1. Introduction
CapRelease Limited ("CapRelease", "we", "us", "our") provides revenue-based finance and related services to eCommerce and consumer brands. We are a company registered in England and Wales under company number 15180252, with our registered office at 71–75 Shelton Street, Covent Garden, London WC2H 9JQ.
This Privacy Policy explains what personal data we collect, why we collect it, what we do with it, and the rights you have over it. It applies to:
- visitors to www.caprelease.com and any other website we operate;
- people who apply to CapRelease for funding, whether or not the application succeeds;
- directors, shareholders, beneficial owners, officers and authorised users of businesses that apply to or contract with us;
- people who contact us, subscribe to our communications, or meet with our team; and
- individuals whose data reaches us through a business's connected accounts or integrations.
This Privacy Policy sits alongside our Platform Terms of Business, which govern your use of the CapRelease platform.
Most of the data we handle belongs to businesses rather than individuals, and information about a company is not itself personal data. But information about the people behind a business — directors, owners, signatories, named contacts — is personal data, and this policy covers it.
We may update this Privacy Policy from time to time. The version in force is the one published at www.caprelease.com/legal/privacy-policy, and the effective date is shown above.
2. Our Role in Your Privacy
We are a controller
For almost everything described in this Privacy Policy, CapRelease is a controller. That means we decide why your personal data is processed and how. We make those decisions for our own commercial purposes — assessing applications, underwriting and pricing funding, meeting our anti-money-laundering and sanctions obligations, managing risk, servicing live advances, and running our business.
We are a controller whether or not we pass data on to anyone else. Controllership is about who makes the decisions, not about who the data is shared with.
Who processes data for us
The third parties listed in Section 12 act as our processors. They handle personal data on our instructions and for our purposes, under written terms that require them to keep it secure and use it only as we direct. They are not free to use it for their own ends.
Where we share controllership
We are a joint controller with Meta Platforms Ireland Limited in respect of the Meta Pixel on our website, and only in respect of the collection and transmission of that pixel data. Meta acts as an independent controller for what it does with the data afterwards. Meta's controller addendum is at www.facebook.com/legal/controller_addendum. The pixel only fires if you accept marketing cookies.
What we are not
We do not act as a processor for our customers, and we do not enter into data processing agreements with them. When you give us data about your business, your customers or your team, we use it as a controller for our own purposes — assessing and managing funding — rather than carrying out processing on your behalf. Section 6 explains how we treat data about your own customers.
Your responsibilities
If you give us personal data about other people — a co-director, a beneficial owner, a colleague who will use the platform, or your accountant — you must be allowed to share it, and you should point them to this Privacy Policy so they know what we do with it.
If you are our customer, you should also read the Platform Terms of Business and your funding documents, which set out the contractual basis on which we hold and use information about your business.
3. When and How We Collect Data
When you visit our website
We collect limited technical and usage data automatically through cookies and similar technologies — see Section 13. If you only browse and decline non-essential cookies, we collect very little about you.
When you give it to us directly
You give us personal data when you apply for funding, create an account, complete identity checks, contact us, book a meeting, subscribe to updates, or correspond with our team by email, phone or SMS.
When you connect an account or integration
With your authorisation, we collect data from systems your business already uses. This is the core of how we underwrite. It includes:
- accounting, banking and eCommerce platforms, accessed through Codat — for example Xero, QuickBooks, Shopify, Amazon, Stripe and your business bank accounts;
- logistics, fulfilment and additional sales channels, accessed through Trackstar — for example third-party logistics warehouse management systems and marketplace accounts;
- identity and company records, obtained through Onfido, Companies House and Middesk.
You control which accounts you connect, and you can disconnect them at any time. Disconnecting stops future collection; it does not delete what we have already collected, which we retain as set out in Section 10.
When we collect it from other sources
We also obtain personal data from public registers, including Companies House and insolvency registers; from identity, sanctions, politically-exposed-person and adverse media checks carried out through our verification provider; from other publicly available sources; and from brokers, partners or introducers who refer you to us.
We do not use credit reference agencies and we do not carry out credit searches. No search footprint is recorded against you or your business as a result of applying to CapRelease.
4. Types of Data We Collect
| Category | What it includes |
|---|---|
| Identity Data | Name, date of birth, nationality, job title, role in the business, shareholding and beneficial ownership details, images of identity documents such as a passport or driving licence, and a selfie or liveness capture used for identity verification. |
| Contact Data | Business and personal email address, telephone and mobile number, business address and, where relevant to identity or address verification, home address. |
| Business Activity Data | Revenue, sales, orders, refunds, chargebacks, customer counts, marketing spend, advertising performance, inventory and fulfilment data, bank transaction data, accounting ledgers, and the other trading and financial information we obtain from your connected accounts. |
| Application Data | The information you submit when applying, the funding amount requested, your stated use of funds, supporting documents, and the record of your application and our decision. |
| Risk and Screening Data | Sanctions, politically-exposed-person and adverse media screening results, insolvency and public register data, the scores and risk indicators we generate from your connected data, and our underwriting assessments. |
| Transaction Data | Advance amounts, remittances, repayment history, arrears, bank details used for payments, and related correspondence. |
| Communications Data | Emails, SMS messages, platform messages, support tickets, meeting bookings and call notes, and your marketing preferences. |
| Technical and Usage Data | IP address, device and browser type, operating system, approximate location derived from IP, login records, pages viewed, referral source, and interaction with our website and platform. |
| Cookie Data | The identifiers and preferences described in Section 13. |
| Payment and banking details | Bank account number, sort code or routing number, and Direct Debit or ACH authorisation details, together with the records of payments we collect from you and any failed or returned collections. |
We do not seek special category data, and you should not send it to us. Identity documents can incidentally reveal information such as nationality or, in some formats, biometric data used by our verification provider to match your face to your document. Where our provider processes biometric data for that purpose, it does so on the basis of your explicit consent, which you give at the point of verification and can withdraw — though we will not be able to verify your identity without it, and we will not be able to proceed with your application.
We do not knowingly collect data from anyone under 18. Our services are provided only to businesses.
5. How and Why We Use Your Data
We only use your personal data where the law allows it. In almost every case that means one of three things: we need it to take steps towards or perform a contract, we have a legal obligation, or we have a legitimate interest that is not overridden by your rights. Where we rely on consent, we say so, and you can withdraw it at any time.
| What we do | Data used | Our legal basis |
|---|---|---|
| Create and administer your account, and give you access to the platform | Identity, Contact, Technical | Performance of a contract, or steps at your request before entering one |
| Assess your application, underwrite and price funding, and make a funding decision | Application, Business Activity, Risk and Screening, Identity | Steps at your request before entering a contract; our legitimate interest in assessing risk accurately |
| Verify identity, confirm beneficial ownership, and carry out sanctions, PEP and adverse media screening | Identity, Contact, Risk and Screening | Legal obligation under the Money Laundering Regulations 2017 and sanctions legislation |
| Detect, investigate and prevent fraud, financial crime and misuse of the platform | All categories | Legal obligation; our legitimate interest in protecting our business, our customers and the wider market |
| Monitor the performance of a live advance, calculate remittances, and collect sums due | Business Activity, Transaction, Communications | Performance of a contract; our legitimate interest in recovering sums owed |
| Build, test and improve our risk models, scoring and analytics | Business Activity, Application, Risk and Screening, Transaction | Our legitimate interest in improving the accuracy of our underwriting and the resilience of our business |
| Operate, secure, maintain and improve our website and platform | Technical, Usage, Cookie | Our legitimate interest in running a secure, reliable service; consent for non-essential cookies |
| Respond to your enquiries, provide support, and manage our relationship with you | Contact, Communications | Performance of a contract; our legitimate interest in responding to those who contact us |
| Send service messages about your account, application or advance | Contact, Communications | Performance of a contract; our legitimate interest in keeping you informed about a service you use |
| Send marketing about our products and services | Contact, Communications, Business Activity | Consent, or our legitimate interest in marketing to existing and prospective business customers |
| Comply with regulatory, tax, accounting and reporting obligations, and respond to lawful requests | All categories | Legal obligation |
| Establish, exercise or defend legal claims, and in connection with a sale, financing or restructuring of our business | All categories | Our legitimate interest in protecting and realising the value of our business; legal obligation where applicable |
| Issue agreements for electronic signature, set up Direct Debit or ACH authorisations and collect repayments | Contact details; payment and banking details | Performance of our contract with you, and our legitimate interest in keeping an auditable record of what was signed and when |
Automated decision-making
We use automated tools to score applications, flag risk indicators and support our underwriting. These tools inform our decisions; they do not make final funding decisions on their own. A member of our team reviews every funding decision before it takes effect.
If that ever changes, and a decision producing legal or similarly significant effects for you is made by automated means alone, we will tell you, and you will have the right to obtain human intervention, express your point of view, and contest the decision. You can ask us about how our models work at hello@caprelease.com, though we will not disclose information that would compromise our commercial interests or the integrity of our fraud and credit controls.
If we want to use your data for something new
If we need to use your personal data for a purpose that is not compatible with the purpose it was collected for, we will tell you and explain the legal basis before we do it.
6. Data About Your Customers
When you connect an eCommerce, accounting, payments or logistics account, the data we receive can include information about your own customers — order values, order dates, shipping locations, customer identifiers, refund and chargeback history, and similar records.
We use this data only in aggregate and only to understand the performance of your business: revenue trends, order volumes, repeat purchase behaviour, seasonality, refund rates and customer concentration. These are inputs into underwriting and monitoring.
We do not use your customers' personal data to market to them, we do not sell it, and we do not build individual profiles of them. Where we do not need customer-level identifiers for the analysis, we minimise or remove them.
You remain the controller of your customers' data in your own systems, and you are responsible for having a lawful basis and appropriate privacy notices in place that cover sharing that data with a finance provider. We act as a controller for the limited purposes described above.
7. Your Privacy Choices and Rights
Under UK data protection law you have the following rights. They are not absolute, and some will not apply where we are required to keep data for anti-money-laundering, regulatory or legal reasons.
- Access — ask for a copy of the personal data we hold about you.
- Rectification — ask us to correct data that is inaccurate or incomplete.
- Erasure — ask us to delete your data where we no longer have a reason to keep it. We cannot delete records we are legally required to retain, including AML records.
- Restriction — ask us to pause our use of your data while a dispute about it is resolved.
- Objection — object to processing we carry out on the basis of legitimate interests, including profiling. You can object to direct marketing at any time and we will always stop.
- Portability — ask us to provide data you gave us, where processing is based on consent or contract and carried out by automated means, in a structured, commonly used, machine-readable format.
- Withdraw consent — where we rely on consent, withdraw it at any time. This does not affect processing already carried out.
- Human review — where a decision is made by automated means alone, ask for human intervention and contest the decision.
To exercise any of these rights, email hello@caprelease.com. We will respond within one month. If your request is complex or you have made several, we may extend that by a further two months and will tell you if we do. We may need to verify your identity first. Exercising your rights is free unless a request is manifestly unfounded or excessive.
Marketing
You can opt out of marketing at any time by using the unsubscribe link in any marketing email, replying STOP to any marketing SMS, or emailing us. Opting out of marketing does not stop service messages about your account, application or live advance.
Disconnecting an integration
You can disconnect any connected account at any time, through the platform or by asking us. This stops future data collection from that source. If you have a live advance, disconnecting may put you in breach of your funding documents, so check those terms first.
8. How We Protect Your Data
We maintain technical and organisational measures appropriate to the sensitivity of the data we hold, including:
- encryption of data in transit using TLS, and encryption of data at rest;
- role-based access control, so that staff can only reach the data their role requires;
- multi-factor authentication on internal systems and administrative access;
- hosting on Microsoft Azure, with the logical and physical security controls that platform provides;
- network segregation, logging and monitoring, and alerting on anomalous access;
- read-only access to your connected accounts wherever the integration supports it, so that we can see data but not change it;
- tokenised credentials for connected accounts, meaning we do not store your banking or platform passwords;
- vendor due diligence before we appoint a processor, and written data protection terms with each one;
- staff training on data protection and financial crime, and confidentiality obligations in every contract of employment; and
- backup and disaster recovery arrangements, with restoration testing.
No system is perfectly secure. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office within 72 hours of becoming aware of it, and we will tell you directly where the risk to you is high.
9. Where We Store Your Data
We store personal data on Microsoft Azure infrastructure.
Personal data is held in our United Kingdom (UK South) and European (EU West) Azure regions. This applies wherever you are located, including if you are in the United States. Section 15 explains how we handle data relating to people in the United States.
Some of our providers are based outside the UK, principally in the United States, and personal data may be transferred to them in order to deliver the services described in Section 12. Members of the CapRelease group may also access data across borders for the purposes described in this Privacy Policy. Where a restricted transfer takes place, we rely on one or more of the following safeguards:
- the UK Extension to the EU–US Data Privacy Framework, where the provider is certified under it;
- UK adequacy regulations, where the destination country has been assessed as providing an adequate level of protection;
- the International Data Transfer Agreement, or the UK Addendum to the European Commission's Standard Contractual Clauses, together with a transfer risk assessment.
You can ask us for details of the safeguard applying to a particular transfer by emailing hello@caprelease.com.
10. How Long We Keep Your Data
We keep personal data only for as long as we need it for the purpose it was collected for, and for as long as the law requires.
| Situation | Retention period |
|---|---|
| You apply and we do not fund you, or you withdraw your application | We retain Business Activity Data and application records for up to 2 years from the date the application is declined, withdrawn or lapses. |
| You become a customer | We retain records for the life of the relationship and for 6 years after the final payment under your last advance, reflecting the limitation period for contractual claims. |
| Anti-money-laundering records | We retain identity verification, beneficial ownership and screening records for 5 years from the end of our business relationship with you, as required by the Money Laundering Regulations 2017. |
| Accounting and tax records | 6 years from the end of the relevant accounting period. |
| Marketing contacts | Until you opt out, or 2 years after your last engagement with us, whichever comes first. |
| Website and cookie data | As set out in Section 13, generally no more than 24 months. |
| Records relevant to an actual or threatened legal claim or regulatory investigation | Until the matter is concluded and any appeal period has expired. |
Accounts that have been inactive are archived within 3 months of last use, and remain archived until the applicable period above expires.
When a retention period ends we delete the data or irreversibly anonymise it. Anonymised and aggregated data, which can no longer identify anyone, may be retained indefinitely for modelling, benchmarking and statistical purposes.
11. Shopify Data Compliance
Where you connect a Shopify store to CapRelease, we comply with Shopify's data protection requirements for connected applications. We support Shopify's mandatory compliance webhooks:
- customers/data_request — where a shopper asks your store for their data, we provide the data we hold about that shopper, if any.
- customers/redact — where a shopper asks your store to erase their data, we erase the data we hold about that shopper, unless we are legally required to keep it.
- shop/redact — 48 hours after your store uninstalls the CapRelease application, we erase store data we are not legally or contractually required to retain. Where you have a live or recently settled advance, we retain what we need under Section 10.
Requests under these webhooks are actioned within 30 days.
12. Third Parties Who Process Your Data
We share personal data with the providers below. Except where stated otherwise, each acts as our processor, handles data only on our instructions, and is bound by written data protection terms. We do not sell personal data, and we do not share it with third parties for their own marketing.
We review this list and keep it current. If you want to know what a particular provider receives, ask us at hello@caprelease.com.
Infrastructure and hosting
| Provider | Purpose | Location |
|---|---|---|
| Microsoft Corporation (Microsoft Azure) | Cloud hosting, storage, compute and platform security | United Kingdom and European Economic Area; United States from January 2027 for US data |
| Microsoft Corporation (Microsoft 365) | Business email, document storage, internal collaboration and the records we keep of our dealings with you | United Kingdom and European Economic Area |
Data aggregation and integrations
| Provider | Purpose | Location |
|---|---|---|
| Codat Limited | Secure access to accounting, banking, payments and eCommerce data from accounts you connect | United Kingdom |
| Trackstar | Secure access to logistics, fulfilment and additional sales channel data from accounts you connect | United States |
Identity, company verification and financial crime
| Provider | Purpose | Location |
|---|---|---|
| Onfido Limited | Identity document verification, biometric facial matching, and sanctions, politically-exposed-person and adverse media screening | United Kingdom |
| Companies House | Source of UK company, officer and beneficial ownership data. Companies House is a public register and an independent controller, not our processor | United Kingdom |
| Middesk, Inc. | US business verification and company records | United States |
We do not use credit reference agencies, and we do not carry out credit searches.
Signing and payments
| Provider | Purpose | Location |
|---|---|---|
| DocuSign, Inc. | Electronic signature and execution of funding agreements and related documents | United States and European Economic Area |
| GoCardless Ltd | Setting up Direct Debit mandates and collecting repayments | United Kingdom and European Economic Area |
| GoCardless Inc | Setting up ACH authorisations and collecting repayments | United States |
Customer relationship management and communications
| Provider | Purpose | Location |
|---|---|---|
| HubSpot, Inc. | Customer relationship management, customer communications and marketing | United States |
| Mailgun Technologies, Inc. | Transactional and service email delivery | United States |
| Chili Piper | Meeting scheduling | United States |
Website, analytics and advertising
These operate on our website only. They do not run on our platform at app.caprelease.com.
| Provider | Purpose | Location |
|---|---|---|
| Webflow, Inc. | Hosting and delivery of our public website, including its forms and content | United States |
| Google LLC (Google Tag Manager) | Manages and deploys the tags listed below; receives IP address and page data | United States |
| Google LLC (Google Analytics) | Website analytics | United States |
| Google LLC (Google Ads) | Advertising measurement, conversion tracking and audience building | United States |
| Meta Platforms Ireland Limited (Meta Pixel and Meta Ads) | Advertising measurement, conversion tracking and audience building. We are a joint controller with Meta for the collection and transmission of pixel data | Ireland, with onward transfer to the United States |
| Microsoft Corporation (Microsoft Clarity) | Website behaviour analytics, including session replay and heatmaps | United States |
| Cloudflare, Inc. | Content delivery, traffic security and rate limiting | Global edge network |
Analytics and advertising tools only run where you have accepted the relevant cookies. See Section 13.
Others we may share data with
- Professional advisers — lawyers, accountants, auditors, insurers and consultants, acting as controllers or processors depending on the engagement.
- Funders, investors and acquirers — in connection with the financing, sale, reorganisation or acquisition of our business or any part of it, subject to confidentiality undertakings.
- Payment and collection providers — where needed to collect sums due or make payments to you.
- Collections and enforcement agents — where an account falls into arrears.
- Regulators, law enforcement, courts and tax authorities — where we are required to disclose, or where disclosure is necessary to establish, exercise or defend legal claims.
- Companies in the CapRelease group — including CapRelease Holdings Limited, CapRelease Financing Limited, CapRelease Inc and CapRelease Financing LLC, for the purposes described in this Privacy Policy.
13. Cookies and Similar Technologies
This section also serves as our Cookie Policy.
Cookies are small files placed on your device when you visit a website. We also use similar technologies such as pixels, tags, local storage and software development kits. In this section we call them all cookies.
Where we use them
Our website at www.caprelease.com uses the cookies set out below, managed through Google Tag Manager.
Our platform at app.caprelease.com sets strictly necessary cookies only — sign-in, session security and fraud prevention. No analytics, session recording or advertising technologies run on the platform.
The categories we use
| Category | What it does | Consent |
|---|---|---|
| Strictly necessary | Keeps you signed in, secures your session, supports traffic security and rate limiting, remembers your cookie choices, and protects against fraud and abuse. The site does not work without them. | Not required |
| Functional | Remembers your preferences and settings, and controls how often on-site messages are shown to you. | Required |
| Analytics | Tells us how our website is used, which pages are visited, and where people encounter difficulty. Includes Google Analytics and Microsoft Clarity, which may record heatmaps and session replays of your interactions with our website. | Required |
| Advertising | Measures the performance of our advertising, attributes sign-ups to campaigns, and builds audiences. | Required |
The cookies we set
| Cookie | Set by | Purpose | Duration | Category |
|---|---|---|---|---|
_cfuvid |
Cloudflare | Maintains session consistency and supports traffic security and rate limiting | Session | Strictly necessary |
CBWebflowFlowstarCurrentShownPerMonth |
CapRelease | Counts how often an on-site message has been shown to you in a month | 25 days | Functional |
CBWebflowFlowstarPerDayNew |
CapRelease | Counts how often an on-site message has been shown to you in a day | 1 day | Functional |
CBWebflowFlowstarStartDatePerDay |
CapRelease | Records when the daily count started | 1 day | Functional |
CBWebflowFlowstarStartDatePerMonth |
CapRelease | Records when the monthly count started | 25 days | Functional |
_ga |
Google Analytics | Distinguishes unique users by assigning a randomly generated identifier | 13 months | Analytics |
_ga_K5J4S7JZ32 |
Google Analytics | Persists session state | 13 months | Analytics |
_clck |
Microsoft Clarity | Records interactions and engagement with the website | 1 year | Analytics |
_clsk |
Microsoft Clarity | Combines multiple page views into a single session | 1 day | Analytics |
MUID |
Microsoft | Identifies a unique user across Microsoft domains | 13 months | Advertising |
SM |
Microsoft | Measures use of the website | Session | Advertising |
_fbp |
Meta | Identifies your browser so that advertising can be delivered and its effectiveness measured | 3 months | Advertising |
_fbc |
Meta | Stores the advertising click identifier; set only if you arrive from a Meta advert | 3 months | Advertising |
Where Google Ads or Meta advertising tags are active, they set additional cookies in the Advertising category.
Your choices
When you first visit our website you are shown a cookie banner. Nothing other than strictly necessary cookies is set until you make a choice. You can accept all, reject optional cookies, or choose by category, and you can change your choice at any time through the Cookie settings link in our website footer.
You can also control cookies in your browser settings, and block or delete them. Blocking strictly necessary cookies will stop parts of the site from working.
Most analytics and advertising providers offer their own opt-outs:
- Google Analytics — tools.google.com/dlpage/gaoptout
- Google Ads personalisation — adssettings.google.com
- Meta — www.facebook.com/adpreferences
- Microsoft Clarity — clarity.microsoft.com/terms
How long cookies last
Session cookies are deleted when you close your browser. Persistent cookies remain for the periods shown in the table above. Cookies set by third parties are also governed by their own retention periods, set out in their privacy policies.
Do Not Track
Our website does not currently respond to Do Not Track browser signals, because no common standard for them has been agreed. Use the Cookie settings link instead.
14. Contact Us and How to Complain
Contact
For anything to do with this Privacy Policy, or to exercise any of your rights:
Email: hello@caprelease.com
Telephone: 0330 818 6313
Post: Data Protection, CapRelease Limited, 71–75 Shelton Street, Covent Garden, London WC2H 9JQ
We are not required to appoint a Data Protection Officer, and we have not appointed one. Privacy enquiries are handled by our management team at the address above.
Complaints
If you are unhappy with how we have handled your personal data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office:
Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Telephone: 0303 123 1113
www.ico.org.uk
Complaining to the ICO does not affect your right to seek a remedy through the courts.