What we collect, how we use it, what you control

This document explains what data New Matrix Capital collects from you, how we use it, who we share it with, and what rights you have. We made this readable because legal documents nobody reads protect nobody. New Matrix Capital LLC operates newmatrix.capital and the related platform.

1. What we collect

Bank account data (Plaid)

When you connect a business bank account, we use Plaid to read transaction history, account balances, and account metadata. Access is read-only. We never see or store your online banking password. While a funding obtained through the platform is live, we continue reading the connected account for two purposes: to confirm the advance landed and to watch for a funding partner paying you around the platform (this is how the platform’s success fee is protected and how stacking is detected early), and to monitor balances and debits on the funded account until the advance settles. You can revoke the connection from your account settings; while a funding commitment is in motion the disconnect routes through support so a replacement account is captured first, and while a partner is merely reviewing your file you are shown what disconnecting affects and can proceed. Direct bank connection through Plaid is not enabled yet; you share bank data by uploading statements, and the Plaid flow above describes what happens once it is enabled.

Credit information

We may collect a credit range you report, records you upload, and the source and date of any credit information available to your account. A live bureau report is requested only when a contracted provider is available and you complete the required authorization. Self-reported and estimated values remain labeled as such.

Business documents

You upload documents such as tax returns, bank statements, voided checks, driver licenses, and articles of incorporation. We store these so you can route them to capital partners without re-uploading every time.

User profile

Your name, email, password (hashed with bcrypt), phone number, business EIN, legal business name, industry, state of formation, and year established. If you sign in through Google, we store the Google identifier returned by the OAuth handshake.

Communication metadata

Timestamps of messages you send our team, message content, support ticket history, and notification preferences. We also log basic device and browser information for security and fraud monitoring.

2. How we use it

Match merchants to capital partners

We use available bank data, credit information, and your business profile to identify potential lender and product fits, and to decide which capital partners a completed application is routed to. No lender receives your file until you submit an application and authorize the share on the apply screen.

Improve New Matrix AI from scrubbed interaction signals

New Matrix AI is the in-product assistant that helps you read your numbers and pick offers. We store truncated, scrubbed summaries of assistant interactions to spot product patterns for our operators. We do not send your raw bank statements, credit reports, or tax returns to any model provider for training.

Review security and fraud signals

We check the type of uploaded merchant statements and documents, identity photos, partner and deal paperwork, lender contract paper and brand images, vendor logos and careers resumes, and screen them for active content, such as scripts, macros and embedded files; uploads are not antivirus-scanned. A statement or document a merchant uploads clears only if it passes that screen, and is added to the file lenders review only once it has cleared. A file that cleared before a check began on its kind of upload does not have to pass that check, so a merchant's statement or document that cleared then can still reach the file lenders review. We parse supported documents and may compare source-labeled records for conflicts or duplicate merchant signals. These signals create restricted review alerts. They are not broadcast to lenders or treated as proof of fraud without human review.

Operate billing and communication

We process subscription payments, send transactional email (signup confirmations, password resets, deal status updates), and respond to your support questions. We also send product and onboarding reminders by default while your file is incomplete. You can opt out of any of them with one click, and an opt-out stops the reminder emails as well as any promotional email.

3. Who we share it with

The capital partners your application is routed to

When you submit an application you authorize the share, and at that moment the file goes to every capital partner that is open for business and whose stated funding criteria it clears. They all receive it at the same time, and their offers compete for your business. That is the service: one application instead of a dozen phone calls, with no partner getting a head start on the others.

Open for business means the partner is approved and active, has completed onboarding, has accepted the current partner agreements, and has published the funding criteria we match against. A partner that has done none of that never receives a file, and one that has done all of it receives yours the moment your file clears its criteria. We record that decision when it is made: which partners were open, how many had published no criteria to match against, and every partner that was evaluated and declined, with the criteria it declined on. That record is kept against your application, so the paragraph above can be checked afterwards rather than taken on trust.

You set the size of that group. Tick partners on the apply screen and only the ones you ticked can receive the file. Tick none and we route to the full matching set, which can include partners you have not seen before. Apply from a named partner’s profile and the file goes to that partner alone. If no partner’s criteria fit, nothing is sent and the application waits for manual routing.

We share only the data relevant to that specific application: your legal business name, your name and email, your state, the last four digits of your EIN, the revenue and time in business on your file, the amount and use of funds you requested, and the bank statements or documents attached to the application. Your phone number is not among it: funding partners reach you through the platform (the deal thread, document requests, and calls you schedule), never by dialing you directly. Every recipient is named on your application page, along with which of them have responded, so you always know who is holding your file. Every routing decision is logged with the reason for it, and accepting one offer automatically declines the rest.

The providers that operate the platform

A provider appears here because the platform is built to use it, not because it is receiving your data today. Each one is marked connected or not connected, read from the same configuration the feature itself checks. A provider that is not connected receives nothing at all.

Connection labels checked 2026-10-16 18:59:45 (UTC). Capability-level status: Integration status.

Full registry (including providers not connected today): newmatrix.capital/subprocessors.

Stripe processes our subscription billing today. Stripe stores card numbers on its own infrastructure, and we do not store full card numbers on our servers.

The support chat widget is not loaded today, so Crisp receives no name, email, or chat content from this site. If we turn it on, it will be consent-gated per our Cookie Policy.

Sign-in itself runs on NextAuth inside our own application. It is not a third party and your credentials never leave our servers.

Inference providers

New Matrix AI may run on Groq, Anthropic, or a self-hosted OpenAI-compatible inference provider we operate. Text you type into New Matrix AI or a support ticket, and every result our own tools hand the model, passes through an automatic redaction step first: Social Security numbers, EINs, phone numbers, bank routing numbers and account numbers are replaced with a marker carrying only the last four digits. The redaction is enforced in code on every path that reaches a model, not applied case by case.

The record we send about your business carries your legal business name, industry, state, year established, Matrix Score, monthly revenue, any business credit scores on file, the positions detected on your account and thirty-day deposit and debit totals. It does not carry your EIN, your Social Security number, your account numbers, or the individual transaction lines from your statements. We do not send raw bank statements, credit reports, or tax returns to inference providers.

One path sends a whole document by design: when you ask New Matrix AI to read a financing agreement you uploaded, its text is sent to the analysis provider (Groq, which runs New Matrix AI; or Anthropic where that provider is enabled, which also reads the file's page images), because reading it is the request and every figure in the report has to be quoted out of it. That request carries the document and nothing else, not its filename and none of the account context above. We do not authorize third-party inference providers to retain prompts for their own model training.

Legal process

We disclose data when a subpoena, court order, or other valid legal process requires it. We tell you when we receive such a request unless the law prohibits notice.

4. Your rights

Depending on where you live, you have specific legal rights over your data. We honor those rights for every user, regardless of state of residence, when the operational cost is reasonable.

CCPA (California)

California residents have the right to know what we collect, the right to delete non-required data, the right to opt out of any sale of personal information (we do not sell your data), and the right not to face discrimination for exercising these rights.

GDPR (EU and UK residents)

If you reside in the European Union or the United Kingdom, you have the right to access, correct, delete, restrict processing of, and port your data. You also have the right to lodge a complaint with your local data protection authority.

State-specific privacy laws (NV, CO, VA, CT, UT)

Nevada, Colorado, Virginia, Connecticut, and Utah have enacted state privacy laws that grant residents rights similar to CCPA. We honor verified requests under each of these statutes. To exercise any state-specific right, email info@newmatrix.capital with the subject line "Privacy Request" and the state where you reside.

5. Data retention

We review this retention policy at least annually, and immediately whenever a material change to how we handle data would affect it.

Financial records

When you request account deletion, we strip your personal and contact fields, disconnect any linked bank account, and disable login in a single operation. The deletion is immediate and cannot be reversed, so we verify the request before we run it.

There are two exceptions, and both are narrow.

The first is legal. Where tax, accounting, or financial-services law requires us to keep specific transaction or identity records, we retain only those records for the period the law sets, and then purge them. Sanctions screening records, meaning the names we screened against the U.S. Treasury OFAC sanctions lists, the result, and who reviewed any possible match, are kept for 10 years, the period federal sanctions recordkeeping rules set, and then purged. They keep the names that were screened, because the name is the record. The same hold covers the records of agreements between us: the fact and version of the terms you accepted, the consents you granted and revoked (with their dates), executed electronic signatures and their audit records, and any adverse-action notice we were required to send. Fair-lending law adds one more: the record of a credit application and the action taken on it is kept for the 12 months federal Regulation B requires, then purged on schedule. Your name, contact details, tax identifiers, and documents are stripped from that application record the day you ask; what remains is the product, the amounts, and the decision. Those are records of a transaction between two parties, kept against an anonymized account with your name, email, and files erased. Everything outside that narrow legal hold is erased when you ask.

The second is a live funding. If you have accepted an offer or a funder has already paid you out, that advance is a real obligation between you and that funder, and our compensation on it is earned. We do not close the account while it is running, because closing it would erase the record of a deal that is still being paid. If you ask, the request is refused with that reason stated, not silently ignored, and your account settings say so before you confirm. Once the funding is settled, email info@newmatrix.capital and we close the account and erase everything the first exception does not hold. Partner accounts follow the same rule: a funder desk still holding live routed files, or a lead vendor whose delivered sponsored placement is not yet paid, is refused with the reason stated, and info@newmatrix.capital closes it once that is settled.

An application still being underwritten does not block anything: you can leave the platform at any point before money is committed, and any in-flight file is marked withdrawn.

Marketing data: 24 months

Marketing engagement data (email opens, click history, page visits tied to marketing campaigns) is retained for 24 months from your last interaction. After that we purge it on a rolling basis.

Everything else: deleted on request

For data not subject to a regulatory hold, we delete it on request within 30 days. That includes your business profile, your uploaded documents that are not tied to a funded transaction, your support history, and your marketing preferences.

6. Data subject requests

You can request a full export of your data at any time. Visit your account settings and use the export tool, or call the export endpoint at /api/user/export. The export is delivered as a machine-readable JSON file.

To request deletion, email info@newmatrix.capital with the subject line "Delete my data". We verify your identity, confirm which records fall under regulatory retention, and delete the rest within 30 days. We send you a written confirmation when deletion is complete.

To correct inaccurate data, use the profile editor in your settings, or email us. We respond to correction requests within 10 business days.

7. California privacy rights (CCPA and CPRA)

If you are a California resident, you have the right to know what personal information we collect, to access and delete it, to correct it, and to not be discriminated against for exercising these rights. Exercise any of these rights by emailing info@newmatrix.capital or using the export and deletion tools described above.

We do not sell your personal information. When you ask us to match you with capital partners, we share the data you authorize only with the capital partners your application is routed to, solely to provide the service you requested. We do not share your personal information with third parties for cross-context behavioral advertising. To opt out of any data sharing beyond fulfilling your own funding requests, email info@newmatrix.capital with the subject line “Do Not Sell or Share My Personal Information”.

You may designate an authorized agent to make a request on your behalf. We verify your identity before acting on any request, and we never charge a fee to exercise these rights.

8. Children

New Matrix Capital is for business operators 18 and older. We do not knowingly collect data from anyone under 18. If you believe a minor has created an account or submitted information, email info@newmatrix.capital and we will delete the account and associated data.

9. Contact

Privacy questions, data requests, and notices of suspected misuse go to info@newmatrix.capital. We respond within 5 business days.

Written privacy notices may also be mailed to New Matrix Capital LLC, 418 Broadway #10741, Albany, NY 12207.

See also our Terms of Service and our Cookie Policy.

Security note: data in transit is encrypted with TLS 1.3. Data at rest is encrypted with AES-256. Bank tokens are encrypted with a service-side key that is never exposed in API responses. We are not SOC 2 certified at this time, and we do not claim to be. No method of transmission or storage is completely secure, so we cannot guarantee absolute security; if a breach affects your data, we will notify you as required by applicable law.