Privacy Policy
Last updated: July 1, 2026
01 Overview & Scope
This Privacy Policy explains how Guapaholics, Inc. ("Guapaholics," "we," "us," or "our") collects, uses, discloses, and protects information in connection with (a) this website and any subdomains (the "Site"), (b) demo requests and other forms submitted through the Site, and (c) at a summary level, the Guapaholics platform services described on the Site, including Guap Finance and the Autonomous Credit Intelligence Platform ("ACIP") (collectively, the "Services").
Guapaholics' enterprise and CDFI clients who onboard end users onto the Services do so under a separate Master Services Agreement and Data Processing Agreement, which govern how end-user financial data is processed in more detail and control which party acts as the data controller for that data. Where this Policy discusses Service-level data processing, it is a summary for transparency and does not override those agreements.
If you do not agree with this Policy, please do not use the Site or submit information to us.
02 Information We Collect
Information you provide to us
- Demo and contact requests: full name, company name, work email address, phone number (optional), organization type, estimated deployment volume, and any message you include.
- Whitepaper or resource downloads: the same categories as above, where a form is required to access the resource.
- Correspondence: anything you send us directly, such as emails to guapaholics@guapaholics.com.
Information collected automatically
- Device and usage data: IP address, browser type, operating system, referring/exit pages, and general usage patterns on the Site.
- Cookies and similar technologies: as described in the Cookies & Tracking section and our Cookie Policy.
Information processed through the Services
Where a client uses Guap Finance, ACIP, or the NAV trade-credit pathway, we (or our subprocessors) may process business and financial information on the client's behalf, such as bank account and cash-flow data (via Plaid), card issuance and transaction data (via Stripe Issuing), identity/KYC-KYB verification data, and credit or rental trade-line data (via NAV or Rental Kharma). Sensitive identifiers are tokenized using Skyflow's data vault where applicable to reduce our direct handling of raw PII. This processing is governed by our agreement with the client, not by this Policy directly.
02 How We Use Information
- Respond to demo requests and other inquiries, and schedule and conduct product demonstrations.
- Operate, maintain, secure, and improve the Site and the Services.
- Send administrative communications, and, where you've agreed to receive them, product updates or marketing communications, which you may opt out of at any time.
- Understand aggregate usage of the Site to improve content and navigation (only where you've consented to analytics cookies).
- Detect, investigate, and prevent fraud, abuse, and security incidents.
- Comply with legal obligations, including tax, accounting, sanctions screening, and anti-money-laundering requirements applicable to a fintech infrastructure provider.
Where GDPR applies to you, our legal bases for these uses are, as applicable: performance of a contract (responding to your requests), our legitimate interests (securing and improving the Site, direct marketing to business contacts), your consent (non-essential cookies and marketing communications), and compliance with legal obligations.
06 Data Retention
We retain demo-request and contact information for as long as needed to respond to your inquiry and pursue a potential business relationship, and generally delete or anonymize it within 24 months of last contact absent an ongoing relationship or legal requirement to keep it longer. Data processed on behalf of clients through the Services is retained per the retention schedule in the applicable client agreement, which typically reflects card-network, lending, and recordkeeping requirements (which can be several years).
07 Data Security
We use administrative, technical, and physical safeguards designed to protect information, including encryption in transit and at rest, role-based access controls, PII tokenization via Skyflow for sensitive identifiers, vendor risk review, and logging/monitoring of production systems. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security. See our Security & Compliance page for more on our ongoing security program.
08 International Data Transfers
Guapaholics is based in the United States and primarily serves US-based clients. If you access the Site from outside the United States, your information will be transferred to, stored, and processed in the United States and other countries where our service providers operate. Where required, we rely on appropriate safeguards for such transfers, such as Standard Contractual Clauses, and we enter into data processing addenda with subprocessors that handle personal data on our behalf.
09 Your Privacy Rights
US state privacy laws
Depending on where you live (for example, California, Colorado, Connecticut, Virginia, Utah, or other states with comprehensive privacy laws), you may have the right to know/access what personal information we hold about you, request correction or deletion, opt out of targeted advertising or the "sale" or "sharing" of personal information (we do not currently sell or share personal information for cross-context behavioral advertising), and not be discriminated against for exercising these rights. You can exercise these rights by emailing guapaholics@guapaholics.com. We will verify your request using the information available to us before acting on it.
EU/UK/GDPR rights
If GDPR or the UK GDPR applies to you, you have the right to access, rectify, erase, or restrict processing of your personal data, to data portability, to object to processing based on legitimate interests or for direct marketing, and to withdraw consent at any time without affecting prior processing. You also have the right to lodge a complaint with your local data protection authority. Contact us at guapaholics@guapaholics.com to exercise these rights.
10 Children's Privacy
The Site and Services are directed to businesses and are not intended for individuals under 18. We do not knowingly collect personal information from children. If you believe a child has provided us information, contact us at guapaholics@guapaholics.com and we will delete it.
11 Do Not Track & Global Privacy Control
Some browsers send a "Do Not Track" signal; there is no accepted industry standard for responding to it, so we currently do not respond to DNT signals differently from other visitors. Where legally required, we honor the Global Privacy Control (GPC) as a valid opt-out of the sale/sharing of personal information for the browser session in which it is sent.
12 Changes to This Policy
We may update this Policy from time to time. Material changes will be reflected by updating the "Last updated" date above, and where appropriate, through additional notice on the Site.
13 Contact Us
Questions about this Policy or requests regarding your personal information can be sent to guapaholics@guapaholics.com.