Data Processing Terms

Last updated: 8/16/2026

These Data Processing Terms apply where Bright Capital America processes personal data on behalf of a workspace or organization customer (the "Customer") in connection with the Platform. They supplement the Terms of Service and the Privacy Policy.

Roles

For Customer-controlled data (team members, CRM records, contacts, investor and company profiles a Customer manages), the Customer is the controller and Bright Capital is the processor. For account, security, and Platform-operational data, Bright Capital America acts as an independent controller.

Purpose and instructions

Bright Capital America processes personal data solely to provide, secure, and improve the Platform and to comply with legal obligations, in accordance with the Customer's documented instructions expressed through Platform configuration.

Confidentiality

Personnel with access to personal data are subject to written confidentiality obligations.

Security

Bright Capital America implements industry-standard technical and organizational measures including encryption in transit, row-level access controls, audit logging, least privilege, and vendor review.

Sub-processors

Bright Capital America uses vetted sub-processors for hosting, database, authentication, email, analytics, verification, and AI inference. A current list is available on request.

International transfers

Where personal data is transferred internationally, Bright Capital America relies on appropriate safeguards, including standard contractual clauses where applicable.

Data subject requests and incident response

Bright Capital America assists the Customer in responding to data-subject requests through the Platform and, without undue delay, notifies the Customer of a personal-data breach affecting the Customer's data.

Deletion

Upon termination, Bright Capital America deletes or returns Customer personal data, subject to legal retention obligations.

Requests: support@brightcapital.fund