What we collect, how we use it, what you control

This document explains what data New Matrix Capital collects from you, how we use it, who we share it with, and what rights you have. We made this readable because legal documents nobody reads protect nobody. Raven Source Holdings LLC d/b/a New Matrix Capital operates newmatrix.capital and the related platform.

1. What we collect

Bank account data (Plaid)

When you connect a business bank account, we use Plaid to read transaction history, account balances, and account metadata. Access is read-only. We never see or store your online banking password. While a funding obtained through the platform is live, we continue reading the connected account for two purposes: to confirm the advance landed and to watch for a funding partner paying you around the platform (this is how the platform’s success fee is protected and how stacking is detected early), and to monitor balances and debits on the funded account until the advance settles. You can revoke the connection from your account settings; while a funding commitment is in motion the disconnect routes through support so a replacement account is captured first, and while a partner is merely reviewing your file you are shown what disconnecting affects and can proceed.

Credit information

We may collect a credit range you report, records you upload, and the source and date of any credit information available to your account. A live bureau report is requested only when a contracted provider is available and you complete the required authorization. Self-reported and estimated values remain labeled as such.

Business documents

You upload documents such as tax returns, bank statements, voided checks, driver licenses, and articles of incorporation. We store these so you can route them to capital partners without re-uploading every time.

User profile

Your name, email, password (hashed with bcrypt), phone number, business EIN, legal business name, industry, state of formation, and year established. If you sign in through Google, we store the Google identifier returned by the OAuth handshake.

Communication metadata

Timestamps of messages you send our team, message content, support ticket history, and notification preferences. We also log basic device and browser information for security and fraud monitoring.

2. How we use it

Match merchants to capital partners

We use available bank data, credit information, and your business profile to identify potential lender and product fits, and to decide which capital partners a completed application is routed to. No lender receives your file until you submit an application and authorize the share on the apply screen.

Train New Matrix AI on anonymized aggregate signals

New Matrix AI is the in-product assistant that helps you read your numbers and pick offers. We improve New Matrix AI using aggregate signals stripped of personally identifiable information. We do not feed your raw bank statements, credit reports, or tax returns into model training.

Review security and fraud signals

We malware-scan uploaded files, parse supported documents, and may compare source-labeled records for conflicts or duplicate merchant signals. These signals create restricted review alerts. They are not broadcast to lenders or treated as proof of fraud without human review.

Operate billing and communication

We process subscription payments, send transactional email (signup confirmations, password resets, deal status updates), and respond to your support questions. We also send product and onboarding reminders by default while your file is incomplete. You can opt out of any of them with one click, and an opt-out stops the reminder emails as well as any promotional email.

3. Who we share it with

The capital partners your application is routed to

When you submit an application you authorize the share, and at that moment the file goes to every capital partner whose stated funding criteria it clears. They all receive it at the same time, and their offers compete for your business. That is the service: one application instead of a dozen phone calls, with no partner getting a head start on the others.

You set the size of that group. Tick partners on the apply screen and only the ones you ticked can receive the file. Tick none and we route to the full matching set, which can include partners you have not seen before. Apply from a named partner’s profile and the file goes to that partner alone. If no partner’s criteria fit, nothing is sent and the application waits for manual routing.

We share only the data relevant to that specific application: your legal business name, your name and email, your state, the last four digits of your EIN, the revenue and time in business on your file, the amount and use of funds you requested, and the bank statements or documents attached to the application. Your phone number is not among it: funding partners reach you through the platform (the deal thread, document requests, and calls you schedule), never by dialing you directly. Every recipient is named on your application page, along with which of them have responded, so you always know who is holding your file. Every routing decision is logged with the reason for it, and accepting one offer automatically declines the rest.

Stripe

Stripe is our subscription-billing processor. Paid plans are not open for signup right now, so no card is being charged today. Once plans open, we send Stripe your name, email, and billing details, Stripe stores card numbers on its own infrastructure, and we never store full card numbers on our servers.

Resend

Resend delivers our transactional and marketing email. Resend receives your email address and the message we send you.

Neon Postgres, NextAuth, and Amazon S3

Neon Postgres hosts our primary database, encrypted at rest. Your account data, business profile, and consents are stored there. NextAuth handles application authentication. Amazon S3 stores the documents you upload, held in a private bucket with server-side encryption at rest.

PostHog

PostHog is our product-analytics and session-replay provider. When you accept all cookies, PostHog receives behavioral events such as pages viewed and features used, attributed to your user id along with your email, name, and role, plus session replays with every input field masked so we never capture what you type. PostHog is consent-gated per our Cookie Policy and does not load if you choose essential-only.

Crisp

Crisp is our optional in-product support-chat vendor. The widget is not loaded today, so Crisp receives no name, email, or chat content from this site. If we turn it on, it will be consent-gated per our Cookie Policy and will receive those fields only after the widget loads.

Inference providers

New Matrix AI may run on Groq, Anthropic, or a self-hosted OpenAI-compatible inference provider we operate. We strip personally identifiable information from prompts where possible and we do not send raw bank statements, credit reports, or tax returns to inference providers. We do not authorize third-party inference providers to retain prompts for their own model training.

Legal process

We disclose data when a subpoena, court order, or other valid legal process requires it. We tell you when we receive such a request unless the law prohibits notice.

4. Your rights

Depending on where you live, you have specific legal rights over your data. We honor those rights for every user, regardless of state of residence, when the operational cost is reasonable.

CCPA (California)

California residents have the right to know what we collect, the right to delete non-required data, the right to opt out of any sale of personal information (we do not sell your data), and the right not to face discrimination for exercising these rights.

GDPR (EU and UK residents)

If you reside in the European Union or the United Kingdom, you have the right to access, correct, delete, restrict processing of, and port your data. You also have the right to lodge a complaint with your local data protection authority.

State-specific privacy laws (NV, CO, VA, CT, UT)

Nevada, Colorado, Virginia, Connecticut, and Utah have enacted state privacy laws that grant residents rights similar to CCPA. We honor verified requests under each of these statutes. To exercise any state-specific right, email info@newmatrix.capital with the subject line "Privacy Request" and the state where you reside.

5. Data retention

We review this retention policy at least annually, and immediately whenever a material change to how we handle data would affect it.

Financial records

When you ask us to delete your account, we erase your financial records: bank transaction history, credit pulls, uploaded statements, identity verification data, and deal documentation, in a single operation, and we disconnect any linked bank account. What remains afterward is limited to anonymized totals that no longer identify you or your business. We do not hold your identifiable financial records against a deletion request.

There are two exceptions, and both are narrow.

The first is legal. Where tax, accounting, or financial-services law requires us to keep specific transaction or identity records, we retain only those records for the period the law sets, up to 7 years, and then purge them. The same hold covers the records of agreements between us: the fact and version of the terms you accepted, the consents you granted and revoked (with their dates), executed electronic signatures and their audit records, and any adverse-action notice we were required to send. Fair-lending law adds one more: the record of a credit application and the action taken on it is kept for the 12 months federal Regulation B requires, then purged on schedule. Your name, contact details, tax identifiers, and documents are stripped from that record the day you ask; what remains is the product, the amounts, and the decision. Those are records of a transaction between two parties, kept against an anonymized account with your name, email, and files erased. Everything outside that narrow legal hold is erased when you ask.

The second is a live funding. If you have accepted an offer or a funder has already paid you out, that advance is a real obligation between you and that funder, and our compensation on it is earned. We do not close the account while it is running, because closing it would erase the record of a deal that is still being paid. If you ask, the request is refused with that reason stated, not silently ignored, and your account settings say so before you confirm. Once the funding is settled, email info@newmatrix.capital and we close the account and erase everything the first exception does not hold. An application still being underwritten does not block anything: you can leave the platform at any point before money is committed.

Marketing data: 24 months

Marketing engagement data (email opens, click history, page visits tied to marketing campaigns) is retained for 24 months from your last interaction. After that we purge it on a rolling basis.

Everything else: deleted on request

For data not subject to a regulatory hold, we delete it on request within 30 days. That includes your business profile, your uploaded documents that are not tied to a funded transaction, your support history, and your marketing preferences.

6. Data subject requests

You can request a full export of your data at any time. Visit your account settings and use the export tool, or call the export endpoint at /api/user/export. The export is delivered as a machine-readable JSON file.

To request deletion, email info@newmatrix.capital with the subject line "Delete my data". We verify your identity, confirm which records fall under regulatory retention, and delete the rest within 30 days. We send you a written confirmation when deletion is complete.

To correct inaccurate data, use the profile editor in your settings, or email us. We respond to correction requests within 10 business days.

7. California privacy rights (CCPA and CPRA)

If you are a California resident, you have the right to know what personal information we collect, to access and delete it, to correct it, and to not be discriminated against for exercising these rights. Exercise any of these rights by emailing info@newmatrix.capital or using the export and deletion tools described above.

We do not sell your personal information. When you ask us to match you with capital partners, we share the data you authorize only with the capital partners your application is routed to, solely to provide the service you requested. We do not share your personal information with third parties for cross-context behavioral advertising. To opt out of any data sharing beyond fulfilling your own funding requests, email info@newmatrix.capital with the subject line “Do Not Sell or Share My Personal Information”.

You may designate an authorized agent to make a request on your behalf. We verify your identity before acting on any request, and we never charge a fee to exercise these rights.

8. Children

New Matrix Capital is for business operators 18 and older. We do not knowingly collect data from anyone under 18. If you believe a minor has created an account or submitted information, email info@newmatrix.capital and we will delete the account and associated data.

9. Contact

Privacy questions, data requests, and notices of suspected misuse go to info@newmatrix.capital. We respond within 5 business days.

Written privacy notices may also be mailed to Raven Source Holdings LLC d/b/a New Matrix Capital, 82-22 189th St, Hollis, NY 11423.

See also our Terms of Service and our Cookie Policy.

Security note: data in transit is encrypted with TLS 1.3. Data at rest is encrypted with AES-256. Bank tokens are encrypted with a service-side key that is never exposed in API responses. We are not SOC 2 certified at this time, and we do not claim to be. No method of transmission or storage is completely secure, so we cannot guarantee absolute security; if a breach affects your data, we will notify you as required by applicable law.