Privacy Policy

This Policy applies to personal information processed in connection with the Platform. It does not apply to information processed solely by third parties under their own policies (for example, Google or WhatsApp after you leave our site).

If you are in Mexico or we process your personal data as a Mexican data subject, our Aviso de Privacidad also applies. In case of conflict on Mexican privacy rights, the Aviso controls for those rights. Our Cookie Policy describes cookies in more detail. Our Terms of Service govern use of the Platform.

We do not sell your personal information for money. We do not share it for cross-context behavioral advertising.

The organization responsible for the personal information described in this Policy is:

• Golden State Capital Management
• 401 B Street, Suite 1850, San Diego, CA 92101, United States
• Email: investors@goldenstatecap.com
• Phone: +1 (619) 769-4155

Privacy requests may be sent to the same email with the subject line "Privacy request."

We collect information in the following categories. The examples are illustrative, not exhaustive.

• Account and identifiers. Email address, password (stored in hashed form if you register with credentials), name, phone number and country code, language preference, and unique account identifiers. If you use Google sign-in, we receive the identifiers Google shares with us (typically name, email, and a Google account ID).
• Investor profile. Country or location (for example, United States or Mexico), planned investment range, investment goals, project-type interests, experience level, referral source, optional background notes, and whether you indicate interest in an investor visa (used only to understand your goals—not as an immigration filing).
• Accreditation and KYC documents. Government-issued ID (passport, driver's license, or national ID), proof of income or net worth, and related files you upload. These are sensitive personal information.
• Investment operations. Investment requests, preferred meeting type, WhatsApp or other channel you choose, deposit amounts, transfer reference numbers, deposit dates, receipts you upload, cash-out and reinvestment requests, holdings, and related operational notes.
• Communications. Messages you send via contact forms, Work with us, email, phone, or WhatsApp; records of our replies; and transactional emails (verification, password reset, deposit or document notices).
• Careers. Name, email, phone, role interest, and message content if you apply or introduce yourself.
• Device and usage. IP address (including for first-visit language detection), browser type, pages viewed, approximate location derived from IP, and cookie identifiers as described in the Cookie Policy.
• Admin and security logs. Account status, accreditation status, timestamps of key actions, and records needed to prevent fraud and abuse.

We collect information directly from you, from your devices, from Google if you choose Google sign-in, from our service providers who process data on our behalf, and from our team when they record operational confirmations (for example, that a wire was received).

We collect sensitive personal information as that term is used under the California Consumer Privacy Act (as amended by the CPRA), including government identifiers and financial information used to verify accredited-investor status and to confirm deposits.

We use this information only as reasonably necessary to: verify identity and eligibility; prevent fraud; complete investor onboarding; confirm bank transfers you report; comply with law; and maintain the security of the Platform. We do not use sensitive personal information to infer characteristics about you for advertising.

California residents may have the right to limit certain uses of sensitive personal information. Because we do not use it for purposes other than those listed above, a "limit the use" request will typically confirm that we already restrict use to those purposes.

We use personal information to:

• Create and secure accounts, verify email, and authenticate sign-in (including Google).
• Complete investor profiles and review accreditation documents.
• Communicate about opportunities, meetings, deposits, project documents, distributions, and account status.
• Match deposit receipts to projects and maintain portfolio records.
• Respond to contact, support, and career inquiries.
• Detect, investigate, and prevent fraud, unauthorized access, and abuse.
• Comply with securities, tax, anti-money-laundering, sanctions, and other legal obligations, and to establish or defend legal claims.
• Improve the Platform, remember your language, and (when enabled) measure site usage as described in the Cookie Policy.
• Understand, at a high level, whether a prospective investor has visa-related goals—not to provide immigration services.

We share personal information only as described below:

• Service providers that host the site, store files (including private cloud storage for investor documents), send email, provide authentication, or analyze usage, under contracts that limit their use of the data.
• Professional advisers such as lawyers, accountants, auditors, and tax preparers, where reasonably necessary.
• Banks and payment counterparties as needed to identify a transfer you made; we do not publish wire instructions in the app or by email.
• Authorities when required by law, legal process, or to protect rights, safety, and integrity.
• Corporate transactions if we are involved in a merger, acquisition, financing, or sale of assets, subject to appropriate confidentiality.
• With your direction, for example when you open WhatsApp to message our team (WhatsApp then processes the conversation under its own terms).

Authorized Golden State administrators can access investor documents and operational records as needed to run the business. Other investors cannot see your identity documents or personal wallet activity.

We use cookies that are necessary to operate the Platform (for example, to keep you signed in and to remember your language via the NEXT_LOCALE cookie). We may also use analytics cookies when measurement tools such as Google Analytics are enabled. Details, retention, and how to control cookies are in our Cookie Policy.

On a first visit we may infer a language preference from your browser or IP-related signals. You can override that choice at any time with the language toggle.

We are based in the United States. If you access the Platform from Mexico or elsewhere, your information will be transferred to and processed in the United States (and in other countries where our providers operate). Those countries may have data-protection rules different from those in your home country.

By using the Platform or submitting information, you understand that your information will be processed in the United States as described in this Policy and, for Mexican data subjects, in the Aviso de Privacidad.

We retain personal information for as long as needed for the purposes described in this Policy, including:

• Account and profile data while your account is active and for a reasonable period afterward to resolve disputes and meet legal duties.
• Accreditation, KYC, and investment records for the period required by securities, tax, AML, and accounting rules—often several years after the end of a relationship or project.
• Communications and career inquiries for a period needed to respond and keep a business record.
• Security logs for a period needed to investigate incidents.

When information is no longer required, we delete it or de-identify it, except where we must keep a copy under law or for legitimate legal claims.

We use administrative, technical, and physical safeguards reasonably designed to protect personal information, including access controls for investor documents, private (non-public) storage for identity and receipt files, and hashed passwords for credential accounts.

No method of transmission or storage is completely secure. You are responsible for using a strong unique password (or Google sign-in) and for protecting access to your devices and email.

Depending on where you live, you may have rights to request access, correction, deletion, or a copy of your personal information, to object to or restrict certain processing, and to withdraw consent where processing is based on consent. We will not discriminate against you for exercising privacy rights.

To make a request, email investors@goldenstatecap.com with enough detail for us to verify your identity and understand the request. We may need to retain certain information (for example, investment and KYC records) even if you ask us to delete an account, where the law requires it.

Mexican data subjects should also review the ARCO procedures in the Aviso de Privacidad.

If you are a California resident, the California Consumer Privacy Act as amended by the CPRA may provide rights to: know the categories and specific pieces of personal information we collected; know the categories of sources, purposes, and categories of third parties with whom we disclose information; request deletion or correction; and opt out of "sale" or "sharing" for cross-context behavioral advertising.

Sale and sharing. We do not sell personal information and we do not share it for cross-context behavioral advertising as those terms are defined in California law. If that practice changes, we will update this Policy and provide a required opt-out.

Sensitive personal information. We collect government identifiers and financial information as described in Section 4, used only for the limited purposes stated there.

Categories collected. In the preceding 12 months we may collect identifiers; commercial information related to investment inquiries; financial and account information; internet or electronic activity; professional information (careers); and sensitive personal information (ID and financial verification documents). We disclose these categories to service providers and advisers as described in Section 6.

You may designate an authorized agent to make a request, subject to verification. We will respond within the timeframes required by law. If we deny a request, we will explain why, subject to legal limits.

If you are in Mexico, Mexican data-protection law (including the Ley Federal de Protección de Datos Personales en Posesión de los Particulares and its regulations, as applicable) may grant ARCO rights and rights to revoke consent and limit use. Those rights, purposes, transfers, and mechanisms are set out in our Aviso de Privacidad, which is the controlling privacy notice for Mexican data subjects.

The Platform is not directed to children under 18, and we do not knowingly collect personal information from children. If you believe a child has provided information, contact us and we will take appropriate steps to delete it.

The Platform may link to Google, WhatsApp, scheduling pages, maps, or other sites. Their privacy practices are governed by their own policies. Review those policies before providing information to them.

We may update this Policy from time to time. The "Last updated" date will change when we do. Material changes may also be notified by email or a notice on the Platform. Continued use after the effective date constitutes acceptance where permitted by law.

Golden State Capital Management, 401 B Street, Suite 1850, San Diego, CA 92101, United States. Email: investors@goldenstatecap.com. Phone: +1 (619) 769-4155.