Privacy Policy

We are a founder-led AI services firm in Raleigh. If you fill in our questionnaire, we use your answers to understand your business and decide whether we can help. We do not sell your information, and we do not share it with anyone who is not working on your project. If you want it deleted, say so and it is deleted.

Everything below explains that in detail. If something here does not match what you experience on our site, tell us — we would rather fix the document than defend it.

CapEx Solutions
5200 Greens Dairy Rd, Raleigh, NC 27616
yourpartner@capexsolutions.ai

That address is a real inbox that a person reads. Use it for anything in this policy — including asking us to delete your data.

We collect nothing about you until you choose to fill in the questionnaire at /start. There is no account to create and no login.

When you complete /start, we collect what you type into it: 29 fields. In plain terms:

• Who you are: your business name, your name, and your email address.
• About your business: what you do, who your customers are, your rough numbers, how the work gets done, where customers come from now, what you have already tried, and what growth looks like to you.
• About you and the business's story: why you started it, what you would miss if it closed, the moment you knew it was working, the hardest month, what a good week looks like, what you never want to do again, and what a good first thirty days would be.

Every one of those fields is optional at the database level, and "doesn't apply to us" or "I don't know" are real answers we would rather have than an invented number.

Alongside your answers our system records five technical values: an ID for the submission, the time you submitted it, which version of the questionnaire you saw, the date of our last substantive contact with you (which is what the retention clock below runs on), and whether you have become a client.

We do not collect payment details, government identifiers, health information, or anything about children. We have no reason to and we do not ask.

Your answers are saved in your own browser as you type, so a closed tab or a phone call does not lose your work. That draft never leaves your device until you press Send, and it is erased from your browser the moment a Send succeeds. If you abandon the form, nothing reaches us at all — there is no partial record of you on our side, because there is nothing to make one from.

Your answers are sent from your browser straight to our database, hosted by Supabase. Because that request goes directly, Supabase sees your IP address on it, as the company that runs the database for us. The form has permission to write and nothing else — it cannot read anything back, cannot check whether you have submitted before, and cannot see anyone else's submission. Nothing at all is sent to us before you press Send.

When you press Send, our system automatically creates and sends the following. This happens on our servers, not in your browser, and each step is logged so we can tell you what happened to your submission:

1. A PDF of your answers, reproduced exactly as you wrote them — we do not edit or summarise them.
2. A copy stored in a private storage area. It is not published, not indexed, and not reachable by a link.
3. A copy filed in a folder for you in our Google Drive. The system that files it can reach that folder and nothing else in our Drive.
4. An email to you from yourpartner@capexsolutions.ai, confirming we received it, with your PDF attached — your own copy, to keep.
5. An email to that same address, so a person here knows your questionnaire has arrived.

One honest consequence of step 4. Once that email reaches you, you hold a copy of your answers that we cannot delete, because it is in your inbox and not ours. If you later ask us to delete your data, we will delete every copy we hold — the database row, the PDF, the Drive file, and anything we derived from it — but the copy we sent you stays yours to keep or delete as you choose. We would rather say that plainly than let "we delete everything" quietly mean something narrower than it sounds.

The address that writes to you is the address that answers you. Your confirmation comes from yourpartner@capexsolutions.ai, and that is the same inbox a person here reads and the same one you use to ask for deletion. You can simply reply to that email and ask us to delete your data — you do not need to find this page again, quote a policy, or write to a different address than the one that wrote to you.

To understand your business, prepare for our conversation with you, and decide together whether we should work together. If we do, to do the work.

That is the whole list. We do not use your answers to build a mailing list, we do not feed them into advertising, and we do not use them to train anything.

• The people at CapEx working on your project. Nobody else here.
• Our hosting and storage providers — Supabase (database), Google (Drive and email) — who store the data on our behalf and are not permitted to use it for their own purposes.
• Adobe and our hosting platform see technical details only, never your answers. Because the page loads a typeface from Adobe Fonts, Adobe receives your IP address and browser type; Supabase receives your IP on the request that submits the form. The full list is in Cookies, storage and tracking below. None of them receives what you wrote.
• Nobody else. We do not sell your information, and we never have. We do not share it with data brokers, advertisers, or partner firms.

If we were ever legally compelled to disclose something, we would comply — and we would tell you unless we were prohibited from doing so.

Our retention rules are set out in full in our internal Data Retention and Destruction Policy, and this is a plain-language summary of the same numbers:

"Last substantive contact" means something you did — you wrote to us, called us, submitted again, or we actually held a conversation. Us emailing you does not restart your clock. That is deliberate: if our own outreach reset the timer, we could keep your data forever simply by continuing to contact someone who never replied. A booked meeting that nobody attended does not restart it either.

North Carolina law does not set a retention period — no state law does. The 12 months and the 7 years are our own choices, made on the principle that we should hold information only as long as we have a real reason to. Anyone who tells you there is a legal North Carolina retention period is mistaken.

Email yourpartner@capexsolutions.ai and ask. You do not need a reason and you do not need to be a client. If you still have the confirmation email we sent you, replying to it reaches the same inbox and is the easiest way.

When we delete, we mean it, and here is the full list of what that reaches:

• the row in our database;
• the PDF in our private storage;
• the copy in your folder in our Google Drive;
• every local copy we have exported;
• any document we produced that reproduces your answers.

Not "hidden from a list" — actually destroyed, to the standard N.C.G.S. § 75-64 requires, which is that the information cannot practicably be read or reconstructed afterwards.

The one copy we cannot reach is the one we emailed you. See the section on what happens when you press Send. That copy is yours; delete it whenever you like.

Every deletion is recorded before it happens, and our system is built so that a deletion cannot occur unless that record is written first. We keep that record — which contains no personal information, only that a deletion took place — for three years, so we can show you we did what we said.

North Carolina has no comprehensive consumer privacy statute. Two bills were introduced in the 2025–2026 session (S757 and H462) and neither has been enacted as of 2026-09-02.

The law that does apply to us is the North Carolina Identity Theft Protection Act:

• N.C.G.S. § 75-64 requires businesses holding personal information about North Carolina residents to destroy it securely, and to describe how they do that in writing. We have that written policy and this section summarises it.
• N.C.G.S. § 75-61(10), read with § 14-113.20(b)(8), defines the information the Act protects as a person's name combined with identifying details including an email address. Because our questionnaire collects your name and your email together, it is covered, and we treat it accordingly.

We do not claim GDPR or CCPA compliance, because neither applies to us today. If that changes, this policy changes with it, and we will say so rather than quietly rewriting the page.

Your answers travel over an encrypted connection and are stored in a database where the public form has permission only to write, never to read. Access to the stored data is restricted to CapEx people and requires credentials that the website itself does not hold.

We are a focused, founder-led firm, and we will not pretend to be a bank. We have taken the measures described here because they are the ones that actually protect you, not because a certificate required them.

When we change it, we will change the date at the bottom and, if the change is significant, say plainly what changed. We will not alter what we do and update this page quietly afterwards.

Two cookies are set, neither by us and neither about you as a person. We do not set any cookie of our own, and we use none for analytics, advertising or profiling. Two arrive from the infrastructure that serves the site:

Neither identifies you, follows you to other sites, or is read by anything we wrote.

We use no analytics. No Google Analytics, no Plausible, no Sentry, no advertising or social pixels, no product telemetry of our own. Nothing is recorded as you type.

One thing is stored in your browser, and it is your own draft. A single entry named capex_onboarding_v2 holds your answers so far, the step you are on, and a random ID your browser generates to keep your draft separate from anyone else's. That ID never reaches us, and the whole entry is deleted the moment a Send succeeds. Your browser also keeps a small, temporary note of your scroll position, which disappears when you close the tab.

Three things on our pages come from other companies. Here is all of them:

That is the complete list. No maps, no embeds, no video players, no other content delivery networks — everything else the page loads comes from us.

About the platform script, stated precisely. The site serves a script of its own, /~flock.js, from our own domain. Its code references an analytics service, and it is configured with a route through which it could report. On the published site it made no requests at all — not on load, not on clicking, not across page changes. We are telling you it is there rather than leaving it out, because it is code we did not write on a page where you type things about your business, and you are entitled to know that even when it does nothing.

Our Content-Security-Policy blocks it from contacting that analytics service directly. We will not overstate that protection: because the script is configured to report through our own domain rather than straight out, a same-origin route would not be stopped by that policy. What we can tell you is what we measured — nothing was sent — and that we will keep measuring.

Checked again on the published site, 3 September 2026 — and one thing had changed. An earlier version of this page said we set no cookies at all. On the live site that was wrong: the hosting platform sets __dpl and Cloudflare sets __cf_bm. Neither is ours and neither profiles you, but the flat claim was false, so it is corrected above rather than quietly softened. The editor-only script that ran on our preview build does not ship to the published site. Everything else held: no analytics, no pixels, no other third party, one browser draft entry, Adobe Fonts, and the direct database request on Send.