Privacy Policy and Notice at Collection
Last updated: August 18, 2026
This notice applies to stelopartners.com and Stelo's business-funding application process. The website currently provides an illustrative eligibility estimate and lead intake. Bank connection, document upload, automated transaction classification, and underwriting tools are activated only when identified in the application experience.
1. Information we collect
| Category | Examples | Current source |
|---|---|---|
| Identifiers and contact data | Name, business email, phone number, session identifier | You |
| Business and commercial data | Industry, monthly-revenue band, time in business, requested amount, eligibility estimate, application status | You and Stelo |
| Internet and attribution data | Landing page, referrer, GCLID, UTM parameters, page and funnel events, IP-derived security signals | Your browser, Cloudflare, advertising links |
| Financial-account information | Account metadata, balances, transaction dates, amounts, descriptions, counterparties, account ownership signals | Only if you authorize a bank connection or upload statements |
| Documents | Bank statements, agreements, deal histories, and other files you choose to provide | Only if document upload is enabled and you upload them |
| Derived data and inferences | Adjusted revenue, transfer classification, existing-position signals, cash-flow trends, fraud indicators, and data-completeness scores | Stelo's rules, models, and reviewers after those features are enabled |
2. Why we use information
- Provide the eligibility experience, respond to your request, and prepare or service a commercial-financing offer.
- Verify application information; evaluate cash flow, capacity, fraud, stacking, and portfolio risk; and satisfy KYB/KYC and other legal obligations.
- Secure the service, prevent abuse, troubleshoot, maintain audit records, and enforce agreements.
- Measure campaign and funnel performance and, where permitted, report qualified or funded outcomes to an advertising platform.
- Improve transaction classification and underwriting using tokenized or de-identified records subject to access controls and documented model governance.
3. Automated tools and artificial intelligence
The current 30-second estimate is generated by a fixed formula based on the answers you provide. It is not an offer, a credit decision, or an AI underwriting decision. If enabled, Stelo may use rules, statistical models, document-processing tools, or AI-assisted systems to categorize transactions, detect anomalies, summarize documents, or support a reviewer. Stelo does not currently make a final adverse funding decision solely through generative AI.
Raw SSNs, account credentials, signatures, and unrestricted statement files are not used to train public or general-purpose AI models. See AI and Data Use for controls and limitations.
4. When we disclose information
We disclose information only as needed for the purposes above:
- Cloudflare hosts the website, edge functions, security controls, D1 database, KV, and private object storage.
- Plaid will receive connection details and return bank-account data only after Plaid Link is enabled and you choose to connect an account.
- Service providers approved for identity, fraud, document processing, communications, e-signature, payment servicing, or legal compliance may receive the minimum data needed after they are contracted and added to our Subprocessor Register.
- Authorities, courts, counterparties, professional advisers, or transaction parties where required by law, necessary to enforce rights, or involved in a corporate transaction.
Stelo does not sell personal information and does not currently share applicant information for cross-context behavioral advertising. Stelo does not sell leads to brokers. If this practice changes, this notice and required opt-out controls must change before activation.
5. Bank and document security
A bank connection uses tokenized access; Stelo does not receive or store your online-banking password. Provider access tokens must be encrypted before storage. Uploaded documents are stored in a private bucket without a public URL. Temporary uploads are subject to automated expiration; application records follow the schedule below. No security measure eliminates all risk.
6. Retention and deletion
Stelo retains information by record type and application outcome, not indefinitely. Current targets include 90 days for incomplete web-session data, 25 months for unfunded or declined application and decision records, and the agreement term plus seven years for funded-deal records. Temporary unattached uploads target deletion after seven days. Legal holds, disputes, fraud investigations, and regulatory obligations can extend a period. See the Data Retention Schedule.
7. Your privacy choices
Subject to applicable law, you may request access, correction, deletion, restriction, or a portable copy of personal information; object to certain processing; or revoke a bank connection. Stelo may verify your identity and may retain records required by law or needed to prevent fraud and resolve disputes. Email privacy@stelopartners.com. Authorized agents may submit requests with proof of authority.
8. Cookies and analytics
Stelo uses essential storage for session and security functions and records attribution parameters included in a referral URL. Cloudflare processes technical security data. Stelo will update this notice and deploy any required consent controls before enabling nonessential analytics, advertising cookies, session replay, or similar technologies.
9. Children
The service is for business representatives and is not directed to children under 18. Do not submit information about a child.
10. Contact and changes
Contact Stelo Partners at privacy@stelopartners.com. Material changes will be posted with a revised date and, when legally required, an additional notice or renewed consent.