Privacy Policy

This policy explains how Capstan Labs, Inc. and Capstan Labs AB ("Capstan", "we") handle personal data on our website and in the Capstan product. It's written to be read, so it uses plain words. If something isn't clear, ask us at privacy@capstan.example.

1. Two roles we play

• For our website, sign-up and billing, Capstan decides what's collected and why. We're the controller, and this policy covers it.
• For the data inside your workspace (what your agents read and write, run traces, connected tools), your company decides. Capstan is the processor, and our Data Processing Agreement covers it. If you're a customer of one of our customers, ask that company about their data.

2. What we collect

When you use the website

• Messages you send us: the contact sales form, job applications and emails. We keep what you type, your email address and the page you sent it from.
• Basic server logs: IP address, browser and the page requested, kept for 30 days to keep the site secure.

When you sign up and use Capstan

• Account details: your name, work email, password (stored only as a hash), and your role in the workspace.
• Sign-in details: when and from where you signed in, and the devices you use, so we can spot accounts that aren't yours.
• Product usage: which features you use and how often, so we can improve them. We don't record your screen or keystrokes.
• Billing details: your company's name and address, and the last four digits of a card. Our payment provider holds the full card number; we never see it.

3. Why we use it

• To provide the service and keep your account secure.
• To answer your messages and help you when something goes wrong.
• To send emails about your account: confirmations, approvals, invoices, security notices. You can't turn these off while you have an account.
• To send product news, only if you ticked the box. Every one has an unsubscribe link.
• To improve Capstan, using usage data that's grouped and doesn't identify you.
• To meet legal duties, such as tax records.

In the EU and UK, our legal bases are the contract with you, our legitimate interest in running and securing the service, your consent (for product news), and legal obligations.

4. What we never do

• We never sell or rent personal data.
• We never use personal data or workspace data to train AI models, and our model providers don't either.
• We never use advertising trackers, on the website or in the product.

5. Cookies

The website and the app use only cookies they need to work: keeping you signed in, protecting forms from abuse, and remembering your light or dark theme. None of them track you across other sites, so you won't see a cookie banner. If we ever add analytics that need consent, we'll ask first.

6. Who we share it with

We share personal data only with companies that help us run Capstan, under contracts that hold them to the same standard. They're listed, with what they do and where, on our subprocessors page. We'll also share data if the law requires it, and we'll tell you first unless we're not allowed to.

7. Where it's stored, and for how long

Account data is stored in the United States, or in the EU if your workspace uses EU residency. When data moves between regions, standard contractual clauses protect it.

Data	How long
Account details	While your account exists, then 30 days
Messages to sales and support	2 years from the last reply
Job applications	12 months
Server logs	30 days
Billing records	7 years, as tax law requires

How long we keep run traces and workspace data is set by your plan and listed on our security page.

8. Your rights

Wherever you live, you can ask us to:

• show you the personal data we hold about you, and give you a copy;
• correct it if it's wrong;
• delete it, unless we must keep it by law;
• stop using it for product news, or for anything based on our legitimate interests.

Write to privacy@capstan.example from the address on your account. We'll reply within 30 days, usually much sooner. If you're in the EU or UK and unhappy with our answer, you can complain to your data protection authority. In Sweden that's IMY.

California residents have the same rights under the CCPA. We don't sell or share personal information as the CCPA defines it.

9. Changes

If we change this policy in a way that matters, we'll email account holders before it applies. The date at the top shows the latest version.