Privacy Policy & Privacy Notice

This Privacy Policy describes how D.O.X Capital ("D.O.X Capital," "we," "us," or "our") handles personal information in connection with https://www.thedoxs.com, our capital-structuring and business-funding advisory services, and any other interaction that expressly links to this Policy.

1. Scope, identity, and privacy roles

This Policy applies only to personal information processed in connection with the websites, forms, communications, memberships, consultations, and services that link to it. It does not apply to a third party's independent services, websites, or privacy practices, even if D.O.X Capital links to or receives services from that third party.

D.O.X Capital may act in different privacy roles depending on the context:

• When we determine why and how personal information is processed for our own website, account, membership, commercial, compliance, security, or marketing activities, we act as a "business" or "controller" under applicable privacy law.
• When we process personal information only on documented instructions from a business client, we act as a "service provider," "processor," or similar recipient. In that setting, the client's privacy notice generally governs the client's collection and use, and our agreement with that client governs our processing. Requests concerning client-controlled information may need to be directed to the client.
• If we and another organization jointly determine processing purposes or means, the parties' respective responsibilities are documented and disclosed where applicable.

D.O.X Capital's description of itself does not displace privacy, consumer-protection, anti-discrimination, licensing, or other applicable law, and nothing in this Policy waives a nonwaivable right.

2. Personal information covered by this Policy

"Personal information" means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked to a person or household, or any similar concept under applicable law. It does not include information excluded by applicable law, such as certain lawfully available public information, deidentified data, or aggregated data.

Depending on your interactions with us, we may collect the following categories:

• Identifiers and contact information — name, postal address, email address, telephone number, account identifier, online identifier, or signature.
• Account and membership information — login credentials, membership status, application or admission records, preferences, and account settings.
• Commercial and transaction information — services considered or purchased, invoices, order history, support history, and transaction status.
• Professional and business information — employer, title, business ownership, industry, professional history, business plans, organizational information, or funding objectives.
• Communications and submissions — emails, messages, consultation notes, survey responses, and other content you submit.
• Internet, device, and usage information — IP address, browser or device type, operating system, timestamps, referring URLs, pages viewed, interactions, diagnostics, and security events.
• General location information — general location inferred from an IP address.
• Uploaded content — documents and their metadata that you submit through an enabled upload workflow.
• Inferences — preferences or indicators derived from the information above, where actually created.

3. Sources of personal information

Depending on the services you use, personal information may come from:

• Directly from you, such as through a form, consultation, purchase, membership application, privacy request, upload, or message.
• Automatically from your browser or device, such as through server logs, cookies, and similar technologies, as disclosed in Section 6.
• From a client, member, authorized representative, or referral source permitted to provide the information.
• From service providers such as payment, hosting, communications, analytics, security, and scheduling providers.
• From public or lawfully accessible sources, where collection and use are lawful.
• From derived activity, when we generate transaction records, security signals, preferences, or inferences.

4. Purposes of processing

We process personal information to:

• provide, administer, personalize, and support requested services, accounts, or memberships;
• authenticate users, maintain account integrity, and manage permissions;
• respond to inquiries, schedule or conduct consultations, and provide customer support;
• process transactions, maintain business records, and administer billing, cancellation, or refunds;
• communicate about a request, transaction, service, security issue, legal notice, or material policy change;
• send marketing communications only when permitted, and honor opt-out or consent-withdrawal choices;
• operate, measure, diagnose, maintain, and improve the website and services;
• prevent, detect, investigate, and respond to fraud, abuse, security incidents, or unlawful conduct;
• comply with law, valid legal process, professional obligations, and enforceable agreements;
• establish, exercise, or defend legal claims and protect the rights, safety, and property of individuals, D.O.X Capital, and others; and
• conduct a corporate transaction or diligence process subject to appropriate safeguards.

Transactional communications, marketing consent, cookie consent, and any AI or automated-processing consent are kept separate where applicable.

5. Cookies and similar technologies

Cookies and similar technologies can include browser cookies, pixels, tags, local storage, and device identifiers. They may support functions that are strictly necessary, remember preferences, measure performance, or provide analytics. Where nonessential analytics or advertising technologies are used, we present any consent or opt-out controls required before those technologies operate and make withdrawal as easy as giving consent. See the Cookie & Tracking Technologies Policy for details. Browser settings may block or delete some cookies, but doing so can affect site functionality.

6. How personal information may be disclosed

We may disclose personal information to the following categories for documented purposes and under appropriate protections:

• Service providers, processors, and contractors performing hosting, security, communications, scheduling, analytics, payment processing, document management, or customer support.
• Clients or counterparties when we process information at their direction or when disclosure is necessary to perform a service you requested.
• Professional advisers and insurers, such as attorneys, accountants, auditors, and insurers, subject to confidentiality.
• Government authorities, courts, and other lawful recipients when required by law or valid legal process, or to protect rights, safety, property, or the integrity of services.
• Parties to a business transaction, including a prospective acquirer, investor, lender, successor, or insolvency representative, subject to appropriate protections.
• Recipients you authorize or that are identified at the point of collection.

7. Sensitive, financial, and uploaded information

Sensitive information is not collected merely because a form or upload tool can accept it; collection is limited to what is reasonably necessary for a disclosed purpose. Where you provide financial or document information for a funding-related service, we handle it consistently with this Policy and the Document Upload & Processing Notice. Do not submit government identifiers, full payment-card data, health information, information about children, or other sensitive data unless the verified workflow specifically requests and protects it.

8. Uploads, AI, and automated processing

Where document uploads are enabled, we define access controls, malware screening, encryption, retention, deletion, and vendor access before the feature operates, and you should not upload sensitive, regulated, confidential, or third-party information unless we expressly request it and you are authorized to provide it.

Where AI or automated tools assist our review, inputs and outputs are processed to support the requested service, and the Automated Document Processing & AI-Assisted Review Disclosure governs that activity. AI output may be inaccurate, incomplete, or biased, is not professional advice, and is not a guaranteed result. We do not use AI output as the sole basis for a legal or similarly significant decision about you unless the workflow and law permit it and any required notice, consent, or human review is provided.

9. Sale, sharing, and targeted advertising

D.O.X Capital does not sell your personal information for money, and does not share it for cross-context behavioral advertising, as those terms are defined under applicable privacy law. If this practice changes, we will update this Policy, identify the categories and recipients involved, provide any required opt-out, and honor applicable universal opt-out signals before any such processing occurs.

10. Retention and deletion

We retain each category of personal information only for as long as reasonably necessary and proportionate to the disclosed purpose, including to provide a requested service, maintain required business and transaction records, comply with law, resolve disputes, enforce agreements, protect security, and establish or defend legal claims. Copies may remain for a limited period in backups, disaster-recovery systems, legal holds, or immutable security records, subject to access restrictions and ordinary deletion cycles. See the Data Retention & Deletion Policy.

11. Privacy rights and choices

Privacy rights depend on your location, your relationship with us, the nature of the information, and statutory exceptions. Subject to applicable law, you may have the right to request access to or confirmation of processing; correction; deletion; portability; restriction; objection; withdrawal of consent; a list of certain third-party recipients; or an opt-out from sale, sharing, targeted advertising, certain profiling, or certain uses of sensitive information, and in some cases a right to appeal a denial or contact a regulator.

To submit a request, contact us at admin@thedoxs.com. We may need information reasonably necessary to verify your identity, authority, jurisdiction, and the records involved, and we will use that information only for verification, fraud prevention, security, and compliance. We may deny or limit a request where permitted and will explain a denial and any available appeal route when required.

12. Security

We use administrative, technical, and physical safeguards designed to protect personal information, which may include access controls, authentication, encryption, secure configuration, monitoring, vendor review, workforce training, incident response, and data minimization. No method of transmission, storage, or security is completely secure, and we cannot guarantee that information will never be accessed, used, disclosed, altered, or destroyed without authorization. Use unique credentials, protect access to your devices, and notify us at admin@thedoxs.com if you believe an interaction or account is insecure.

13. Children and minors

The Services are intended for adults at least 18 years of age and are not directed to children. We do not knowingly collect personal information from children, and if we learn that we have collected covered child data, we will take reasonable steps to address it. A parent or guardian may contact us at admin@thedoxs.com.

14. Third-party services and changes to this Policy

Third-party links and integrations are governed by the third party's own terms and privacy notice when the third party independently determines its processing. We may revise this Policy to reflect changes in services, data practices, technology, or law. If a change is material, we will provide notice and obtain consent where required by applicable law.

15. Contact

Questions about this Policy, our privacy practices, or a privacy request may be directed to D.O.X Capital at admin@thedoxs.com.