Privacy Policy and Notice at Collection

Last updated: October 15, 2026

This notice applies to stelopartners.com and Stelo's business-funding process. The public website accepts contact requests for human follow-up and does not offer document upload. If you pursue funding, Stelo staff may upload documents you or your representatives provide, together with credit reports and public-record or industry-screening search results about the business and its owners, to a private staff workspace, where AI-assisted extraction proposes information for staff review (Section 3). Stelo staff may also record a funding call after telling you it is being recorded; the recording is transcribed and summarized with AI for staff review (Section 3). Stelo staff may also send you a private link to connect your business bank accounts through Stripe Financial Connections (Section 4). Monitoring linked accounts after funding is not switched on yet, and automated transaction classification and underwriting tools are not active. While Stelo's read-only link to their mailboxes is switched on, Stelo also reads email that Titanova and Arcadia, the affiliated brokerages Stelo owns, receive and send about funding requests, with its attachments, and uses AI to sort it, read the attachments and propose details for staff review (Section 3).

1. Information we collect

Category	Examples	Current source
Identifiers and contact data	Name, business email, phone number, session identifier	You
Business and commercial data	Business name, the state where the business is based, a monthly revenue range, time in business, industry, optional funding purpose and timing, contact preference, request source and operational status	You and Stelo
Internet and attribution data	Landing path without query values, referrer without query values, allowlisted campaign parameters such as ad click identifiers and UTM tags (from the first visit Stelo recorded in the last 90 days and from the visit that led to your request), whether your browser sent a Global Privacy Control or Do Not Track signal, session identifier, and IP-derived security signals	Your browser, Cloudflare, advertising links
Website usage data	On public pages only: pages visited, clicks, browser errors, page speed, and session replays (recordings of how the page was used, with everything typed into the contact form hidden); browser and device information; the IP address your browser connects from, which PostHog may use to estimate an approximate location; and a random ID kept in your browser	Your browser, through PostHog
Owner and guarantor information	Names, home addresses, dates of birth, Social Security numbers, driver's license or other identification details, and credit-report contents	Applications and identification you or your representatives provide; existing credit reports prepared by credit bureaus and supplied for the funding request
Financial-account information	Account and routing numbers, balances, transaction dates, amounts, descriptions, counterparties, account ownership signals, and, from a linked bank account, the bank's name, the last four digits of the account, and the account owner names and mailing addresses	Bank statements, voided checks, and other documents you or your representatives provide; Stripe Financial Connections, when you link your business bank accounts
Public-record and industry-screening information	Court, judgment, and lien search results, such as filing dates, jurisdictions, case references, reported statuses, and amounts; DataMerch merchant-screening entries, such as a reported status and entry text	Public records and industry-screening databases such as DataMerch; screenshots of search results are uploaded by Stelo staff and treated as reported information, not verified findings
Documents	Applications, bank statements, identification, voided checks, tax returns, profit-and-loss statements, balance sheets, accounts-receivable records, credit reports, payoff letters, DataMerch and court or lien search screenshots, agreements, and emails	You or your representatives; for reports and letters, the credit bureaus, public records, industry-screening databases, and funders that produce them; uploaded by Stelo staff
Email about a funding request	Emails exchanged with Titanova or Arcadia, the affiliated brokerages Stelo owns, about a funding request: sender and recipient names and addresses, subject, message text, attachments and files linked from those emails in Google Drive, such as bank statements, applications, identification, voided checks, tax returns, and funders' offers, contracts and declines, and details such as the business name, contact details, amounts requested or offered, and payment terms; AI-proposed labels and details reviewed by Stelo staff, figures read from attachments, and a record of each funding request's progress. Read only while Stelo's read-only link to those mailboxes is switched on	You, your representatives, funders and other senders; read by Stelo from Titanova's and Arcadia's work mailboxes
Funding-call recordings and transcripts	Audio of funding calls, written transcripts with speaker turns and timestamps, speaker names staff add, and AI summaries of what was discussed, such as the purpose of the funding, amounts and payment terms discussed, and follow-up commitments	You and Stelo staff on a call you are told is recorded; transcripts and summaries are produced by AI tools and reviewed by Stelo staff
Electronic-signing records	When you sign an agreement online: your name and email address; the answers you type into the agreement; your drawn signature and initials; the dates and times you confirmed a one-time email code, agreed to sign electronically, and signed; a record of that consent and its version; the IP address and browser user agent of the device you used to submit your signature; if you choose not to sign, the reason you pick and any note you add; and the signed agreement, your copy with private details hidden, and the signing record	Stelo staff, who enter each signer's name and email address; you; your browser; and Stelo's signing system
Derived data and inferences	Values extracted from documents and reviewed by staff; adjusted revenue, transfer classification, existing-position signals, cash-flow trends, fraud indicators, and data-completeness scores	Stelo staff and AI-assisted document extraction; the other listed items only after those features are enabled

2. Why we use information

• Accept and respond to a contact request and, if you later choose to proceed, prepare or service a commercial-financing offer.
• Verify application information; evaluate cash flow, capacity, fraud, stacking, and portfolio risk; and satisfy KYB/KYC and other legal obligations.
• Secure the service, prevent abuse, troubleshoot, maintain audit records, and enforce agreements.
• Prepare agreements for electronic signature, confirm each signer's email address, send each signer a copy, and record who signed, when, and how, to show the agreement was signed and has not changed.
• Review your funding request using the business bank accounts you link through Stripe and, only on deals Stelo funds itself or co-funds, monitor those accounts after funding, with the consent you give when you link, until Stelo staff turn monitoring off. Monitoring after funding is not switched on yet.
• Measure campaign and funnel performance and, where permitted, report qualified or funded outcomes to an advertising platform.
• See how visitors use the public website and find problems with it, using page visits, clicks, browser errors, page speed, and session replays.
• Track how funding requests sent by Titanova and Arcadia move from first email to funded, declined or closed, and keep an internal underwriting dataset of funders' offers and declines, statement figures and outcomes, for Stelo's own lead tracking and future underwriting. Its export leaves out names, contact details, and tax ID and account numbers. Stelo does not sell or share it.
• Once separately approved, improve transaction classification and underwriting using tokenized or de-identified records subject to access controls and documented model governance. Bank data received through Stripe Financial Connections is never used for this.

3. Automated tools and artificial intelligence

The public contact form does not generate an estimate, score, approval, or offer. It checks only two answers: the state where the business is based and how long it has operated. If the business is in a state Stelo does not serve or has operated for less than six months, the form says Stelo can't help with that request right now and no one from Stelo calls about it; the request is still saved and kept like any other contact request. No credit check is run.

When you pursue funding, Stelo staff use AI-assisted extraction on documents uploaded to the private staff workspace. Page images or text from a document are sent through OpenRouter to the DeepSeek V4.1 Flash model hosted by DeepInfra, which proposes values such as business, contact, identification, and financial details and reported DataMerch, court, or lien entries, each linked to its source page. Staff accept, correct, or reject each proposed value; only staff-reviewed values become deal facts or are applied to a funding record. Extraction does not approve, decline, score, or price funding, and Stelo does not make a final adverse funding decision solely through generative AI.

If a funding call is recorded, Stelo tells you first. Cloudflare Workers AI transcribes the recording using the Deepgram Nova-3 model hosted by Cloudflare, and Stelo's requests ask to opt out of Deepgram's model-improvement program. The transcript, with Social Security, account and similar numbers masked, is then sent through OpenRouter to the DeepSeek V4.1 Flash model hosted by DeepInfra to draft a short summary of what was discussed, linked to the moment in the call. Amounts and terms are recorded only as discussed; staff decide whether anything from the call is added to a deal.

Stelo reads the work mailboxes of Titanova and Arcadia, the affiliated brokerages Stelo owns, only while its read-only link to them is switched on, through read-only access each of them grants in its own Google Workspace after telling its reps in writing, to keep track of the funding requests they send and the replies, offers and declines that come back. Fixed rules, not AI, first set aside newsletters, sign-in codes, calendar invitations, automatic replies, lawyers' email and internal chat, and hold back any email whose text looks like it contains online-banking login details, with its attachments; those emails are not stored by Stelo and are never sent to an AI provider. The text of the remaining emails, with Social Security, account, routing and similar numbers masked, is sent through OpenRouter to the DeepSeek V4.1 Flash model, or to the GLM 5.3 Flash model when Stelo chooses it or compares the two on a sample, both hosted by DeepInfra, with the same provider settings, to sort the email (for example a submission, an offer or a decline) and propose details such as the business name, amounts and terms. Attachments are stored encrypted, once per file; bank statements, applications, funders' offers, contracts and declines, and PDFs that can't be sorted by name are read once, as page images or text on the same route, for figures such as statement totals and offer terms. Before any file is sent, fixed rules check the text of every page for online-banking login details and hold the file back if they find any; applications that are only scanned images, and unsorted PDFs that are scans or whose text shows identification, check, tax-return or Social Security number details, are also kept but not sent. Files whose name or email marks them as identification, voided checks or tax returns are stored but never sent to an AI provider. While Stelo's read-only link to Drive files is switched on, Stelo also opens Google Drive, Docs, Sheets, Slides and Drawings files linked in Titanova's and Arcadia's work email, read-only and with the access of the person whose mailbox received it; it never browses or lists anyone's Drive or opens linked folders, copies are stored encrypted and read like that email's attachments, and files it can't open are noted, not requested. Nothing is added to a lead or deal until Stelo staff confirm it, and email text is shown to staff only when they choose to view it, which is logged. Stelo also groups these emails into a record of each business's funding request and an internal underwriting dataset, kept in Stelo's Cloudflare account for its own lead tracking and future underwriting; they are not sold or shared and do not decide anything.

Stelo administrators may also ask Anthropic's Claude questions about Stelo's internal business records for internal analysis, such as how many funding requests reached each stage, which deals were funded in a month and the commissions on them, or how quickly new contact requests were called. They use their own Claude accounts with the setting that lets Anthropic use their chats to improve its models turned off, and Claude can only read these records, not change them. Claude receives Stelo's funding, deal, lead and commission records: names of businesses, their owners, funders, sales-floor reps and Stelo staff, business contact details such as email addresses and phone numbers, amounts, terms, statuses and dates, the answers, campaign tags, Google ad click IDs and browser privacy signals saved with a contact request, lists of a deal's documents (their kind, folder, date and who added them, never their contents), records of Stelo's own ACH payments, deal email subjects and short AI summaries of deal emails with Social Security, tax ID, account, routing, phone and similar numbers removed, and bank statement totals such as deposits, balances and NSF counts. Once switched on, it may also receive investor records without names or contact details: investor numbers, contribution amounts and dates, and onboarding and statement status. It never receives the text of emails or attachments, document contents or file names, identification images, copies of bank statements, Social Security or tax ID numbers, bank account, routing or card numbers, driver's license or other ID numbers, bank login details, or bank data Stelo receives through Stripe Financial Connections, and Claude does not approve, decline, score or price funding.

Stelo's extraction and summary requests ask for zero-data-retention routing and deny provider data collection, and staff confirm a document they upload contains no online-banking login information before it is sent. Stelo does not currently use your documents, call recordings, transcripts, emails, or extraction results to train AI models. Bank data Stelo receives through Stripe Financial Connections is not shared with AI providers and is never used to train AI or other models. If enabled in a later and separately identified process, Stelo may also use rules, statistical models, or AI-assisted systems to categorize transactions, detect anomalies, or support a reviewer. See AI and Data Use for controls and limitations.

4. When we disclose information

We disclose information only as needed for the purposes above:

• Cloudflare hosts the website, edge functions, security controls, D1 database, KV, encrypted private document and call-recording storage, encrypted storage of email and attachments read from Titanova's and Arcadia's mailboxes and of the records built from them, the private container that renders uploaded PDF pages, and Workers AI, which transcribes recorded funding calls.
• OpenRouter routes, and DeepInfra processes, page images or text from documents staff send to AI-assisted extraction, masked call transcripts for summaries, and, while Stelo's read-only link to Titanova's and Arcadia's work mailboxes is switched on, the masked text of their emails and page images or text of the attachments it reads, as described in Section 3.
• Anthropic receives the records, figures and short summaries described in Section 3 when a Stelo administrator asks Claude about Stelo's business from their own Claude account; it never receives email or attachment text, document contents, identification images, data from linked bank accounts or the restricted numbers listed there.
• Google Ads receives limited browser information from the Google Ads tag on public pages, used only to measure whether ad clicks lead to inquiries, as described in Section 9.
• Google Workspace hosts Stelo staff email, including messages and attachments sent to Stelo staff, and Titanova's and Arcadia's work email, which Stelo reads through read-only access only while that link is switched on.
• Once funding packages are switched on, OptimumBank, Stelo's bank, reviews ready-to-fund packages before a deal is funded. A package holds the deal summary, the funding amounts and the documents Stelo staff approve for it, such as the application, bank statements, ID and the signed agreement copy with bank login answers and other private details hidden. Bank login answers are never included.
• Resend delivers Stelo's transactional email. Staff alerts go to Stelo staff mailboxes. They include alerts when someone declines to sign an agreement, with the deal number, the business name, the name of the person who declined, their reason, and their note, and, once funding packages are switched on, alerts when a funding package is answered, with the deal name and number and the reviewer's note. A note is left out of the alert if it looks like it contains bank details, an SSN, an EIN, or a date of birth. Internal alerts to Stelo admins about specific deals, such as returned or missed payments, merchant bank monitoring, stop requests, wire plans, fees waiting, deals funded, and state reviews, include each deal's business name, DBA, and owner name, never amounts or account numbers. Resend also delivers bank-link, signing, and document-sharing emails and, once that feature is switched on, funding-package emails, including the recipient's name and email address, one-time codes, and private links, and, in funding-package emails to Stelo's funding mailbox, the deal name and funding amounts. These emails contain no bank details.
• PostHog may process website usage data from Stelo's public pages: pages visited, clicks, browser errors, page speed, and session replays. Everything typed into the contact form is hidden from replays, and names, email addresses, and phone numbers are not sent to PostHog. Staff, investor, signing, bank-link, document, and other private pages never load PostHog.
• Stripe provides bank linking through Stripe Financial Connections. When you apply for funding, Stelo staff may send you a private link to connect your business bank accounts in Stripe's window. Stripe then shares with Stelo, read-only, the bank's name, the last four digits of each account, balances, the account owner names and mailing addresses, and up to 180 days of transactions, so Stelo staff can review your funding request. You agree to this when you link. The same consent covers monitoring the linked accounts after funding, but only on deals Stelo funds itself or co-funds, until Stelo staff turn monitoring off; monitoring after funding is not switched on yet. Stelo keeps this bank data with your application or deal record and deletes it on that record's schedule, legal holds included; it is not deleted when you disconnect or when monitoring stops. You can disconnect at any time through Stripe or your bank, or by asking Stelo (Section 8). Only Stelo staff use this data. Stelo never sells it, never uses it for marketing or as a consumer report, and never uses it to train models, and it is not shared with AI providers or analytics. Stripe handles what it collects in its window under its own privacy policy.
• Service providers approved for identity, fraud, document processing, communications, e-signature, payment servicing, or legal compliance may receive the minimum data needed after they are contracted and added to our Subprocessor Register.
• Authorities, courts, counterparties, professional advisers, or transaction parties where required by law, necessary to enforce rights, or involved in a corporate transaction.

Stelo does not sell personal information and does not share applicant information for cross-context behavioral advertising. The Google Ads tag only measures ad clicks: remarketing and personalized advertising are turned off, and no form values, names, email addresses or phone numbers are sent to Google. Stelo does not sell leads to brokers. If this practice changes, this notice and required opt-out controls must change before activation.

5. Bank and document security

The public contact form does not request banking credentials. Funding applications may ask for online-banking login information. Stelo staff send a document to AI extraction only after confirming it contains none; documents that contain it, or that staff have not confirmed, are stored and previewed privately and are not sent to AI providers. When you link a bank account through Stripe Financial Connections, you sign in to your bank through Stripe's window, not on a Stelo page. Stelo never sees the login you type into Stripe's window, and Stelo's app never logs in to your bank. Stelo stores the bank data it receives from Stripe encrypted. Documents staff upload are encrypted and stored in a private bucket without a public URL, and access is limited to authorized Stelo staff. Temporary uploads are subject to automated expiration; later application records follow the schedule below. No security measure eliminates all risk.

6. Electronic signing

When Stelo asks you to sign an agreement online, we email a private link to the address Stelo has for you. Before you can open the agreement, we email you a one-time code to confirm the address is yours. Signing pages do not load analytics.

We use the information listed in Section 1 under electronic-signing records to show who signed, when, and how, to show the agreement has not changed since it was signed, to send each signer a copy, and to enforce the agreement. Your drawn signature, typed answers, IP address, and browser user agent are stored encrypted with the signed original. The IP address and browser user agent are not printed on the agreement, on your copy, or on the signing record, and they are not sent to analytics or AI providers.

Once everyone has signed, each signer is emailed a private link to their copy of the agreement, with bank login answers and other private details hidden. Stelo keeps the signing record on file and gives a copy on request. The signing record lists every signer's name, a partly hidden email address, and the times each person confirmed their code, agreed to sign electronically, and signed. Everyone asked to sign can read the whole agreement before signing, including details about the business and the other signers that appear in it. The signed original, with nothing hidden, stays private with Stelo staff. The copy with private details hidden and the signing record can be included in the ready-to-fund package Stelo sends to its funding mailbox for review before funding.

If you choose not to sign, Stelo staff are emailed your name, the business, the deal number, the reason you pick, and your note, unless the note looks like it contains private details. If an agreement is cancelled, runs out of time, or someone declines to sign, we may email the other signers to let them know and whom to contact.

Signing emails, one-time codes, and copy links are delivered through Resend. Signed agreements and signing records are stored encrypted in Cloudflare. We keep them for as long as the related funded-deal or application record; see the Data Retention Schedule. If your copy link stops working, reply to Stelo's email and we'll send you a new one.

7. Retention and deletion

Stelo retains information by record type and outcome, not indefinitely. The contact-request record has retention lifecycle fields, but its target period remains pending legal and operations approval. Current targets for later records include 25 months for unfunded or declined application and decision records and the agreement term plus seven years for funded-deal records. Bank data received through Stripe follows the related application or deal record, including legal holds, and is not deleted when you disconnect an account or when monitoring stops. Stelo's copy of an email read from Titanova's or Arcadia's mailboxes, with its attachments and the files linked from it, is deleted after 30 days when it is not about a deal and 90 days after staff set it aside; an email waiting for staff review is kept until staff decide, and an email staff link to a lead or deal follows that record. An attachment another kept email also has stays until that email goes too. The record of each funding request's progress, the figures read from emails and attachments, and the underwriting dataset stay after the email copy is deleted; they are not yet on an automatic deletion schedule. Legal holds, disputes, fraud investigations, and regulatory obligations can extend a period. See the Data Retention Schedule.

8. Your privacy choices

Subject to applicable law, you may request access, correction, deletion, restriction, or a portable copy of personal information; object to certain processing; or revoke a bank connection. Stelo may verify your identity and may retain records required by law or needed to prevent fraud and resolve disputes. Email privacy@updates.stelopartners.com. Authorized agents may submit requests with proof of authority.

9. Cookies and analytics

Stelo uses essential storage for session and security functions. Allowlisted campaign values, such as an ad click identifier and UTM tags, are stored in your browser and used for up to 90 days, then replaced on your next visit, and are saved with a contact request; stored landing and referrer values omit query strings and fragments. Cloudflare processes technical security data.

On public pages, PostHog records the pages you visit, your clicks, browser errors, page speed, and a session replay, which shows the page and where you scrolled and clicked, so Stelo can see how the site is used and fix problems. Everything typed into the contact form is hidden from replays, page addresses are recorded without query values, and the referrer is cut to the site it came from. PostHog keeps a random ID in your browser's storage, not a cookie, to connect the pages of one visit. Stelo does not identify visitors to PostHog by name, email address, or phone number. PostHog also receives your IP address with each request and may use it to estimate an approximate location. The contact form's own analytics events carry only coded choices and outcomes, such as the funding timing picked or whether Stelo could help with a request, and the request's reference number, and never names, contact details or typed text. PostHog is not loaded on staff, investor, signing, bank-link or document pages, or when your browser sends a Global Privacy Control or Do Not Track signal.

Public marketing pages load the Google Ads tag so Stelo can measure whether visits from its ads lead to inquiries. It may set advertising cookies that recognize an ad click, and Google receives the page path with campaign parameters only, a referrer without query values, and standard browser and device information. Remarketing, personalized advertising and the sending of user-provided data such as email addresses or phone numbers are turned off. The tag is not loaded on staff, investor, signing, bank-link or document pages, or when your browser sends a Global Privacy Control or Do Not Track signal. When it does, Stelo still saves allowlisted campaign values with a contact request for its own reporting, records that the signal was sent, and never reports that request to an advertising platform.

10. Children

The service is for business representatives and is not directed to children under 18. Do not submit information about a child.

11. Contact and changes

Contact Stelo Partners at privacy@updates.stelopartners.com. Material changes will be posted with a revised date and, when legally required, an additional notice or renewed consent.