Privacy Policy

1. Who We Are

Capitarra ("Capitarra," "we," "us," or "our") is owned and operated by Rox Commerce LLC, with its registered office at 66 W. Flagler Street, Suite 900, Miami, FL, USA. This is our privacy statement and data retention policy (“Privacy Policy”), which explains how we collect, use, share, and protect personal data when you visit the Capitarra website or use the Capitarra platform — including the Investor Profile, Country Intelligence, Scenario Modelling, and Strategy Reports features as defined herein (together, the "Service").

Your access to, and use of, the Capitarra website and/or the Capitarra platform are subject to this Privacy Policy and certain other terms and conditions, contained in our Terms and Conditions.

If you are located in the European Economic Area ("EEA"), the United Kingdom ("UK"), or another jurisdiction with comparable data protection law, this Privacy Policy is intended to meet the requirements of the European Union (“EU”) General Data Protection Regulation ("GDPR") and the UK GDPR.

2. Personal Data We Collect

a) Account & Settings data — name, email address, password (stored encrypted/hashed), and records of account changes (email updates, password resets, account deletion requests).

b) Investor Profile data — the personalisation inputs you choose to provide so we can calculate your Match Score and tailor Strategy Reports to you, including your primary investment objectives, usage intention, return priority, financing preference, FX sensitivity, and climate preference. This is investment-preference data only — it is not health, biometric, racial, religious, or other "special category" data under Article 9 GDPR.

c) Scenario Modelling data — the property and financing assumptions you enter to run ROI/IRR calculations, such as purchase price, monthly rent, vacancy rate, operating costs, expected appreciation, holding period, down payment, mortgage rate, and mortgage term, and any scenarios you choose to save.

d) Billing & payment data — billing name and address, invoices, and your purchase history (e.g., purchased Reports or Passes). We do not receive or store full payment card numbers — payments are processed by our third-party payment processor under its own privacy and security terms.

e) Match Scores and purchased Reports — the country rankings, Match Score outputs, and Intelligence Report snapshots associated with your account at the time of purchase.

f) Usage & device data — IP address, browser and device type, pages visited, links clicked, and similar information collected automatically via cookies and similar technologies (see Section 8).

g) Communications — messages you send us (e.g., support requests) and, where applicable, your interactions with marketing emails or in relation to webinars you've signed up for.

We do not knowingly collect government ID numbers, health data, or other “special category” data, and we ask that you not submit such information to us.

3. How and Why We Use Personal Data

4. Match Score and Automated Personalisation

Your Match Score is calculated by an algorithm that weighs eleven standardised country indicators against the preferences in your Investor Profile, exactly as described in our Methodology Center. This is automated processing that ranks countries — it does not produce a legal or similarly significant automated decision about you (it does not approve, deny, or grant you access to anything), so it falls outside the scope of Article 22 GDPR. You can review, edit, or delete your Investor Profile at any time; saving changes automatically refreshes your Match Score and rankings.

5. Who We Share Data With

We share personal data only as needed to operate the Capitarra platform and perform the Service, including with:

• Our payment processor, to process payments and prevent fraud (e.g. Stripe).
• Cloud hosting, authentication, database, and storage providers, to host the Capitarra platform, securely store user data, authenticate users, and provide file storage.
• Technology service providers and independent contractors, who assist us in developing, maintaining, hosting, securing, and supporting the Capitarra platform, and who process personal data only on our instructions and under appropriate confidentiality obligations.
• Email and communication service providers, to send transactional communications and, where permitted or with your consent, marketing communications.
• Analytics service providers, to help us understand how the platform is used and improve our Services, primarily through aggregated or pseudonymised data.
• Regulators, courts, or law enforcement, where required by law.
• A successor entity, in connection with a merger, acquisition, corporate reorganisation, or sale of all or substantially all of our assets, subject to the protections described in this Privacy Policy.

We do not sell or rent personal data.

6. International Data Transfers

We are headquartered in the United States (“US”). If you are located in the EEA, UK, or elsewhere outside the US, your personal data will be transferred to, and processed in, the US and potentially other countries where our service providers operate and where privacy laws may differ. Where required, we rely on appropriate safeguards — such as the European Commission's Standard Contractual Clauses and the UK's International Data Transfer Addendum — to protect these transfers. In addition, the Capitarra website may be viewed and accessed anywhere in the world, including countries that may not have laws regulating the use and transfer of personally identifiable information. By using our website, submitting information through our website, or submitting personal information to us through other means, you voluntarily consent to such international transfer and hosting of such information to those countries and parties.

7. Data Retention

• Account and Investor Profile data: retained while your account is active; deleted or anonymized within [30–90] days of a verified deletion request.
• Scenario data: retained while your account is active, or deleted earlier at your request.
• Purchased Reports and Invoices: retained as a record of your purchase for as long as required for accounting, tax, and consumer-protection purposes (commonly up to 10 years depending on jurisdiction), even after account deletion — so there is always a clear record of what you bought and paid for.
• Usage/analytics data: retained in identifiable form for up to [12–24] months, then aggregated or deleted.
• Communications: Your personal details for marketing communications will be retained for a period of three years from the date of your last interaction with the marketing communication (i.e., opening an email or clicking on a link within the email) at which point all of your personal details is removed from our systems. Where you tell us that you no longer wish to receive marketing messages about our Service, we will keep this information about you until you tell us otherwise. This is to ensure that we don’t send you any further marketing communications in error.

8. Cookies and Similar Technologies

We use:

• Strictly necessary cookies (e.g., to keep you logged in) — these cannot be switched off.
• Analytics cookies (e.g., to understand which pages and features are used) — used only with your consent where required by law.
• Marketing cookies (e.g., to measure which campaigns brought you to our website) — used only with your consent where required by law.

You can manage cookie preferences through the banner shown on your first visit, or through your browser settings. For full details on the specific cookies we use, see our Cookie Policy. Please be advised that certain sections or functionalities of the Capitarra website may be inaccessible to you if your browser does not accept cookies.

9. Your Rights

In accordance with applicable data protection laws, including but not limited to the GDPR, you have a right to:

• Access your personal data by requesting a copy of the personal information we hold about you and details of how we use that information.
• If any of the information held about you is incorrect or out of date, you have the right to amend or rectify it. Please follow the process outlined below and we will amend our records where appropriate.
• You have the right to require us to erase your personal data, stop processing your personal data, restrict the processing of your personal information, right of portability of your personal information and/or to withdraw your consent to processing. This may not apply if there are other legal justifications to continue processing.
• You have a right to lodge a complaint with a relevant supervisory authority.

If you think we may have incorrect personal information, or would like a copy of the personal information we hold on you, or to exercise any other data protection right, you can email us at legal@capitarra.com . Please note that we need to verify your identity before we can provide you with any information

You can manage most of this directly from Settings (change email, reset password, update billing information, download invoices, delete account). For anything else, contact us at legal@capitarra.com.

10. Security

We use industry-standard safeguards to protect personal data from loss, misuse, alteration or destruction, including encrypted password storage, encrypted data transmission (HTTPS/TLS), and access controls limiting who can view personal data. No system is 100% secure, and we encourage you to use a strong, unique password. We cannot guarantee that your personal data will not become accessible to unauthorized persons and we cannot be responsible for actions resulting from a breach of security when information is supplied over the Internet or any public computer network.

11. Children

The Service is intended for adults making investment decisions and is not directed at, or knowingly offered to, anyone under 18. If we learn we have collected data from a minor, we will delete it.

12. Links to other websites

Our website contains links to other websites that are not operated by us. This Privacy Policy does not cover, and we are not responsible for the privacy practices and protection or the content of third party websites to which we link from this website. We encourage you to read the privacy statements on the other websites you visit. We cannot control the content or security of such websites. We cannot be held responsible for any loss or damage incurred by a user as a result of visiting such websites. No links are intended to be, nor should be construed as, an endorsement of any kind by us of that other website.

13. Additional Disclosures for US Residents

This section supplements the rest of this Policy and applies if you are a resident of a US state with its own consumer privacy law (including California, Colorado, Connecticut, Virginia, Texas, Oregon, and other states as their laws take effect).

Categories of personal information. In the past 12 months, we have collected the categories of personal information described in Section 2, which fall under the following categories under US state law: identifiers (name, email, account ID); commercial information (purchase and billing history); internet or other electronic network activity (usage and cookie data); financial information limited to billing name and address (we do not collect full payment card details); and inferences drawn from your Investor Profile to generate your Match Score and personalised Report content.

Sensitive personal information. Your account password is treated as "sensitive personal information" under some state laws solely because it is a login credential. We use it only to authenticate you and do not use or disclose it for any other purpose.

Sale and sharing. We do not sell personal information for money. We may use cookies and similar technologies (e.g., advertising pixels) that some state laws classify as "sharing" personal information for cross-context behavioral advertising, even though no sale occurs. You can opt out at any time via the "Your Privacy Choices" link in the website footer, or through the Cookie Settings described in our Cookie Policy.

Your rights. Subject to the law of your state, you may have the right to know what personal information we hold about you, request its deletion, correct inaccurate information, opt out of sale/sharing and targeted advertising, and not be discriminated against for exercising these rights — we will not deny you the Service, charge a different price, or provide a lower-quality Service solely because you exercised a privacy right. To exercise these rights, contact us at legal@capitarra.com we may need to verify your identity against your account email before completing a request.

14. Additional Disclosures for Canadian Residents

This section supplements the rest of this Privacy Policy and applies if you are located in Canada.

Federal law (PIPEDA). We collect, use, and disclose your personal information only with your meaningful consent and for purposes a reasonable person would consider appropriate, consistent with the federal Personal Information Protection and Electronic Documents Act. You may access and request correction of your personal information, and may file a complaint with the Office of the Privacy Commissioner of Canada if you believe we have not met our obligations.

Quebec residents. If you are located in Quebec, the following additional disclosures apply under Quebec's Act respecting the protection of personal information in the private sector ("Law 25"):

• We have a designated person responsible for the protection of personal information at Rox Commerce LLC, reachable at legal@capitarra.com
• Your Match Score is generated through automated processing of your Investor Profile, as described in Section 4 and our Methodology Center. You have the right to be informed of this, to request an explanation of the main factors and parameters that produced your result, and to submit comments to a member of our staff who can review them.
• Because Rox Commerce LLC is based in the United States, your personal information is transferred outside Quebec as described in Section 6 (International Data Transfers). We take this into account before any such transfer to confirm the data will receive adequate protection.

Marketing emails. Where we send you promotional emails, we do so consistent with Canada's Anti-Spam Legislation (CASL) — with your prior consent, clear sender identification, and a functioning unsubscribe mechanism in every message.

15. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated version with a new "Last updated" date and, where changes are material, provide additional notice (e.g., by email or an in-app banner).

16. Contact Us

Rox Commerce LLC (operating Capitarra) 66 W. Flagler Street, Suite 900, Miami, FL, USA Email: legal@capitarra.com