Privacy Policy

What We Collect

The only personal information we ever collect is:

• Email address— only if you join the waitlist, submit feedback, send us a contact message, or create an Intentional ID account.
• Display name and passkey public key— only if you sign in with an Intentional ID account.
• Financial snapshots— only when you explicitly transfer a snapshot from SeeMyZakat to analyze your portfolio. See the Cross-Site Boundaries section below.

We do not collect your name, phone number, mailing address, or browser fingerprints.

How We Use Your Email

Your email is used exclusively to notify you about Intentional Capital product updates and launch announcements, or to reply to feedback or contact submissions. We will not sell, share, or rent your email to third parties. You can request removal at any time.

To detect duplicate waitlist signups without leaking emails across storage rows, we compute a SHA-256 hash of your email with a server-side salt. The hash is stored alongside the plaintext email (needed for notifying you at launch). If you request deletion, both the hash and the plaintext are removed.

Authentication (Optional)

Intentional Capital supports optional sign-in via Intentional ID— our WebAuthn/passkey-based authentication service operated at intentional-engines.com. Public marketing pages work without signing in.

If you sign in, we set a session cookie named __intentional_session on intentional-capital.com. It is httpOnly, AES-256-GCM encrypted, signed, and scoped to this domain with a 7-day lifetime. When signed in, Sentry error reports include your anonymous user ID in breadcrumbs so we can triage support requests — never your financial data.

See the Intentional Engines privacy policy for how the auth provider handles your data.

Capital Wealth (Client-Facing Platform)

If you use Intentional Capital's client-facing wealth management platform, it proxies computations to our Platform API — retirement projections, tax optimization, and values-based analysis. Financial inputs you provide are used only to compute the requested analysis and are not stored beyond your authenticated session unless you explicitly save a scenario.

Advisors Diligence (CFO Workspace)

If you use the Advisors workspace at /portfolio, deal data you enter (company financials, cap tables, documents) is stored in a dedicated Postgres database and encrypted with our vault system. Anthropic's Claude model is invoked to produce analysis summaries; prompts include only the relevant deal context and are not retained by Anthropic beyond their API policy. Stakeholder views are permissioned per-deal.

Feedback

If you choose to submit feedback, we store your message and the page you were on. Feedback is anonymous by default. If you optionally provide your email address (to receive a response), that email is stored alongside your message. We do not share feedback data with third parties.

Cross-Site Boundaries

Intentional-capital.com and seemyzakat.com are operated by the same company but maintain separate data boundaries. No data flows between them without your explicit action.

If you choose to share your zakat results from SeeMyZakat with Intentional Capital, we receive a PII-free, encrypted snapshot of your financial data:

• Member names are replaced with generic labels (“Member 1”, “Member 2”) — real names are never transmitted
• The snapshot is encrypted at rest (AES-256-GCM) and automatically deleted after 15 minutes or first retrieval
• No email, IP address, session identifiers, or browser data crosses between sites
• We use this data only to render your personalized analysis — it is not stored after retrieval

What We Don't Collect

• No names, phone numbers, or mailing addresses
• No passwords (we use passkey authentication only)
• No tracking pixels or advertising networks
• No browser fingerprinting

Analytics

We use Vercel Analytics for privacy-focused, aggregated page view data. Vercel Analytics does not use cookies, does not track individual users, and does not collect personally identifiable information. We also use Vercel Speed Insights to monitor page performance.

Error Monitoring

We use Sentry for error monitoring and diagnostics. Sentry captures error messages, page URLs, and performance metrics when something goes wrong.

When you are signed in via Intentional ID, Sentry breadcrumbs include your anonymous user ID so we can triage support requests. Your email address and financial data are never included in Sentry payloads.

Third-Party Services

• Vercel — Hosts our website, serverless functions, and provides anonymous analytics
• Upstash — Redis storage (waitlist emails, feedback, contact messages, encrypted transfer tokens, rate limits)
• Supabase Postgres — Diligence deal data (advisors-diligence workspace only)
• Anthropic (Claude) — AI analysis for the diligence workspace. Prompts include only the relevant deal context.
• Intentional Engines (Intentional ID) — Passkey authentication. See the Engines privacy policy.
• Sentry — Error monitoring (technical data + anonymous user ID when signed in)

None of these services receive personal information beyond what is described above.

Data Retention

• Waitlist email — Until you request deletion
• Feedback / contact messages — Until reviewed and purged by our team
• Transfer snapshots — 15 minutes or first retrieval, encrypted at rest
• Session cookies — 7 days
• Diligence deal data — For the life of the engagement, encrypted via vault
• Error reports (Sentry) — Per Sentry's retention policy
• Page views (Vercel Analytics) — Aggregate only, no individual data

Data Deletion

To request deletion of your waitlist email or any feedback submissions, contact us via our feedback form with the subject “Data Deletion Request.” We will delete all matching entries within 7 business days.

Data already in anonymized or aggregated form (Vercel Analytics, Sentry error reports) cannot be individually deleted as it contains no personal information.

California Privacy Rights

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA/CPRA):

• Right to Know— You may request what personal information we collect, use, and disclose. For this site, this is limited to: email address (if you joined the waitlist) and feedback messages (if you submitted feedback with your email).
• Right to Delete— You may request deletion of your personal information. See the “Data Deletion” section above.
• Right to Opt-Out of Sale— We do not sell, rent, or share your personal information with third parties for their marketing purposes. We have never sold personal information.
• Right to Non-Discrimination— We will not discriminate against you for exercising your privacy rights.

Categories of Personal Information

Third-Party Service Providers

The following are service providers that process data on our behalf under contract. None use your data for their own marketing purposes:

• Vercel — Hosting and analytics
• Upstash — Data storage
• Sentry — Error monitoring (technical data only, no PII)

Do Not Sell My Personal Information

We have neversold or shared your personal information to third parties for their marketing purposes, and we have no plans to start. If you are a California resident exercising your right to opt out under CCPA/CPRA, there is nothing to opt out of — but we acknowledge your request.

To file a formal Do-Not-Sell request or any other California privacy right request, send us a message with the subject “Privacy Request”.

Contact

Questions about this privacy policy? Send us a message