Last Updated: November 3, 2026

This Privacy Policy (“Policy”) describes how Not Legal Advice, Inc., a California corporation (“Company,” “we,” “us,” or “our”) collects, uses, and handles your information in connection with the Services (as defined in the Terms of Service). It is incorporated by reference into the Terms of Service, available at fullydiluted.io/terms (the “Terms”). Capitalized terms not defined here have the meanings given in the Terms.

If you are looking for our recommendations regarding anonymization, data security warnings, and the various disclaimers about the Services’ AI-built infrastructure, those are addressed more fully in the Terms. This document focuses on what happens to your data. To the extent we know.

As stated in Section 3 of the Terms, the Services are offered only to users located in the United States of America and are not offered to, or intended for, anyone located outside the United States, including anyone in the European Union, the European Economic Area, the United Kingdom, or any other jurisdiction. This Policy is written for United States users and with reference to United States law only. We do not accept users from, and this Policy does not attempt to comply with the data protection laws of, any other jurisdiction. If you are outside the United States, you are not permitted to use the Services, and you should not submit any information to them. The website and the analytics data described in this Policy are served and processed in the United States; your cap table is processed on your own device, wherever you are, and is not transmitted.

1. INFORMATION WE COLLECT

1.1 Cap Table Data

When you import a cap table, it is read and processed by the modeling engine running inside your browser; its contents are not transmitted to us. This data may include founder names, investor names, share counts, share classes, option pools, vesting schedules, SAFE and convertible note terms, valuation information, and other details that most companies treat as highly confidential.

The engine keeps only what the model needs, in your browser: holder names, share classes, each holder’s holdings (shares, price paid and cash), warrants, convertible terms, option-pool totals and round settings. Email addresses, certificate-level history, option grants by person, relationship labels and the source system’s identifiers are discarded as the file is read, in your browser.

Here is what happens to that data after processing: nothing, and it never left your device. Your cap table is held in your browser while you work. Parsing an imported file, recomputing the table after an edit, running the pro forma and building a file for you to save all happen in a modeling engine that runs inside your browser tab, so no part of your cap table is sent to us or to anyone else. We have no server that receives it, we do not write cap tables to a database or to disk, and nothing you enter persists anywhere except your own browser and the files you choose to save.

If you want to keep your work, use Save, which downloads a spreadsheet to your own device. If you want to keep working on it later, import that file. Every saved file carries a hidden settings sheet (share classes, rounds, holdings and convertible terms) so it can be re-imported; that sheet never contains holder names or email addresses. Names appear only on the visible sheets, so a saved file is your cap table and should be shared as carefully. Closing your browser tab clears what the browser was holding (see Section 1.4).

1.2 Analytics Data

We use Google Analytics, which collects information about your visit including your IP address, browser type, device information, pages visited, referring URLs, time spent on the Services, and other standard web analytics data. Google Analytics uses cookies to collect this information.

Google’s use of this data is governed by Google’s own privacy policy, which is comprehensive and long and available at https://policies.google.com/privacy. We encourage you to review it, or at least acknowledge its existence. Google also explains what it does with information collected from sites that use Google Analytics at https://policies.google.com/technologies/partner-sites.

If you would rather not be counted, Google offers an opt-out browser add-on at https://tools.google.com/dlpage/gaoptout. Most ad blockers and browser tracking-protection settings also block Google Analytics, and the Services work the same either way.

1.3 Other Technologies

As of the date of this Policy, we do not believe we have additional tracking tools or analytics services installed beyond Google Analytics. However, the Services are under constant development. We may have added something between when this Policy was last updated and when you are reading it. We may also add things in the future. We will update this Policy when we become aware of material changes, assuming we become aware of them.

1.4 Browser Storage

While you work, the Services keep your current cap table, the pro forma you last ran and its inputs, and which tab is open in your browser’s session storage. While the getting-started tour’s demo runs, a temporary copy of your table is kept there too, so the tour can put it back when it ends. This is the mechanism that lets you open the Terms or this Policy and come back without losing your table. Session storage is not a cookie: it lives only in the browser tab you are using, it is never sent to us or to Google, and your browser erases it when you close the tab. Some browsers restore a closed tab’s session storage after a crash or restart; the Clear button removes everything the Services stored for a table. If you import with Mask Names on (an optional switch on the import panel, off by default), the Services also download a key file to your device containing the real company and holder names, encrypted with your passphrase or, if you skip the passphrase, with a key stored inside the file. So that the tool keeps working without a connection, your browser also keeps a copy of the Services’ pages and of the modeling engine’s files in its own cache, as browsers do for any website. That cache holds the Services’ code, never your cap table, and you can clear it through your browser’s settings. Nothing else is written to your device unless you use Save.

2. HOW WE USE YOUR INFORMATION

2.1 Cap Table Data

We do not use your cap table data at all, because we never receive it. The Services, running in your browser, use it for one purpose: processing your cap table and modeling pro forma financing rounds. That is the intended use, and the only one.

2.2 Analytics Data

We use Google Analytics data to understand how people use the Services, which pages are visited, and other standard analytics purposes. We do this so we can improve the Services, which, given their current state, has meaningful room for improvement.

3. DATA SHARING

3.1 We do not sell, rent, or trade your personal information or cap table data to third parties. For cap table data this is less a policy than a physical fact: we never receive it, so there is nothing to sell. For analytics data (Section 1.2) it is a policy, and one that could change. Who knows. Again, we STRONGLY recommend that you redact sensitive information from your cap table before importing it or building it within the Services, because it will be on your screen and in the files you save.

3.2 We share data with the service providers who run the Services, to the extent necessary for them to function. The website, including the code of the modeling engine your browser downloads, is served by Netlify. Like any web host, Netlify keeps standard web-server logs (your IP address, the files requested, the time and your browser type) for its own operational purposes under its own privacy policy; those logs record which files your browser fetched and never contain your cap table, which is not transmitted. We keep no request logs of our own. Google provides analytics (Section 1.2).

3.3 Google Analytics data is shared with Google in accordance with Google’s terms. We did not design Google Analytics and cannot speak to what Google does with the data it collects, though we suspect it is extensive.

3.4 We may disclose information if required by law, subpoena, or legal process, or if we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others.

4. DATA RETENTION

For analytics data, retention is governed by our Google Analytics settings and Google’s own data retention policies.

For cap table data, retention is simple: we never receive it, so we retain none of it. It exists only in your browser while you work and in the files you choose to save.

5. SALE OR TRANSFER

In the event of a sale, merger, acquisition, or other transfer of the Company or the Services or their assets, your data — which, given how the Services work, cannot include cap table data, because none exists on our systems — may be among the assets transferred. This is addressed further in Section 10 of the Terms.

6. DATA SECURITY

We have not conducted a formal security audit, penetration test, or third-party security assessment. We do not have a SOC 2 report. The Services were built primarily by AI.

We take reasonable precautions to protect your data, but “reasonable” is doing a lot of work in that sentence given the disclosures above. We cannot guarantee the security of your own device or browser, which is where your cap table lives while you use the Services.

Please see Section 5.4 of the Terms for our thoughts on anonymization, which we will summarize here as: please anonymize your data.

7. COOKIES

The Services themselves set no cookies. The only cookies come from Google Analytics, which sets two on this site’s domain: _ga, which assigns your browser a random identifier so Google can tell returning visits from new ones, and _ga_H3PJEM9TR2, which keeps track of your current visit on this particular site. Each lasts two years from your most recent visit unless you delete it sooner. Neither contains anything you typed into the Services.

We may use additional cookies as the Services develop, and will update this Section if we do. Your browser settings allow you to view, manage, or block cookies, and blocking these two will not affect any functionality; the Google Analytics opt-out add-on described in Section 1.2 is another option.

8. YOUR RIGHTS

Depending on the state in which you reside, United States law may give you rights regarding your personal data, including rights to know what we hold, to correct or delete it, or to opt out of certain uses. If you are a California resident, you may have rights under the California Consumer Privacy Act (CCPA), to the extent it applies to us. We will work to honor applicable rights under United States federal and state data protection laws.

To exercise any of these rights, please contact us at gintelbot@gmail.com. We will make good faith efforts to respond to your request, which in some cases may involve figuring out where your data is and how to retrieve or delete it. In practice, as Section 1.1 explains, we hold no cap table data to retrieve or delete; what remains is Google Analytics data, which you can limit as described in Sections 1.2 and 7.

This Policy does not grant, and we do not undertake to honor, rights under the General Data Protection Regulation, the UK GDPR, or the data protection law of any jurisdiction outside the United States, because the Services are not offered to anyone to whom those laws apply. If you are located outside the United States, you are not permitted to use the Services.

9. CHILDREN’S PRIVACY

The Services are not directed at children under 13, and we do not knowingly collect data from children under 13. If you believe a child has used the Services, please contact us and we will take appropriate steps, including being mildly impressed.

10. THIRD-PARTY LINKS

The Services may contain links to third-party websites. We are not responsible for the privacy practices of those sites. Given that we are still cataloguing our own privacy practices, this should be expected.

11. CHANGES TO THIS POLICY

We may update this Policy at any time. When we do, we will revise the “Last Updated” date at the top. Material changes will be communicated through the Services or by other reasonable means, to the extent we remember.

12. CONTACT

For questions about this Policy or to exercise your data rights, please send an email to: gintelbot@gmail.com

We will respond as promptly and helpfully as we can.