DRAFT — Not Legally Reviewed
This is a working starting point, not a final legal document. It must be reviewed by an attorney before being published as Capital Command's actual Privacy Policy.
Draft — pending attorney review
This Privacy Policy describes how Wood Capital LLC (“Capital Command”) handles information in connection with the Capital Command service. It applies to information submitted by departments using Capital Command (“Customer Data”) and to information about individual users of the Service.
Capital Command is in controlled pilot development, running on a live, multi-tenant Supabase database with real user authentication and Row Level Security enforced at the database level — a department's data is only ever visible to signed-in members of that department. See the Trust Center for the full current-state description, including what is not built yet (self-service sign-up, real file/document storage, email notifications). This policy will be revised further as those gaps close.
Department-provided information (personnel counts, apparatus, budgets, facilities, funding history, and similar organizational data entered directly into Capital Command), documents and their associated metadata, and basic account/contact information for the people using Capital Command on a department's behalf. Capital Command does not purchase or aggregate data about individuals from third parties.
To operate the Service for the department that submitted it — funding matching, financial calculations, report generation, and related features — and not for any other department's benefit. Customer Data is not sold. Capital Command does not currently perform aggregate or de-identified analytics across departments' data; if that changes, this section will describe it before it happens.
Capital Command uses AI-assisted drafting in one feature today (SOP/SOG drafting). When used, it sends only the department's own already-entered Department Profile information (never third-party or other departments' data) to a third-party AI provider (Anthropic) to generate a draft; that output is stored clearly marked as AI-suggested and unverified until a person reviews it, and is never used to train any AI model. No other feature in Capital Command processes Customer Data through AI. This section will be updated before any additional AI-assisted feature is made available.
Retention periods, a self-service export format/process, and a self-service deletion process are not yet finalized. A department can request an export or deletion of its own data today by contacting its Capital Command point of contact directly.
Capital Command currently uses Supabase (database and authentication), Vercel (application hosting), and, for the one AI-assisted feature described above, Anthropic (AI processing). Nothing is listed here that isn't actually in use; this list will be kept current as infrastructure changes.
Privacy questions should go through your Capital Command point of contact directly.