Privacy policy
Draft for legal review before launch.
Who we are
Rose Capital Group runs this investor portal for its own investors only. Accounts are by invitation.
What we keep and why
- Identity and contact details (name, email, phone, address, date of birth): to administer your investment and contact you.
- ID / SSN / passport number: required for tax reporting (K-1). Stored encrypted; only the last 4 digits are shown.
- Investment details, transactions and documents: this is the service itself.
- Security log (sign-ins, document views and downloads): to protect your account and meet audit requirements.
We don't sell data, and we use no advertising cookies or third-party analytics.
Cookies
Essential cookies only: a sign-in cookie (the sign-in ends on sign-out, or on our server after 30 minutes without activity, and after 7 days at most), a language cookie, and during a password reset a temporary cookie holding the email address you entered (up to 20 minutes).
Service providers that process data for us
| Provider | Location | What it does |
|---|---|---|
| Vercel Inc. | USA (Oregon) + global edge | Hosts the application: servers in Oregon, with requests passing through its global network (encryption in transit, routing) on the way. Does not store documents. |
| Supabase Inc. | USA (Oregon, us-west-2) | Database and document storage, double-encrypted. |
| Amazon Web Services | USA (Virginia, us-east-1) | Encrypted backup copy of documents. |
| GitHub, Inc. | USA | Runs the daily backup job: copies the documents, still encrypted, to the backup bucket. It doesn't hold the decryption key. |
| Twilio Inc. | USA | Sends sign-in codes by text message or WhatsApp, only if you choose it: receives your phone number. WhatsApp messages also pass through Meta. |
| Resend | USA | Sends email (invitations, codes, notifications). |
| Cloudflare, Inc. | Global | CAPTCHA check (Turnstile) on sign-in and password reset: receives IP address and browser signals. |
| OpenStreetMap Foundation | UK / EU | Property location map on investment pages: your browser loads map tiles. |
Security
Mandatory two-factor authentication, double encryption of documents, encrypted ID numbers, strict separation between investors, and a log of every document view.
How long we keep data
Investment and tax records are kept for as long as the law requires (typically at least 7 years). The log of emails we sent you is kept 180 days. Other personal data is deleted on request or when no longer needed.
Your rights
You can ask for a copy of your data, to correct it, or to delete it (subject to the retention duties above). Contact us: admin@the-rosegroup.com