Privacy Policy

Last Updated:April 28, 2026

Mobstergang, Inc., the company that operates Syndkit ("Syndkit," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website, platform, and services (collectively, the "Services").

By accessing or using our Services, you agree to this Privacy Policy. If you do not agree with the terms of this Privacy Policy, please do not access or use our Services.

1. Company Information

Mobstergang, Inc.
447 Broadway, 2nd Floor #1649
New York, NY 10013
Email: [email protected]

2. Information We Collect

2.1 Information You Provide Directly

Account Information: Name, email address, phone number, company name, job title, and password when you create an account.
Profile Information: Investment criteria, sector preferences, deal stage preferences, geographic focus, and investment history.
Deal Documents: Pitch decks, executive summaries, financial projections, business plans, and other materials you upload to our platform.
Payment Information: Billing address, payment card details (processed securely by our payment processor, Stripe), and transaction history.
Communications: Messages, emails, and other communications you send through our platform or to our support team.
Verification Information: Documentation to verify accredited investor status, identity verification documents, and related information.
CRM Credentials and Connection Information: When you enable a CRM Integration (such as Wealthbox, DealCloud, Salesforce, or other supported CRM platforms), you provide API keys, personal access tokens, OAuth credentials, or similar access credentials. We also store connection metadata such as the provider name, a non-sensitive credential hint (e.g., the last few characters of a token), connection status, and the timestamp of your most recent connection test. See Section 5 for details on how CRM-connected data is handled.

2.2 Information Collected Automatically

Device Information: IP address, browser type, operating system, device identifiers, and mobile network information.
Usage Data: Pages visited, features used, clicks, searches, time spent on pages, and interaction patterns.
Log Data: Access times, error logs, referring URLs, and pages viewed before and after using our Services.
Cookies and Tracking Technologies: We use cookies, web beacons, pixels, and similar technologies to collect information about your browsing activities.

2.3 Information from Third Parties

Identity Verification Services: Information from third-party services used to verify your identity or accredited investor status.
Public Databases: Information from publicly available sources, business registries, and professional networks.
Analytics Providers: Data from analytics services that help us understand platform usage.
Connected CRM Platforms: When you authorize a CRM Integration, we may receive records (such as contacts, companies, deals, opportunities, notes, tasks, and activities) from the CRM you connect, only to the extent needed to deliver the features you request.

3. How We Use Your Information

We use your information for the following purposes:

Provide Services: To operate our platform, match founders with investors, process transactions, and deliver the features you request.
AI-Powered Matching: To analyze your profile, deal documents, and preferences using artificial intelligence and machine learning to generate investor matches and recommendations.
Communication: To send you service-related notifications, respond to inquiries, provide customer support, and send marketing communications (with your consent).
Improvement: To analyze usage patterns, improve our algorithms, enhance user experience, and develop new features.
Security: To detect, prevent, and address fraud, security breaches, and other harmful activities.
Legal Compliance: To comply with applicable laws, regulations, legal processes, and government requests.
Payment Processing: To process payments, prevent fraud, and manage billing.
CRM Integrations: To perform the CRM operations you request — including connection testing, reading records you authorize, writing back records you authorize, and maintaining an audit trail of CRM actions taken on your behalf.

4. How We Share Your Information

4.1 Service Providers

We share information with third-party service providers who perform services on our behalf, including:

Payment Processors: Stripe processes payment transactions securely.
Cloud Infrastructure: We use cloud service providers to host and store data.
AI Providers: We use artificial intelligence services, including OpenAI, to power our matching algorithms, generate insights, and process deal information. Data shared with AI providers is subject to their respective privacy policies and data processing agreements.
Analytics Services: We use analytics tools to understand platform usage and improve our Services.
Email Services: We use email service providers to send transactional and marketing emails.
Identity Verification: Third-party services verify user identity and accredited investor status.

4.2 Platform Users

When you use our matching services, certain information may be shared with potential investors or founders based on your privacy settings and the nature of the match. You control what information is visible to other users through your account settings.

4.3 Legal Requirements

We may disclose your information if required to do so by law or in response to valid requests by public authorities, including:

To comply with a legal obligation, subpoena, court order, or legal process.
To protect and defend our rights or property.
To prevent or investigate possible wrongdoing in connection with the Services.
To protect the personal safety of users or the public.

4.4 Business Transfers

If we are involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, your information may be transferred as part of that transaction. We will provide notice before your information is transferred and becomes subject to a different privacy policy.

4.5 With Your Consent

We may share your information for other purposes with your explicit consent.

5. CRM Integrations and Connected Account Data

This section explains how we collect, use, store, and secure information when you connect a third-party CRM platform (such as Wealthbox, DealCloud, or Salesforce) to your Syndkit account. The legal terms governing your use of CRM Integrations are set out in our Terms of Service.

5.1 What We Collect from CRM Integrations

CRM Credentials: API keys, personal access tokens, OAuth credentials, or similar access credentials you provide to enable a CRM Integration.
Connection Metadata: Provider name, display name, connection status, last connection-test timestamp, last error message (if any), and a non-sensitive credential hint such as the last few characters of a token.
CRM Records: Records you authorize us to read from your CRM (such as contacts, companies, deals, opportunities, notes, tasks, and activities) and records we write back to your CRM at your direction.
Writeback Audit Log: For each CRM operation we attempt on your behalf — including test connections, reads, and writebacks — we record the operation type, the local and external object identifiers involved, request and response payloads, status, error messages, attempt count, and timestamps.

5.2 How We Use CRM-Connected Data

To perform the CRM Integration actions you request, including connection tests, reads, and writebacks.
To populate context within Syndkit (for example, to surface relevant contacts or deals while you work).
To maintain an audit trail of CRM operations for security review, debugging, and your own compliance and recordkeeping needs.
To diagnose and recover from errors when CRM operations fail.

5.3 How We Share CRM-Connected Data

We use your CRM Credentials to call your connected CRM platform's API on your behalf, only as needed to perform the actions you request or enable. Your use of any third-party CRM is governed by that provider's own privacy policy and terms.
We do not sell, rent, or otherwise commercialize your CRM Credentials or CRM Records.
We do not share your CRM Credentials or CRM Records with other Syndkit users.
We do not use your CRM Credentials or CRM Records to train AI models for the benefit of other users.
If a Syndkit feature you use processes CRM-connected data through an AI provider (for example, to summarize a record or draft an email), only the relevant content — never your CRM Credentials — is sent to that provider, subject to that provider's privacy and data-processing terms.

5.4 Storage and Security of CRM Credentials

CRM Credentials are encrypted at rest using AES-GCM encryption.
CRM Credentials are scoped to the user account that provided them. They are not accessible to other Syndkit users.
Once saved, CRM Credentials are never displayed back to you in full. We surface only a non-sensitive credential hint and connection status.
Operations performed using your CRM Credentials are recorded in the writeback audit log described in Section 5.1.

5.5 Retention and Deletion

CRM Credentials are retained until you disconnect the CRM Integration through your account settings or your account is closed. On disconnect, the encrypted credential record is deleted from our active systems.
Writeback Audit Log entries are retained for up to two (2) years for security review, debugging, and compliance purposes, after which they are deleted or anonymized in line with our standard data retention practices.
CRM Records read from your CRM are retained only as long as needed to provide the requested feature, and may be cached for performance. You may request deletion of cached CRM Records at any time, subject to legal retention requirements.
You may also revoke or rotate CRM Credentials directly with your CRM provider at any time, independent of Syndkit. Revocation at the provider level will cause CRM operations through Syndkit to fail until you reconnect with new credentials.

5.6 Your Choices

You can disconnect any CRM Integration at any time through your account settings.
You can rotate, revoke, or restrict the scope of CRM Credentials at the CRM provider.
You can request deletion of CRM-connected data we have cached by contacting [email protected].

6. Data Retention

We retain your personal information for as long as necessary to provide our Services, comply with legal obligations, resolve disputes, and enforce our agreements. Specific retention periods include:

Account Information: Retained while your account is active and for 7 years after account closure for legal and compliance purposes.
Deal Documents: Retained while your account is active. You may delete uploaded documents at any time through your account settings.
Payment Records: Retained for 7 years as required by tax and financial regulations.
Usage Data: Generally retained for 2 years for analytics purposes.
CRM Credentials and CRM-Connected Data: See Section 5.5 for CRM-specific retention and deletion practices.

7. Data Security

We implement appropriate technical and organizational security measures to protect your personal information, including:

256-bit encryption for data in transit and at rest.
AES-GCM encryption for sensitive credentials, including CRM Credentials.
Regular security assessments and penetration testing.
Access controls and authentication requirements.
Employee training on data protection practices.
Incident response procedures.

While we strive to protect your information, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.

8. Your Privacy Rights

8.1 All Users

You have the right to:

Access: Request a copy of the personal information we hold about you.
Correction: Request correction of inaccurate or incomplete information.
Deletion: Request deletion of your personal information, subject to legal retention requirements.
Portability: Request a copy of your data in a machine-readable format.
Opt-Out: Opt out of marketing communications at any time.
Disconnect Integrations: Disconnect any CRM Integration or other connected third-party account at any time through your account settings.

8.2 California Residents (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

Right to Know: You can request information about the categories and specific pieces of personal information we have collected, the sources of collection, the business purposes, and the categories of third parties with whom we share information.
Right to Delete: You can request deletion of your personal information, subject to certain exceptions.
Right to Opt-Out of Sale: We do not sell your personal information. If this changes, you will have the right to opt out.
Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.

To exercise your CCPA rights, please contact us at [email protected] or call 682-800-GANG. We will verify your identity before processing your request.

8.3 Do Not Track

Our Services do not currently respond to "Do Not Track" signals. However, you can manage cookies through your browser settings.

9. Cookies and Tracking Technologies

We use the following types of cookies:

Essential Cookies: Required for the operation of our Services (authentication, security, load balancing).
Analytics Cookies: Help us understand how users interact with our platform.
Functional Cookies: Remember your preferences and settings.
Marketing Cookies: Used to deliver relevant advertisements (with your consent).

You can control cookies through your browser settings. Note that disabling certain cookies may affect the functionality of our Services.

10. Children's Privacy

Our Services are not intended for individuals under 18 years of age. We do not knowingly collect personal information from children under 18. If we become aware that we have collected personal information from a child under 18, we will take steps to delete such information promptly.

11. International Data Transfers

Our Services are operated in the United States. If you access our Services from outside the United States, please be aware that your information may be transferred to, stored, and processed in the United States where our servers are located and our central database is operated. By using our Services, you consent to this transfer.

12. Third-Party Links

Our Services may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to read the privacy policies of any third-party sites you visit.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last Updated" date. For significant changes, we may also send you an email notification. Your continued use of our Services after any changes constitutes acceptance of the updated Privacy Policy.

14. Contact Us

If you have any questions about this Privacy Policy or our privacy practices, please contact us at:

Mobstergang, Inc.
447 Broadway, 2nd Floor #1649
New York, NY 10013
Email: [email protected]
Phone: 682-800-GANG