Information Security, Regulatory Compliance & Privacy Policy
Effective Date: January 1, 2026
Last Revised: April 10, 2026
Document Classification: Confidential
Version: 2.0
Notice to Investors
This Information Security, Regulatory Compliance & Privacy Policy (the “Policy”) is issued by JBV Capital Inc., a California corporation (“JBV Capital,” the “Firm,” “we,” “us,” or “our”), and governs the collection, processing, storage, protection, and disclosure of personal and financial information obtained from or on behalf of our limited partners (“LPs”), prospective investors, and authorized users of the JBV Capital LP Portal (the “Platform”).
This Policy constitutes a binding agreement between you and JBV Capital with respect to data handling practices. By accessing the Platform, submitting personal information, or executing investment documents through JBV Capital, you acknowledge that you have read, understood, and agree to be bound by the terms of this Policy.
JBV Capital is registered as a broker-dealer with the United States Securities and Exchange Commission (“SEC”) and maintains membership in the Financial Industry Regulatory Authority (“FINRA”) and the Securities Investor Protection Corporation (“SIPC”). The Firm conducts securities offerings exclusively under Regulation D of the Securities Act of 1933, as amended.
1. Information Security Architecture
1.1 Encryption Standards
(a) Data in Transit.All data transmitted between the Investor’s browser and the Platform is encrypted using TLS 1.2 or higher.
(b) Data at Rest.All Investor Data stored within the Firm’s database systems is encrypted at rest using AES-256.
(c) Document Storage. Investor documents are stored in encrypted cloud storage systems. Access is controlled through cryptographically signed, time-limited URLs that expire after a predetermined period.
1.2 Authentication and Access Control
Access to the Platform requires email-based one-time password verification or Google SSO for each login session. Authenticated sessions are governed by cryptographically signed JSON Web Tokens scoped to the individual Investor. The Platform enforces Row-Level Security policies at the database layer, ensuring each Investor may access only their own data.
2. Data Collection and Processing
In connection with your investment activities, JBV Capital collects: identity information (name, tax ID, government ID), contact information (email, phone, address), financial information (net worth, income, accreditation status, bank details), entity information (for entity investors), investment data (commitments, distributions, K-1s), and usage data (IP address, browser type, timestamps).
3. Use of Information
JBV Capital uses Investor Data solely for: identity and accreditation verification, transaction processing, K-1 and tax document preparation, AML/KYC compliance, regulatory reporting, fund communications, recordkeeping, and platform security.
4. Disclosure of Information
JBV Capital does not sell, rent, or trade Investor Data. We may disclose data to: fund administrators, legal counsel, independent auditors, tax advisors, regulatory authorities (SEC, FINRA, IRS), banking institutions, and technology service providers, each bound by written confidentiality obligations.
5. Data Retention
| Record Category | Retention Period |
|---|---|
| KYC/AML records | 5 years after termination |
| Securities transaction records | 6 years after disposition |
| Tax records (K-1s) | 7 years after tax year |
| Subscription agreements | Life of Fund + 6 years |
| Investor communications | 6 years total |
| Audit logs | 6 years |
6. Your Rights
Under the California Consumer Privacy Act (CCPA/CPRA) and GDPR (where applicable), you have the right to: access your data, request deletion (subject to regulatory retention), correct inaccurate data, request data portability, and object to processing. JBV Capital does not sell Personal Information.
To exercise any of these rights, contact privacy@jbv.com. We will respond within 30 calendar days.
7. Cookies
The Platform uses strictly necessary session cookies only for authentication. We do not deploy third-party tracking cookies, advertising pixels, browser fingerprinting, or web analytics that transmit data to third parties.
8. Security Incidents
In the event of a data breach, JBV Capital will notify affected Investors within 72 hours and provide a description of the incident, data involved, consequences, and remedial measures.
9. Infrastructure
| Provider | Service | Certification |
|---|---|---|
| Vercel | Application hosting | SOC 2 Type II |
| Supabase (AWS) | Database & auth | SOC 2 Type II |
| Google Workspace | Email delivery | SOC 2 Type II |
10. Children’s Privacy
The Platform is not directed to individuals under the age of 18. Access to the Platform requires accredited investor qualification under SEC Rule 501(a) of Regulation D. We do not knowingly collect, maintain, or use personal information from children under 13 years of age. If you learn that a child has provided us with personal information in violation of this Policy, please contact us at privacy@jbv.com.
11. International Visitors
The Platform is hosted in the United States and intended for visitors located within the United States. If you choose to use the Platform from the European Union or other regions with laws governing data collection and use that may differ from U.S. law, you are transferring your personal information outside of those regions to the U.S. for storage and processing. We may also transfer your data from the U.S. to other countries in connection with storage and processing, fulfilling your requests, and operating the Platform. By providing any information on or through the Platform, you consent to such transfer, storage, and processing.
12. Corporate Transactions
We may transfer or disclose your personal information to service providers, advisors, potential transactional partners, or other third parties in connection with the consideration, negotiation, or completion of a corporate transaction in which JBV Capital is acquired by or merged with another company, or we sell, liquidate, or transfer all or a portion of our assets. In such event, we will use reasonable efforts to require that the transferee treats your personal information in accordance with this Policy.
13. Changes to This Policy
We will post any adjustments to this Policy on this page, and the revised version will be effective when it is posted. If we materially change the ways in which we use or share personal information previously collected from you, we will notify you by email or through the Platform at least 30 days before the change takes effect.
14. Contact
For questions about this Policy or your data, contact:
JBV Capital Inc.
Email: privacy@jbv.com
General: info@jbv.com
This Policy supplements your Limited Partnership Agreement, Subscription Agreement, and other Fund Documents. In the event of a conflict, the Fund Documents control. Governed by the laws of the State of California.
© 2026 JBV Capital Inc. All rights reserved.