1. Introduction and Scope
This Privacy Policy describes how Digital Alpha Technologies, Inc. ("Digital Alpha," "Quiver," "we," "us") collects, uses, discloses, and protects personal information in connection with the Quiver platform, used by fund general partners (GPs) and limited partners (LPs) for fund administration, capital calls, and related services. This policy applies to our web application and any associated services.
Quiver is a US-based service. Our infrastructure and the personal information we control is stored and processed in the United States. Some third-party service providers we use, described in Section 3, may process data as part of providing their services to us.
2. Information We Collect
- Account information: name, email address, phone number, password stored in hashed form, and role within your organization.
- Investor (LP) profile information: legal name, Social Security Number or Employer Identification Number, date of birth, citizenship, occupation, address, tax classification and tax identification information, and know-your-customer (KYC) documentation.
- Bank account information: bank name, account holder name, last four digits of your account number, and account type. We do not directly collect or store your full bank account or routing number. These are handled by Plaid and exchanged for a secure token.
- Payment authorization information: records of your authorization for ACH debits, including the date, IP address, and browser/device information at the time of authorization.
- Transaction information: capital call and payment records, transaction status, and related identifiers from Stripe.
- Fund and organization information: fund, fund class, and capital call details relevant to your investment or fund management activity.
- Documents you upload: fund documents, KYC documents, proofs of payment, tax documents, and similar files.
- Usage information: pages and features you access, actions you take in the app, device and browser information, and diagnostic/error information collected via our product analytics provider.
- Communications: records of emails and messages we send to you through the platform.
3. How We Share Information: Service Providers
We do not sell your personal information, and we do not share it with third parties for cross-context behavioral advertising. We share personal information only with service providers who help us operate the platform, as described below.
4. Cookies and Similar Technologies
Our application uses a small number of first-party cookies necessary for the app to function: a secure, browser-session cookie used to maintain your login session, and a cookie that remembers which organization you have selected within the app. These cookies are set with secure, strict same-site attributes.
Your authentication session token is held only in your browser's memory while you are using the app and is not stored in persistent browser storage.
If you link a bank account through Plaid and are redirected to your bank's login page and back, we temporarily store limited session information in your browser for up to 30 minutes to resume that process securely. This does not include your bank credentials.
PostHog and features embedded from Plaid or Stripe may set their own cookies or use browser storage as part of providing their services; we do not control these directly. Please refer to those providers' privacy disclosures for details. Our website also loads fonts and icon images directly from Google's servers, which may expose basic technical/network information to Google as a normal part of how web browsers load such resources.
5. Data Retention
We retain personal information for as long as necessary to provide our services and to satisfy legal, tax, and regulatory recordkeeping obligations applicable to us and to the fund managers we serve, including obligations under securities, tax, and payment-network regulations that in some cases require retention of financial records for several years. Our internal data retention practices are governed by a separate internal policy, and we dispose of information when it is no longer needed and no longer subject to a retention requirement.
6. Your Privacy Rights
Depending on where you live, you may have rights regarding your personal information, including the right to know what personal information we hold about you, the right to request a copy of it, the right to request correction of inaccurate information, and the right to request deletion, subject to our legal and regulatory recordkeeping obligations described in Section 5.
6.1 California, New Jersey, and Texas residents
If you are a resident of California, New Jersey, or Texas, applicable state privacy law may give you the rights described above, as well as the right to opt out of the sale or sharing of personal information for targeted advertising. We do not sell personal information and do not share it for targeted advertising purposes, so no opt-out action is currently necessary. You will not receive discriminatory treatment for exercising any privacy right.
6.2 New York residents
New York does not have a comprehensive consumer privacy law equivalent to the above, but we apply the same data security and breach notification practices to New York residents as required under applicable New York law.
6.3 How to exercise your rights
To make a request regarding your personal information, contact us using the information in Section 10. We will respond to verified requests within 30 days. Please note that some requests may be limited by our obligation to retain certain records, for example financial, tax, or compliance records, for a legally required period, as described in Section 5.
7. Data Security
We apply administrative, technical, and physical safeguards designed to protect personal information, including encryption of sensitive data fields, access controls, and secure infrastructure practices. Further detail is available in our Information Security Policy, available on request. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
8. Children's Privacy
Quiver is a business platform intended for use by accredited investors, fund managers, and their authorized representatives. It is not directed to, and is not intended for use by, individuals under the age of 18. We do not knowingly collect personal information from children.
9. Changes to This Policy
We may update this Privacy Policy from time to time. We will post the updated policy with a revised "Last updated" date, and, where required by law, provide additional notice of material changes.