights.

Submitting a recruiting form does not create an employment or contract relationship, and it does not guarantee any role, pay or hours.

3. Texts and calls

If you give us your phone number, we may call or text you about your inquiry or account. We send marketing texts or automated marketing calls only if you have agreed to receive them. Agreeing is never a condition of buying anything or applying. Message frequency varies, up to 4 marketing messages per month. Message and data rates may apply. Reply STOP to stop texts, or HELP for help. We do not sell or share your mobile number or texting consent with third parties for their own marketing.

4. How we share information

We share information:

• With service providers that help us operate, under contracts that limit their use of it:
  • hosting, databases and file storage (Netlify, Supabase and Cloudflare R2);
  • sign-in (Clerk);
  • email (Resend and Google);
  • document signing (PandaDoc);
  • analytics (Google and Microsoft);
  • advertising (Meta);
  • AI (Anthropic), which helps power features of the Service.

Our AI providers are not permitted to use your information to train their models.

• With advertising partners for targeted advertising, as described in section 1.
• With buyers and partners as described in section 5.
• At your direction, for example when you ask us to send a document to an investor.
• For legal reasons, when the law requires it, or to protect rights, safety or property.
• In a business transfer. If Cairnul is involved in a merger, acquisition, financing, reorganization, bankruptcy or sale of all or part of its business or assets, personal information may be reviewed in diligence and transferred to the buyer or successor as a business asset. The successor may continue to use it as this policy describes.

5. Sale and sharing of personal information

We may sell personal information, and share it for targeted advertising, as those terms are defined by US state privacy laws. This includes:

• sharing identifiers and Site activity with advertising partners such as Meta; and
• providing contact details, such as name, email, company and role (but never mobile numbers collected for texting), to third parties such as business partners and service providers to startups, for their own marketing or business purposes.

We do not sell sensitive personal information.

We never sell Customer Data or account documents. That includes accreditation materials, tax identification numbers, cap tables and investor information.

Your choices. In the United States, you can opt out of sale and targeted advertising at any time, as described in section 7. In the European Economic Area, the United Kingdom and Switzerland, we sell or share your personal information with third parties for their own purposes only with your consent.

6. De-identified and aggregated data

We may create de-identified or aggregated data that cannot reasonably be linked to you. We may use, share and sell it for any lawful purpose. We will keep it in de-identified form, we will not try to re-identify it, and we require anyone who receives it to agree to the same.

7. Your choices and rights

• Opt out of sale and targeted advertising (US). You can:
  • use the "Your privacy choices" link at the bottom of every page;
  • email privacy@cairnul.com with "Opt out" in the subject line; or
  • turn on Global Privacy Control in your browser. We treat that signal as an opt out of sale and targeted advertising, and we turn off the Meta tools and Microsoft Clarity for that browser.
• Cookie settings. Reopen the cookie banner at any time from the "Cookie settings" link in the Site footer.
• Other tools. You can adjust your Meta ad preferences, install the Google Analytics opt-out add-on, or block or delete cookies in your browser. Some parts of the Site, such as sign-in, may not work without cookies.
• Email marketing. Use the unsubscribe link, or email us.
• Texts. Reply STOP.
• Access, correction, deletion and portability.
  • Depending on where you live, including Texas and other US states, you may have the right to:
  • confirm whether we process your information;
  • access it;
  • correct it;
  • delete it;
  • get a portable copy of it;
  • opt out of sale, targeted advertising and profiling.
  • Email privacy@cairnul.com. We may verify your identity using the contact details we already have.
  • We respond within 45 days, and we won't treat you differently for using your rights.
  • We may keep information where the law allows, for example to finish a transaction, keep the Service secure, meet legal obligations or defend legal claims.
  • If we decline your request, you can appeal by replying with "Appeal" in the subject line.
  • You may use an authorized agent where the law allows.

8. How long we keep information

We keep personal information for as long as we have a business purpose for it, and longer where the law requires or allows. Our business purposes include continuing our relationship with you, marketing, analytics, keeping business records and defending legal claims. When we no longer need it, we delete it or de-identify it.

• Leads and marketing contacts: for as long as we may continue to contact you or keep business records about you. This is up to 7 years after our last interaction with you, or until you ask us to delete it.
• Account information: while your account is open, and then up to 7 years for records, tax, legal and security purposes.
• Site analytics: according to each tool's retention settings, which we set to no more than 14 months. Microsoft Clarity keeps session recordings for a shorter period set by Microsoft.
• Customer Data: as our customer agreement provides.
• EEA, UK and Switzerland: we keep lead and marketing data no longer than 3 years after our last interaction with you.

9. Visitors and users outside the United States

This section applies if the EU or UK General Data Protection Regulation (GDPR), or a similar law, applies to you.

Our legal bases

• Contract: to provide the Service and manage your account.
• Legitimate interests: to answer inquiries, review applications, keep the Site and Service secure, improve them using data that isn't collected through cookies, and send business marketing where the law allows. You can object at any time.
• Consent: for analytics and marketing cookies, Meta's tools (including hashed matching), session recording, marketing texts, and any sale or sharing of your information with third parties for their own purposes. You can withdraw consent at any time. Withdrawing does not affect earlier processing.
• Legal obligation: to comply with the law.

Your rights. You can ask to access, correct, delete, restrict or port your information, and to object to processing, including all direct marketing. You can withdraw consent at any time, and you can complain to your local data protection authority. Email privacy@cairnul.com. We respond within one month.

International transfers. We are based in the United States and process information there. When we transfer information from the EEA, the UK or Switzerland, we rely on one of two safeguards:

• the EU-U.S. Data Privacy Framework (and its UK and Swiss extensions), where our provider is certified; or
• the European Commission's Standard Contractual Clauses, with the UK Addendum.

Some providers rely on both. Others, including some whose certification doesn't cover the UK or Switzerland, rely on Standard Contractual Clauses for those transfers. You can ask us which safeguard applies to a provider, and for a copy of it.

10. Security

We use reasonable safeguards, such as encryption in transit, access controls and limited staff access. However, no method of transmission or storage is fully secure.

11. Children

The Site and the Service are not for anyone under 18, and we do not knowingly collect information from children.

12. Location of processing

We are based in the United States. We and our service providers process and store information primarily in the United States. If you are outside the United States, your information will be transferred to the United States. Section 9 explains the safeguards we use.

13. Changes

We may update this policy. When we do, we will post the new version here and change the "Last updated" date. If a change materially affects how we use or share information we already have, we will notify you beforehand. Where the law requires it, we will ask for your consent first.

14. Contact us

Cairnul, Inc. 501 Brazos Street, 3107 Austin, Texas 78701 Email: privacy@cairnul.com