Privacy Notice
Edition 2026-10-30.1. Documents approved. Contractual acceptance is not enabled.
These documents have been approved. Account acceptance will be requested when enabled for this release.
Who handles information
CapitalWave Inc. operates CapitalBOS. For institution-assigned learning, the institution may determine the educational purposes and CapitalWave may process records on its instructions. CapitalWave also determines purposes for account administration, service security and its own legal obligations. The relevant roles and institutional instructions must be set out in the applicable agreement.
Information collected
The service processes account identifiers, verified email and authentication-provider information; profile names and preferences; institution roles, cohort memberships and roster reservations; exercise actions, submitted findings, communications, scores, saved debriefs and instructor observations; enrollment and access events; and contractual acceptance records. Hosting, authentication, email and diagnostic services may process device, network, delivery and error information. Simulation financial data is fictional, but identifiable learner records are personal information.
Sources and purposes
Information comes from you, your institution or instructor, the authentication provider and operation of the service. It supports accounts, enrollment, assigned practice, teaching, feedback, exports, security, troubleshooting, contractual records and applicable obligations. Depending on the activity and applicable law, the legal basis may be performance of a contract, legitimate interests assessed for service administration and security, a legal obligation, or the institution's lawful instructions. Optional processing requiring consent needs a separate choice; accepting Terms is not that consent.
Who can see records
Authorized teaching staff and institution administrators can inspect records within their assigned access, including performance and observations. Other learners do not receive the private instructor report through the classroom display. Instructors can export records and must safeguard them. CapitalWave may use service providers for hosting, authentication, email delivery and diagnostics, and disclose information where legally required or necessary to protect rights and security. A public classroom message must not contain private learner information.
Providers and international processing
The application integrates Lovable hosting and development services, Supabase authentication and database services, optional Google sign-in, Google-hosted fonts and Resend for configured roster emails. Availability and provider configuration differ between deployments. Provider locations, subprocessors, contractual safeguards and international transfer mechanisms must be confirmed for the institution's deployment. Do not assume data remains in a particular country merely because an institution is located there.
Retention and deletion
Retention depends on the record category, institutional instructions and applicable obligations. An institution's recorded retention period is a policy record, not an automatic deletion job. Resetting an exercise or removing enrollment does not erase saved attempts, debriefs or audit. Contractual acceptance and security evidence may require separate retention. Deletion, anonymization, preservation exceptions and backup expiration require an operational review; we do not promise automatic erasure after a displayed number of days.
Your choices and rights
Depending on applicable law, you may request access, correction, deletion, restriction, portability or object to certain processing, and withdraw consent where processing relies on consent. Rights have lawful limits and identity may need verification. Institution-controlled records may need coordination with the institution. You may complain to a competent data protection authority. Submit requests through Contact and Privacy Requests; do not include passwords or recovery tokens.
Adults and updates
This release is for adults aged 18 or older. Institutions must not enroll younger learners under this release. If an underage account is identified, notify the privacy contact for review. Material changes to processing will be communicated appropriately. Receipt or acknowledgment of this notice is distinct from consent to optional processing.