Privacy Policy

The controller responsible for processing your personal data is:

Legal name:

Amunt Software S.L.

Tax ID:

B-24773137

Registered address:

Calle Diputacio, 276, P. 1 Pta. 1. 08009, Barcelona, España

Contact email:

info@amunt.app

To provide you with a precise tool for managing your cap table and legal processes, we need to collect the following categories of data:

• Marketing communications: Your email address and company name, only if you gave them to us to hear about news (for example, on the former waitlist).
• Account and Profile Data: First and last name, email address, profile photo, identity document number (DNI or NIF) if you add it, preferred language, whether you are a founder or an investor and, if you use one, your password (stored only as a hash, never in plain text). If you sign in with Google, LinkedIn or Microsoft, we receive your name, email address and profile photo from them.
• Corporate and Financial Data: Cap table, share classes, valuations, funding rounds and convertible loans, negotiations with investors, investment agreements, and legal documents (shareholder agreements, minutes, contracts). In these cases, Amunt will often act as a data processor for third-party data that you upload to the platform.
• Data a company gives us about you: If a company adds you as a shareholder, investor, lender or signer, it gives us your name, your email address and, where the documents need them, your tax ID and address. We use them to write to you (the offer, the negotiation, the signature) and to draw up those documents. If you later sign in to Amunt with that email address, you find what is waiting for you there.
• Conversations with the assistant: If you use the in-app assistant, we keep what you write to it and what it answers, and delete each conversation once it has gone unused for 90 days.
• Technical Data: IP address, browser type, device data, and activity logs to ensure security and generate the audit trail. When you sign a document in Amunt, we keep the IP address and the time as evidence of the signature.

• Service Delivery: Operating the software, calculating dilution, running the exit simulator, and automatically generating legal documents.
• Security and Audit: Maintaining immutable audit trails for due diligence workflows and preventing fraud or unauthorized access.
• Transactional Communications: Sending critical notifications such as sign-ins, pending signatures, and password resets through secure providers.
• Billing: Charging each company's subscription and issuing its invoices, through Stripe.
• Product Improvement: Understanding how the platform is used (pages visited and actions taken, never what you type, names or amounts) to improve its performance and design. It is linked to your account only if you accept analytics cookies.
• Marketing Communications: Sending beta updates or new feature announcements only if you have provided explicit consent, for example, by joining the waitlist.

• Performance of a contract: To provide Amunt services to you under our Terms and Conditions.
• Explicit consent: For marketing communications (such as the former waitlist) and for analytics cookies.
• Legitimate interest: To ensure network security, prevent fraud, and improve the software architecture.
• Legal obligation: To comply with tax regulations and requests from competent authorities.

We never sell your data to third parties. We only share information with first-tier strategic infrastructure providers that are strictly necessary to operate Amunt. We require all of them to comply with GDPR:

• Hosting and database: Vercel, Inc. (hosting and running the application) and Neon (database, with servers in Frankfurt, Germany).
• File storage: Cloudflare R2 (documents, logos and profile photos). Documents are kept in private storage and open only through a short-lived link for people with access.
• Transactional Email and Authentication: Resend (for critical access emails and system alerts).
• Marketing and Waitlist: Resend (for marketing communications and waitlist management).
• Payments: Stripe (subscription payments). You enter your card details with Stripe, and they never reach Amunt.
• Electronic signature: Signaturit Solutions, S.L. (Spain), when a document is signed through it; it receives the document and the name and email address of each signer.
• AI assistant: Anthropic, PBC (United States), which provides the model behind the in-app assistant. Only when you use it, it receives what you write and the company data the assistant looks up to answer.
• Error tracking and product analytics: Sentry (Functional Software, Inc., EU region, servers in Germany), to find and fix errors; and Mixpanel (Mixpanel, Inc., data stored in the EU), to understand how the platform is used, linked to your account only if you accept analytics.

If you connect an outside AI agent to your account (for example Claude or ChatGPT, with an API key or through OAuth), the data that agent reads goes to its provider under your own agreement with them. That provider does not work for Amunt.

If any of these providers transfers data outside the European Economic Area (EEA), we ensure that Standard Contractual Clauses (SCCs) approved by the European Commission are in place.

All data travels encrypted (HTTPS) and our providers store it encrypted. Passwords are stored only as a hash, documents in private storage behind short-lived links, and the cap table's ledger of transactions cannot be changed or deleted.

We will retain your personal and corporate data while your account remains active. If you close your account (from your profile), we anonymize your personal data, except where we are legally required to retain it, such as electronic signature records or invoicing data, for the applicable statutory limitation period. The data a company has recorded about its shareholders and investors stays in its cap table, because it is part of the company's history.

Under GDPR, you have the right to exercise full control over your data. You may request:

• Access: To know what data we hold about you.
• Rectification: To correct inaccurate or incomplete data.
• Erasure (Right to be forgotten): To delete your data when it is no longer necessary.
• Restriction and Objection: To restrict certain data processing activities, for example, unsubscribing from email communications.
• Portability: To receive your data in a structured, commonly used, machine-readable format.

To exercise these rights, simply email info@amunt.app and specify the right you wish to exercise. You also have the right to lodge a complaint with the Catalan Data Protection Authority (APDCAT) or the Spanish Data Protection Agency (AEPD) if you believe we have not handled your data correctly. You can also close your account at any time from your profile.

We reserve the right to update this Privacy Policy to reflect changes in the platform architecture or new legal obligations. We will notify you of any material changes through the email address associated with your account.

We use the technical cookies below to make the service work and, only if you accept them in the cookie banner, analytics cookies that help us understand how Amunt is used. Without them we still count, anonymously, which pages are visited and a few named actions; accepting lets us link those visits to your account id. We never record what you type, the names or amounts on screen, or your sessions.

• NEXT_LOCALE cookie (technical): Stores your language preference (es, en, or ca) so the website can be shown in your chosen language on future visits. This cookie is not used for analytics, advertising, or profiling.
• Session cookie (better-auth.session_token, technical): Keeps you signed in while you use Amunt, and expires after 7 days without activity. Without it you cannot sign in to your account.
• Sign-in cookies (amunt.sign_in_requested and better-auth's own, technical): When you ask for a sign-in link, they remember it was asked for from this browser so the link signs you in directly, and when you sign in with Google, LinkedIn or Microsoft they protect that step. They last minutes and are cleared once the link is used or expires.
• Discount code cookie (amunt_promo): If you arrive through a discount or affiliate link (with ?promo= or ?ref=), it remembers the code for 30 days so it applies when you pay for the subscription. It holds no data about you.
• Cookie preference cookie (amunt-analytics-consent, technical): Remembers for 1 year whether you accepted or rejected analytics cookies. The same choice is kept in the browser's local storage.
• Browser local storage: Inside the app, your browser remembers the last pages you opened from search (⌘K) and which sections you have collapsed. This data never leaves your device.
• Sentry (error tracking, no cookies): Run by Functional Software, Inc. on servers in the EU. When something fails, a report of the error and the address of the page is sent, without cookies and without identifying you. Retention: up to 90 days.
• Mixpanel (usage statistics, and analytics cookies if you accept): Run by Mixpanel, Inc., with data stored in the EU. Anonymous usage statistics (pages visited and actions taken) are sent without cookies and without identifying you. If you accept analytics, a cookie (mp_*_mixpanel) keeps an anonymous visitor id, and when you are signed in your account id (never your name or email) is attached. Retention: up to 1 year.

Legal basis for technical cookies: legitimate interest (Art. 6(1)(f) GDPR) and technical necessity to provide the service you ask for (keeping you signed in, your language, signing in). As strictly necessary cookies, they do not require prior consent under applicable rules.

Legal basis for error tracking and anonymous usage statistics: our legitimate interest in keeping the service secure and working, and in improving it (Art. 6(1)(f) GDPR). They store nothing on your device and do not identify you.

Legal basis for analytics cookies: your consent (Art. 6(1)(a) GDPR and Art. 22.2 LSSI). You can withdraw it at any time from "Cookie settings" in the website footer or in your account menu.

Retention: each cookie lasts as long as its description says; the language cookie, until you close your browser or, if you choose your language in your profile, 1 year.

You can delete or block these cookies in your browser settings, although without the session cookie you cannot sign in and without the language cookie the site will not remember your language.