Privacy Policy

Last updated: October 2026

1. Data Controller

The data controller within the meaning of the General Data Protection Regulation (GDPR) is:

capty.ai
Frömmgen/Wintjens GbR
KWL Büro 0.05, Lothringer Str. 38
44805 Bochum, Germany
Email: hello@capty.ai

2. Scope of this Privacy Policy

This privacy policy applies to the use of our website at capty.ai and to the use of our SaaS platform capty (hereinafter "Platform" or "Service"). It informs you about the nature, scope, and purposes of the processing of personal data.

capty is directed exclusively at companies, agencies, freelancers acting in a professional or commercial capacity, and other organisations (B2B). Natural persons acting outside their professional or commercial capacity are not the intended audience of this service.

3. Website Hosting and Server Logs

Our website is hosted by Hostinger International Ltd. When you visit our website, the hosting provider automatically collects information in server log files:

IP address of the requesting device
Date and time of access
Name and URL of the accessed file
Website from which access is made (referrer URL)
Browser and operating system used
Hostname of the accessing device

Processing is based on Art. 6(1)(f) GDPR (legitimate interest in the technical provision and security of the website). Server log files are automatically deleted after 30 days.

Hostinger processes data in data centres within the EU. More information: Hostinger Privacy Policy.

4. SSL/TLS Encryption

This site uses SSL/TLS encryption for security reasons. An encrypted connection is indicated by the browser address bar changing from "http://" to "https://" and the lock icon in the address bar.

5. Contact Requests and Earlier Waitlist Sign-ups

When you use our contact form, we collect the following data:

First and last name
Email address
Company (optional)
Message (optional)

Legal basis: Art. 6(1)(a) GDPR (consent) and Art. 6(1)(b) GDPR (pre-contractual measures). The data is used to process your enquiry. We do not share this data with third parties without your explicit consent.

Contact data is retained for up to 24 months from collection, unless a contractual relationship arises or earlier deletion is requested.

The waitlist that accepted sign-ups before launch no longer exists. Waitlist data already collected is deleted under the same limit of at most 24 months from collection; you can request earlier deletion at any time at hello@capty.ai.

6. Newsletter and Product Emails (Brevo)

We use Brevo (formerly Sendinblue), Brevo SAS, 106 boulevard Haussmann, 75008 Paris, France, for sending newsletters and product-related emails.

When you subscribe to our newsletter, your email address is stored and processed by Brevo. Brevo also collects technical data such as open rates and click behaviour to optimise our email communications.

Legal basis: Art. 6(1)(a) GDPR (consent). You can revoke your consent at any time by unsubscribing from the newsletter (link in every email) or by contacting us at hello@capty.ai. Email addresses are retained until consent is withdrawn. Upon an unsubscribe request, deletion from active mailing lists occurs within 30 days.

Brevo is certified under the EU-US Data Privacy Framework. More information: Brevo Privacy Policy.

7. Cookies

Our website uses cookies. Cookies are small text files that are stored on your device by your browser.

7.1 Strictly Necessary Cookies

These cookies are required for the operation of the website and cannot be disabled:

capty_cookie_consent: Stores your cookie preferences (duration: 365 days)
capty_lang: Stores your language setting (duration: 365 days)

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the functionality of the website).

7.2 Analytics Cookies (Google Analytics)

We use Google Analytics, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics uses cookies that enable an analysis of website usage.

We have implemented the following privacy measures:

IP anonymisation is enabled (your IP address is truncated within the EU)
A data processing agreement has been concluded with Google
Data sharing with Google is disabled
Google Signals is disabled

Legal basis: Art. 6(1)(a) GDPR (consent). Analytics cookies are only set after your explicit consent via our cookie banner. You can revoke your consent at any time via the cookie settings.

More information: Google Privacy Policy. You can also prevent collection by Google Analytics with the browser add-on.

7.3 Managing Cookie Settings

You can adjust your cookie settings at any time via our cookie settings page. Additionally, you can manage or delete cookies in your browser settings.

8. Fonts and Icons

We use the typeface "Plus Jakarta Sans" and a set of icons. Both are served from our own server. Loading a page therefore establishes no connection to Google or any other third party; in particular, no IP address is transmitted to a third party.

9. Account Creation and Account Management

Use of the capty Platform requires the creation of a user account. During registration and account management, we process the following data:

First and last name
Email address
Company name (required for invoicing)
Password (stored encrypted, not readable in plain text)
Team assignments and role permissions (depending on the selected plan)
Registration timestamp and most recent login data (for security purposes)

Legal basis: Art. 6(1)(b) GDPR (performance of contract). Account data is retained for the duration of the contractual relationship. After cancellation, the 30-day export window set out in the Terms applies. Account data is then deleted, unless statutory retention obligations apply.

10. Uploaded Content and Generated Outputs

In the course of using the Platform, customers upload media content and receive AI-generated outputs. The following data is processed:

Uploaded images and videos
Text inputs (instructions, brand descriptions, and other inputs)
AI-generated captions, copy, and other outputs
Approval statuses and comments within approval workflows
Usage metadata (e.g. upload timestamps, processing status)

Legal basis: Art. 6(1)(b) GDPR (performance of contract). Uploaded and generated content is retained for the duration of the contractual relationship. After cancellation, the 30-day export window set out in the Terms applies. Content is then deleted, unless statutory retention obligations apply; for earlier versions of uploaded media, the period of up to 30 days described in section 10.1 applies.

Uploaded content is not shared with third parties for advertising, analytics, or other secondary purposes.

10.1 Where uploaded media files are stored

Uploaded images and video are stored on a server operated by us with Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in the Nuremberg data centre (Germany). Hetzner provides the infrastructure only and takes no notice of the content of the files. A data processing agreement under Art. 28 GDPR is in place with Hetzner (version 1.2 of 16 February 2026, concluded on 12 October 2026).

These files are not transferred to any third country. The agreement provides that processing takes place exclusively within the EU/EEA; for a server location in the EU, server data is processed solely within the EU, and support services are likewise provided from within the EU. The sub-processors approved by the provider relate exclusively to the Finland, USA and Singapore locations and do not apply to our location in Nuremberg.

The provider is certified to ISO 27001 and holds a BSI C5 Type 2 attestation. The technical and organisational measures of its data centres are audited annually by an independent body; the audit by TÜV Rheinland i-sec GmbH dated 19 February 2026 covers the Nuremberg site and identified no deviations. Details are set out in Annex 1 and Annex 2 of our data processing agreement.

The remaining application data — account data, text entered and generated, post and approval data — is held on our infrastructure with Hostinger International Ltd. within the EU (Lithuania). The hosting of this website is unaffected by this (see section 3).

To avoid confusion: our service provider bundle.social also uses Hetzner (section 11.2). That is separate infrastructure at a different location and concerns only posts for TikTok and LinkedIn. The Nuremberg server described here is operated by us.

Processing by AI providers: for analysis and text generation, content is transmitted to the processors named in section 13. Storage with Hetzner does not change this; the safeguards described there continue to apply.

Backups and versions: once the export period ends, we delete content from our active systems. To protect against accidental deletion or overwriting, earlier versions of uploaded media may be retained in our Hetzner Object Storage in Germany (region NBG1) for up to 30 days for technical recovery purposes. They are not used in normal platform operation and are deleted automatically once that period expires. If a version is restored, we re-apply any deletion requests that still apply. Statutory retention obligations remain unaffected.

11. Connected Social Media Accounts and API Integration

11.1 General

capty allows users to connect their social media accounts via OAuth 2.0 to publish and schedule content automatically. When using these integrations, both capty and the respective platforms process personal data. capty and each social media platform act as independent data controllers (separate controllers) for the processing carried out within their respective spheres.

The legal basis for all processing in this section is Art. 6(1)(b) GDPR (performance of contract). Access tokens and refresh tokens are stored exclusively server-side, encrypted and secured in accordance with current industry standards. They are not shared with any third party other than processors supporting capty in operating the Platform. Users may disconnect their accounts and request deletion of all related data at any time.

11.2 Technical Integration of TikTok and LinkedIn via bundle.social

Connecting TikTok and LinkedIn, and publishing to those two platforms, runs technically through the service bundle.social, operated by BUNDLE SP. Z O.O., UL. Hoża 86/410, 00-682 Warsaw, Poland (KRS 0001103308, NIP 7011202969). bundle.social acts as a processor for us under Art. 28 GDPR and processes the data solely on our instructions.

The scope is limited to two platforms: only posts you publish to TikTok or LinkedIn, and the corresponding account connections, pass through bundle.social. Publishing to Instagram and Facebook runs through our own Meta integration and does not involve bundle.social. If you connect neither TikTok nor LinkedIn, no data of yours is transmitted to bundle.social.

Before you connect either account, we tell you explicitly at that point in the application that the connection runs through bundle.social, and we link our Terms of Service. The connection is only established if you actively initiate it.

What is transmitted: the content of posts intended for TikTok or LinkedIn (text, images, video, metadata), scheduling information, the identifier and basic profile data of the connected account, the access tokens (OAuth), and subsequently publication status, post IDs, error messages and retrieved analytics data.

Storage at the provider: per the bundle.social privacy policy, post content, post data, analytics and uploaded media are kept for as long as needed to provide publishing, scheduling, post history, analytics, debugging and support — so unlike a pure pass-through, content remains with the provider. Access tokens are kept while the account stays connected. The provider states that application and API logs as well as database backups are retained for 7 days, and that deleted customer data is removed from active systems within 30 days. The provider expressly states that it does not use customer content, uploaded media, social account data or OAuth data to train third-party AI models, and that it does not sell personal data.

Place of processing: our contracting party is established in Poland and therefore within the EU; the transfer to it is not a third-country transfer. Under the data processing agreement concluded with us, the production infrastructure is in Germany (Hetzner, Frankfurt am Main). Account data, post data, analytics and the access tokens are stored there. Administrative access is restricted to personnel in Poland. Published media files are stored and delivered through Cloudflare's global infrastructure, and the provider uses further service providers for authentication, billing, email and support, some of which process outside the EEA. Those transfers rely on Standard Contractual Clauses.

The provider's sub-processors: we disclose the full chain by name — Hetzner (Germany), Supabase (USA), Stripe (EEA), Cloudflare (global), Resend (USA), Crisp (EU) and Google Workspace (EU/USA). Purpose, location and safeguard for each are set out in Annex 1a of our data processing agreement. The provider announces changes to that set at least 14 days in advance.

Further information: bundle.social privacy policy and bundle.social terms of service.

11.3 Meta (Facebook and Instagram)

Data controller at Meta:
Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (for EU/EEA users); Meta Platforms, Inc., 1 Meta Way, Menlo Park, CA 94025, USA (global parent).

Data processed by capty via the Meta Graph API:

Facebook Page IDs and names, and the user's administrative role on each Page
Instagram Business or Creator Account ID and basic profile information (display name, avatar URL)
Page Access Tokens (for Facebook Pages; do not expire on a fixed schedule; invalidated upon password change or access revocation) and User Access Tokens (valid approx. 60 days; stored server-side as Long-Lived Tokens)
Metadata relating to scheduled and published posts (publish time, Post ID, publish status)

API permissions (scopes) used: pages_show_list, pages_manage_posts, pages_read_engagement, instagram_business_basic, instagram_business_content_publish.

Data transmitted to Meta when publishing: Post content (text, image or video file), visibility settings, and scheduled publish time are transmitted to Meta via the Graph API. capty processes this data exclusively on instruction from and on behalf of the user.

Programme and terms: capty uses the Meta Graph API under the Meta Platform Terms (Meta for Developers Platform) and the Meta Business Tools Terms. Use is compliant with Meta's current Platform Policies. capty participates in Meta's App Review process for all permissions requiring Advanced Access.

Data deletion and revocation: Access tokens are deleted as soon as a user disconnects their account in capty's account settings, cancels their capty account, or upon request from Meta. Users can also revoke access directly with Meta at any time:

Facebook/Meta: Settings → Apps and Websites
Alternatively: auth.meta.com/settings/apps_websites/

capty additionally provides an in-platform option to disconnect accounts and request data deletion. Requests sent to hello@capty.ai will be processed and all platform-related data deleted promptly.

Data processing by Meta: For information on Meta's own data processing, please refer to:
Facebook: facebook.com/privacy/policy/
Instagram: privacycenter.instagram.com/policy/

11.4 LinkedIn

The technical connection to LinkedIn runs through bundle.social; see section 11.2. The following relates to processing by LinkedIn itself.

Data controller at LinkedIn:
LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland (for EU/EEA users); LinkedIn Corporation, 1000 West Maude Avenue, Sunnyvale, California 94085, USA (global parent).

Data processed by capty via the LinkedIn API:

LinkedIn Member URN (pseudonymised identifier) for user authentication
Organisation/Company Page URNs and names where the user holds an administrative role (Administrator, Content Admin, or Direct Sponsored Content Poster)
Access Token (valid 60 days) and Refresh Token (valid 365 days), stored exclusively server-side
Metadata relating to published posts (Post URN, publish time, status)

API permissions (scopes) used: w_member_social (for personal profiles), w_organization_social, r_organization_social (for company pages). Only the data necessary for the publishing function is processed; LinkedIn profile data beyond the URNs required for authentication is not stored.

Data transmitted to LinkedIn when publishing: Post content (text, media URN), author URN (member or organisation), visibility settings, and distribution parameters are transmitted via the LinkedIn Posts API.

Programme and terms: capty uses the LinkedIn API under the LinkedIn API Terms of Use. Prior to a user's first authentication, capty informs users about the purpose of data processing, the categories of data collected, and their right to withdraw — as required by LinkedIn's API Terms (six-element pre-authentication disclosure).

Data deletion and revocation: Access tokens are deleted immediately upon account disconnection or capty account cancellation. Upon request, all previously transferred data is fully deleted within 10 days. Users can also revoke access directly with LinkedIn at any time:

Settings → Data Privacy → Permitted Services

Data processing by LinkedIn: linkedin.com/legal/privacy-policy

11.5 TikTok

The technical connection to TikTok runs through bundle.social; see section 11.2. The following relates to processing by TikTok itself.

Data controller at TikTok:
TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland (for EU/EEA users); TikTok Information Technologies UK Limited, Kaleidoscope, 4 Lindsey Street, London, EC1A 9HP, United Kingdom (for UK users). capty and TikTok act as independent data controllers (controller-to-controller) pursuant to the TikTok Developer Data Sharing Agreement (effective 22 January 2026).

Data processed by capty via the TikTok Content Posting API:

TikTok Open ID (pseudonymised user identifier) and display name
Access Token (valid 24 hours) and Refresh Token (valid 365 days), stored exclusively server-side
Creator information (available privacy levels, comment/duet/stitch permissions) retrieved via API prior to each video upload
Metadata relating to published videos (Video ID, publish time, status)

API permissions (scopes) used: video.publish, video.upload, user.info.basic.

Data transmitted to TikTok when publishing: The video file, caption (max. 2,200 characters), privacy level setting, branded content flags, AI-generated content disclosure (as required by TikTok's Community Guidelines), and comment/duet/stitch settings are transmitted via the TikTok Content Posting API. The privacy level is always actively selected by the user; capty does not pre-set this value.

Programme and terms: capty uses the TikTok API under the TikTok for Developers programme, governed by the TikTok Developer Terms of Service and the TikTok Developer Data Sharing Agreement. The video.publish scope is subject to full App Review by TikTok before content can be posted publicly.

Data deletion and revocation: Access tokens are deleted immediately upon account disconnection or capty account cancellation; capty may also programmatically revoke tokens via TikTok's OAuth revocation endpoint. Users can revoke access directly in the TikTok app at any time:

TikTok app: Profile → Menu → Settings and Privacy → Security → Manage app permissions → [Remove access]

Further information: TikTok Support – Third-Party Apps

tiktok.com/legal/page/eea/privacy-policy/en

12. Payment Processing (Paddle)

We use Paddle.com Market Limited, 30 Old Bailey, London EC4M 7AU, United Kingdom (company number 8172165) for payment processing.

Paddle acts as our Merchant of Record, meaning it is the legal seller and reseller of the subscription. The payment contract is concluded between you and Paddle; Paddle issues the invoice and remits the applicable VAT. In doing so, Paddle does not process payment data on our behalf but as an independent controller within the meaning of the GDPR.

The following data is transmitted to, or collected by, Paddle during payment processing:

Name, email address
Payment information (credit card number, expiry date, CVC)
Billing address, country and company details (including VAT ID where provided)
Transaction amount and plan information

Full card details are processed exclusively by Paddle and its payment providers and never reach our servers. We only process the subscription and billing information we need to perform the contract.

Legal basis: Art. 6(1)(b) GDPR (performance of contract) and Art. 6(1)(c) GDPR (compliance with tax and commercial law obligations). Billing and transaction records subject to tax or commercial law retention obligations are retained for 10 years (§ 147 AO / § 257 HGB).

Paddle is based in the United Kingdom. Transfers there are covered by the European Commission's adequacy decision for the UK, which ensures an adequate level of data protection.

More information: Paddle Privacy Policy and Paddle Buyer Terms.

13. AI-Supported Processing

capty uses one or more AI service providers to deliver and improve the functionality of the Service. Depending on the feature, use case, availability, quality, and technical requirements, capty may use different AI providers and processing infrastructures.

These providers may process submitted content solely for the purpose of providing the requested service to capty. Where required, capty enters into appropriate contractual arrangements with such providers. If personal data is transferred to countries outside the EU or EEA, capty relies on the safeguards provided by applicable data protection law (e.g. SCCs, adequacy decisions), where available and applicable.

capty does not guarantee that any specific AI provider, model, or processing location will be used for a particular request unless explicitly agreed otherwise in writing.

AI provider currently used: Anthropic Ireland, Limited, 6th Floor, South Bank House, Barrow Street, Dublin 4, D04 TR29, Ireland (the "Claude" model family). Anthropic processes the transmitted content as a processor, solely to deliver the requested function. Under Anthropic's commercial terms, content submitted via the API is not used to train AI models. Processing on infrastructure in the United States may occur; such transfers are safeguarded by Standard Contractual Clauses.

Google (video analysis): To analyse uploaded videos we use the Gemini API provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The uploaded video content and the analysis derived from it are transmitted. Google processes this content as a processor, solely to deliver the requested function. Under the terms Google applies in the European Economic Area, content submitted through the API is not used to improve Google products and not used to train models. Processing on infrastructure outside the EU may occur and is safeguarded by Standard Contractual Clauses.

Caption Check: Our free analysis tool at capty.ai/caption-check is available without a user account. The text entered there is transmitted to the AI provider named above in order to produce the platform-specific rewrites. We do not store the text you enter permanently. If you request the results by email, we store only the generated versions until they are sent, for a maximum of 24 hours, after which they are deleted automatically. The legal basis for this is Art. 6(1)(b) GDPR and Art. 6(1)(f) GDPR (legitimate interest in providing the tool).

Legal basis otherwise: Art. 6(1)(b) GDPR (performance of contract).

14. Recipients and Processors

We engage the following service providers in the operation of our website and Platform. Data processing agreements pursuant to Art. 28 GDPR have been concluded, or will be concluded prior to the activation of the respective processing activity:

Provider	Purpose	Role	Location
Hetzner Online GmbH	Storage of uploaded media files (images, video)	Processor	Germany (Nuremberg)
Hostinger International Ltd.	Web hosting; infrastructure for account, post and text data	Processor	EU (Lithuania)
Brevo SAS	Email delivery (newsletter, product emails)	Processor	EU (France)
Paddle.com Market Limited	Payment processing and invoicing (Merchant of Record)	Independent controller	United Kingdom (adequacy decision)
BUNDLE SP. Z O.O. (bundle.social)	Technical integration of TikTok and LinkedIn: account connection, publishing posts and retrieval of the associated statistics	Processor	Poland (EU) as contracting party; production systems in Germany (Hetzner, Frankfurt). Media delivered via Cloudflare globally; further sub-processors partly outside the EEA — Standard Contractual Clauses
Google Ireland Ltd. (Analytics)	Website analytics (consent-based only)	Processor	EU (Ireland) / potentially USA
Anthropic Ireland, Limited	AI-assisted text generation and Caption Check	Processor	EU (Ireland), processing possibly US – SCCs
Google Ireland Limited	AI-assisted analysis of uploaded video (Gemini API)	Processor	EU (Ireland), processing possibly third country – SCCs
Meta Platforms Ireland Limited	Social media API (Facebook, Instagram) — content publishing	Independent controller	EU (Ireland) / USA
LinkedIn Ireland Unlimited Company	Social media API (LinkedIn) — content publishing	Independent controller	EU (Ireland) / USA
TikTok Technology Limited	Social media API (TikTok) — content publishing	Independent controller (controller-to-controller)	EU (Ireland) / international

Should further AI providers be added in future, they will be listed here and disclosed on request at hello@capty.ai.

15. International Data Transfers

Some of our service providers are based outside the European Union (EU) or European Economic Area (EEA), or may access data from third countries. The following safeguards are in place:

Brevo is certified under the EU-US Data Privacy Framework (DPF).
Paddle processes data through its UK entity. Transfers there are covered by the European Commission's adequacy decision for the United Kingdom.
Meta Platforms: Meta Platforms Ireland Limited is designated as the data exporter for EEA transfers. Transfers to the USA are based on Standard Contractual Clauses (Module 1, controller-to-controller, Decision 2021/914) and the EU-US Data Privacy Framework, for which Meta Platforms, Inc. is certified.
LinkedIn: LinkedIn Ireland Unlimited Company processes data primarily within the EU. Transfers to the USA (LinkedIn Corporation) are safeguarded by Standard Contractual Clauses (Module 2, controller-to-processor, pursuant to LinkedIn's Business Development DPA).
TikTok: TikTok Technology Limited (Ireland) acts as the data controller for EU/EEA users. Transfers to third countries are based on Standard Contractual Clauses (Art. 46 GDPR). Note: In May 2025, TikTok was fined €530 million by the Irish DPC for unlawful transfers of EEA user data to China. TikTok has committed to remediation measures (Project Clover). The data processed by capty (API tokens, posting metadata) is structurally distinct from the personal data at issue in that enforcement action; TikTok's own processing as an independent controller is governed solely by TikTok's policies.
Google contracts with us through its Irish entity for the video analysis. Processing outside the EU may occur and is safeguarded by Standard Contractual Clauses.
bundle.social (BUNDLE SP. Z O.O.) provides the technical connection to TikTok and LinkedIn. Our contracting party is established in Poland and therefore within the EU; the transfer to it is not a third-country transfer. Under the data processing agreement the production infrastructure is in Germany (Hetzner, Frankfurt). Individual sub-processors of the provider process outside the EEA: Supabase (authentication, USA), Cloudflare (media delivery, global network) and Resend (email, USA); Google Workspace processes in the EU and the USA. Those transfers rely on Standard Contractual Clauses. The full list is in Annex 1a of the DPA.
Anthropic contracts with us through its Irish entity. Processing on infrastructure in the United States may occur and is safeguarded by Standard Contractual Clauses. Should we engage further AI providers in future, capty will likewise rely on the safeguards provided by applicable law (e.g. SCCs, adequacy decisions).

16. Your Rights as a Data Subject

Under the GDPR, you have the following rights:

Right of access (Art. 15 GDPR): You can request information about your personal data stored by us.
Right to rectification (Art. 16 GDPR): You can request the correction of inaccurate data.
Right to erasure (Art. 17 GDPR): You can request the deletion of your data, provided no legal retention obligations apply.
Right to restriction of processing (Art. 18 GDPR): You can request the restriction of processing of your data.
Right to data portability (Art. 20 GDPR): You can request that we provide your data in a structured, commonly used, and machine-readable format.
Right to object (Art. 21 GDPR): You can object to the processing of your data at any time if processing is based on legitimate interest.
Right to withdraw consent (Art. 7(3) GDPR): You can withdraw consent at any time with effect for the future.
Right to deletion of platform-connected data: You may request deletion of all data processed by capty in connection with your connected social media accounts (tokens, posting metadata) at any time. Deletion will be carried out within 10 days of the request.
Right to lodge a complaint: You have the right to lodge a complaint with a supervisory authority. The supervisory authority responsible for us is: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Postfach 20 04 44, 40102 Düsseldorf, Germany, www.ldi.nrw.de.

To exercise your rights, please contact: hello@capty.ai

No automated decision-making

We do not carry out automated decision-making, including profiling, within the meaning of Art. 22(1) and (4) GDPR. The AI-assisted generation of draft text produces no legal effect and does not similarly significantly affect you; the decision whether to use or publish a suggestion is yours alone.

Provision of your data

Providing your data is neither required by law nor by contract. Certain details are, however, necessary to enter into a contract and use the Service, in particular your email address and login credentials. Without them we cannot provide the Service. Anything beyond that is voluntary, and not providing it puts you at no disadvantage.

17. Retention Periods

We retain personal data only for as long as necessary for the respective processing purpose or as required by applicable law:

Data category	Retention period
Server log files	30 days
Contact data (and legacy waitlist records)	Up to 24 months from collection, or until deletion is requested
Newsletter subscriber data	Until consent is withdrawn; deletion from active lists within 30 days of unsubscribe request
Account and user data	Duration of the contractual relationship + 30-day export window after cancellation
OAuth tokens (Meta, LinkedIn, TikTok)	Duration of the active account connection; deleted immediately upon disconnection or cancellation, within 10 days at the latest
Posting metadata (social media channels)	Duration of the contractual relationship + 30-day export window after cancellation, then deletion. If the customer actively deletes the account: immediate deletion with no export window
Uploaded and generated content	Duration of the contractual relationship + 30-day export window after cancellation, then deletion. If the customer actively deletes the account: immediate deletion with no export window
Billing and payment records	10 years pursuant to § 147 AO / § 257 HGB (German commercial and tax law)

18. Data Processing on Behalf of Customers (DPA)

Where customers process personal data of third parties via the Platform (e.g. employee data, client data), customers act as data controllers and capty acts as data processor. In such cases, the parties are required to conclude a Data Processing Agreement (DPA) pursuant to Art. 28 GDPR. capty provides a standard DPA template, available at capty.ai/legal/dpa/.

19. Changes to this Privacy Policy

We reserve the right to update this privacy policy to reflect changes in legal requirements or changes to our service. The current version is always available on this page. For material changes, we will inform you by email if your email address is available to us.