Overview
Fundex, Inc. (“Fundex,” “we,” “us,” or “our”) operates the Fundex investor CRM platform at usefundex.com and its associated services (the “Service”). This Privacy Policy explains what information we collect, why we collect it, how we use and protect it, and your choices.
Fundex is a business-to-business (B2B) software platform. Our customers are fund managers, startups, and early-stage companies (“Customers”) who use our tools to manage investor relationships and fundraising pipelines. When our Customers store investor contact records in Fundex, they are the data controller for that contact data and we act as a data processor on their behalf.
Three privacy relationships: (1) Customers — organizations that subscribe to Fundex. We control and process their account data. (2) Investor contacts — third-party individuals whose data Customers enter into Fundex. Our Customers control that data; we process it per their instructions under our Data Processing Addendum. (3) Directory investors — professionals listed in the Fundex Investor Directory. Fundex controls that data, as described under Investor & CRM Data.
Data We Collect
Account & Subscription Data
When you create a Fundex account or start a trial, we collect:
- Full name, work email address, and password (hashed)
- Company name, size, and industry
- Billing address and payment method (processed by Stripe; we do not store raw card numbers)
- Role, permissions, and team membership within your organization
CRM & Pipeline Data
When Customers use the platform to manage their fundraising pipeline, they may enter or import:
- Investor names, email addresses, phone numbers, titles, and LinkedIn URLs
- Fund names, AUM, investment thesis, and portfolio data
- Meeting notes, call logs, email correspondence, and custom activity records
- Pipeline stage, deal terms, and relationship health signals
- Tags, lists, and custom fields defined by the Customer
Email & Calendar Integration Data
If you connect your email inbox or calendar (via our Nylas integration), we collect:
- OAuth access tokens (encrypted at rest; limited to the permissions you approve when you connect your account)
- Email messages and metadata from your connected mailbox, used to display your inbox in Fundex, detect replies to messages sent through Fundex, and detect requests not to be contacted
- Email open and click tracking pixels and link redirects (only for outreach sequences you initiate)
- Calendar event data: title, attendees, and time (for scheduling and logging meetings)
Usage & Technical Data
- IP address, browser type, operating system, and device identifiers
- Pages viewed, features used, and session duration
- API call logs and error reports
- Cookies and similar tracking technologies (see Cookies)
How We Use Data
We use collected information for the following purposes:
Service delivery
Providing, operating, maintaining, and improving the Fundex platform and its features.
Account management
Creating accounts, authenticating users, managing subscriptions, and processing payments.
Email outreach
Sending investor emails on your behalf via your connected mailbox; displaying your inbox inside Fundex; scheduling meetings on your connected calendar; tracking opens, clicks, and replies to measure campaign performance.
AI features
Powering AI-assisted drafting, email quality scoring, and investor recommendations. AI processing uses only the data you have provided and does not train public models.
Customer support
Responding to support requests, diagnosing bugs, and providing onboarding assistance.
Security & fraud prevention
Detecting and preventing unauthorized access, abuse, and fraudulent activity.
Legal compliance
Meeting our obligations under applicable law, responding to lawful requests, and enforcing our Terms of Service.
Analytics & product improvement
Aggregated, de-identified usage analytics to understand feature adoption and improve the product. We never sell this data.
Investor & CRM Data
Fundex is a data processor for investor contact data that Customers import or enter themselves. Our Customers—fund managers, startups, and advisors—are the data controllers for those records. Fundex is the data controller for the Fundex Investor Directory described below.
Customer responsibility: Customers are responsible for ensuring they have a lawful basis to store and process investor contact information in Fundex (e.g., legitimate interest in fundraising activities, or prior consent). Fundex provides tooling; the legal basis determination lies with the Customer.
Data Processing Addendum (DPA)
Enterprise and growth plan Customers may request a Data Processing Addendum covering sub-processor obligations, Standard Contractual Clauses (SCCs) for international transfers, and audit rights. Contact privacy@usefundex.com to request a DPA.
Tenant Isolation
Each Customer organization operates in a logically isolated tenant. Investor records, pipeline data, and communications of one Customer are never accessible to another Customer. All database queries are scoped by tenant_id at the application layer.
Fundex Investor Directory
Fundex maintains a directory of institutional investors, including venture capital funds, family offices, and other professional allocators. The directory is built from the professional relationships of Fidelman & Company, the investment bank affiliated with Fundex, developed through its investment banking work since 2015. It is not purchased, rented, or scraped from third-party lists. Profiles may be supplemented with publicly available professional information, such as firm details and investment focus.
Directory profiles contain professional contact information only, such as name, firm, title, business email address, and investment focus.
A Customer can unlock an individual directory profile into its private tenant. An unlocked profile is held only in that Customer's tenant and is subject to the same outreach rules as any other contact, including the permitted-use requirement and opt-out handling described under Email Outreach & Tracking.
Investors in the directory may request a copy of their profile, ask us to correct it, or ask to be removed from the directory at any time by emailing privacy@usefundex.com. A removed profile can no longer be unlocked by any Customer.
Email Outreach & Tracking
Fundex enables Customers to send personalized outreach emails to investors via their own connected mailboxes (Gmail, Outlook / Microsoft 365). We integrate with Nylas to authenticate and send email on behalf of the connected account.
Permitted use of outreach
Fundex Customers are prohibited from using the platform to send sales or marketing communications to any contact who has not consented to receive them, or with whom the Customer does not have an existing business relationship. Customers are solely responsible for ensuring they have a lawful basis to contact each recipient, and for honouring any request to stop.
Every recipient can opt out of further messages. Outreach messages sent through Fundex include an unsubscribe line by default, and any recipient may also opt out by replying to the sender. Fundex automatically detects replies asking not to be contacted. Newsletters sent through Fundex include a clearly visible unsubscribe link. Opt-outs are applied permanently across the Customer's entire workspace, never expire, and cannot be overridden by the Customer.
Accounts found to be sending unsolicited commercial email will be suspended.
What we track
- Open tracking: A 1×1 pixel image is embedded in outreach emails. When the recipient opens the email and images load, we record the open event and approximate time.
- Click tracking: Links in outreach sequence emails may be rewritten to route through our tracking domain before redirecting to the target URL, recording the click event.
- Reply detection: We read replies to messages sent through Fundex in order to update pipeline stages, stop follow-up sequences, and detect requests not to be contacted.
- Bounce & opt-out handling: Hard bounces, unsubscribe requests, and replies asking not to be contacted are automatically honoured, and the contact is suppressed from future outreach.
Email tracking is a feature of the outreach sequences tool. Tracking pixels are only embedded in emails sent through Fundex sequences — not in emails sent directly from your email client. Investors may disable image loading in their email client to opt out of open tracking.
Mailbox permissions
Connecting your email account grants Fundex the OAuth permissions you approve. Fundex uses them to send the email you compose or schedule in Fundex, to display your inbox inside Fundex (visible only to you), to read replies to messages sent through Fundex, and to schedule meetings on your connected calendar. We use mailbox and calendar data only to provide features you use. We do not sell it, use it for advertising, or use it to train AI models.
Fundex's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Data Retention
We retain your data for as long as your account is active or as needed to provide the Service. Specific retention periods:
- Account data: Retained while your subscription is active plus 90 days after cancellation to allow account reinstatement.
- CRM and pipeline data: Available for export at any time; purged within 30 days of account termination upon written request.
- Email tracking events: Retained for 36 months from the event date, then automatically deleted.
- Billing and transaction records: Retained for 7 years for tax and legal compliance.
- Security and audit logs: Retained for 12 months.
- Backups: Point-in-time database backups are retained for 35 days and then overwritten.
You may request deletion of your data at any time by contacting privacy@usefundex.com. We will respond within 30 days.
Security
Fundex implements technical and organizational measures appropriate to the risk of processing personal data. These include:
Encryption in transit
All data transmitted between clients and our servers is encrypted using TLS 1.2+.
Encryption at rest
Database volumes and backups are encrypted using AES-256 at the storage layer.
Access controls
Role-based access control (RBAC) limits who can access customer data internally. Production access requires MFA and is logged.
Tenant isolation
All database queries are scoped by tenant ID. Cross-tenant data access is blocked at the application layer.
Vulnerability management
We run automated dependency scanning, static analysis, and periodic penetration testing.
Incident response
We maintain an incident response plan and will notify affected Customers without undue delay in the event of a data breach.
No method of electronic transmission or storage is 100% secure. While we strive to use commercially acceptable means to protect your data, we cannot guarantee absolute security. Please report security vulnerabilities to security@usefundex.com.
Your Rights
Depending on your location, you may have the following rights regarding your personal data:
Access: Request a copy of the personal data we hold about you.
Rectification: Request correction of inaccurate or incomplete data.
Erasure (Right to be Forgotten): Request deletion of your personal data, subject to legal retention obligations.
Portability: Request your data in a structured, machine-readable format (CSV or JSON).
Restriction of processing: Request that we limit how we use your data in certain circumstances.
Objection: Object to processing based on legitimate interests or for direct marketing purposes.
Withdraw consent: Where processing is based on consent, withdraw it at any time without affecting prior lawful processing.
To exercise any of these rights, email us at privacy@usefundex.com. We will respond within 30 days (GDPR) or 45 days (CCPA). We may need to verify your identity before processing your request.
GDPR
If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, the General Data Protection Regulation (GDPR) or equivalent UK/CH legislation applies to our processing of your personal data.
Legal bases for processing
- Contract performance: Processing necessary to deliver the Service you have subscribed to.
- Legitimate interests: Security monitoring, fraud prevention, product analytics, and improving the Service — balanced against your rights.
- Consent: Marketing communications and certain cookie categories (you may withdraw at any time).
- Legal obligation: Tax and accounting records.
International data transfers
Fundex is based in the United States. When we transfer personal data from the EEA/UK to the US, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission. Enterprise Customers may request SCCs as part of a Data Processing Addendum.
Data Protection Officer
For GDPR-specific inquiries, contact our privacy team at privacy@usefundex.com. You also have the right to lodge a complaint with your local supervisory authority.
CCPA / CPRA (California)
If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) grants you additional rights:
- Right to Know: Request information about the categories and specific pieces of personal information we have collected about you.
- Right to Delete: Request deletion of your personal information (subject to exemptions).
- Right to Correct: Request correction of inaccurate personal information.
- Right to Opt Out of Sale / Sharing: We do not sell or share personal information for cross-context behavioral advertising.
- Right to Limit Use of Sensitive Personal Information: We do not use sensitive personal information beyond what is necessary for the Service.
- Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.
To submit a verified consumer request, email privacy@usefundex.com or use the Do Not Sell or Share My Personal Information link in the footer. We will respond within 45 calendar days.
Children's Privacy
The Fundex Service is not directed at children under the age of 18. We do not knowingly collect personal information from anyone under 18. If you believe a child has provided us with personal information, please contact privacy@usefundex.com and we will promptly delete it.
Policy Changes
We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date at the top of the page. For material changes, we will provide prominent notice via email or an in-app notification at least 30 days before the change takes effect. Your continued use of the Service after the effective date constitutes acceptance of the updated policy.
We encourage you to review this page periodically. Previous versions of this policy are available upon request.
Contact Us
If you have questions about this Privacy Policy, want to exercise your rights, or have a privacy concern, please reach out:
Mailing Address
Fundex, Inc.311 Post Road East, 2nd Floor
Westport, CT 06880
United States
For security vulnerabilities, please email security@usefundex.com — do not file public issues.