Privacy Policy

1. Who We Are

CapraBrand is a product of CapraWorks. This policy explains how we collect, use, and protect your personal information when you use caprabrand.com (“Service”). Full publisher and contact details are set out in our legal notice. This policy is available in English and French; for consumers residing in France, the French version prevails.

2. Data We Collect

Account data: email address (used for authentication via magic link).

Brand data: brand names, taglines, descriptions, colours, fonts, social handles, and uploaded assets that you provide.

Website designs: if you use them, the answers you give (what to show, pictures, feel, town, notes) and the pages drawn are stored with your brand, and deleted with the brand or your account.

Platform credentials: API keys and tokens you enter to connect third-party platforms. They are stored in our database, protected by row-level security so only you can read them, and used solely to publish content on your behalf. Our database provider encrypts stored data at rest; we do not additionally encrypt these values at the column level. You can remove any connection at any time from Settings, which deletes the stored credentials.

Usage data: page views and feature usage collected via CapraLens (our first-party analytics). We do not use third-party tracking pixels or advertising cookies.

Payment data: handled entirely by Stripe. We store your Stripe customer ID and subscription ID but never your card details.

Instant preview data: if you use the free brand preview (/try/shop), we store the business details you type, the generated preview, and — if you enter it to unlock a logo — your email address. We use that email to generate your logo and may follow up once about your preview; it is not added to any newsletter. A salted hash of your IP address (never the raw address) is kept for daily rate limiting.

Client preview data: if you use the free client preview (/try), we fetch the public web page you paste and send its text to Anthropic’s Claude API to draft the sample posts. We do not store the page, the address or the drafts. A salted hash of your IP address (never the raw address) is kept for daily rate limiting, and the size of each AI request is logged for cost tracking.

Preview advisor: if you chat with the AI advisor on the preview page, we keep the conversation for 90 days, so the advisor can follow it and so we can improve CapraBrand, and then delete it. If you ask it to pass your question to a person, we email your question and the conversation to our support team and use the email address you give to reply to you; that address is kept with your preview, like the one above.

3. How We Use Your Data, and Our Lawful Basis

Under the GDPR we must tell you the lawful basis for each purpose. They are:

• Providing the Service (your account, your brands, publishing content you choose to publish) — performance of a contract (Art. 6(1)(b)).
• Processing payments and keeping billing records — performance of a contract and legal obligation (Art. 6(1)(b) and (c)).
• Transactional email (magic links, support replies) — performance of a contract (Art. 6(1)(b)).
• Security, abuse prevention and rate limiting — legitimate interests (Art. 6(1)(f)) in keeping the Service available and secure.
• One follow-up about a brand preview you generated (if you left your email on /try) — legitimate interests (Art. 6(1)(f)). You can object or ask us to delete the preview at any time.
• Answering you in the preview advisor (keeping the conversation for 90 days, and passing your question to a person when you ask) — steps taken at your request before a contract and legitimate interests (Art. 6(1)(b) and (f)) in answering you and improving the Service. You can ask us to delete a conversation at any time.
• Audience measurement (understanding which channels bring people to CapraBrand, see section 8) — legitimate interests (Art. 6(1)(f)). This is first-party only, is never used to profile you or track you across other sites, and you can object at any time.

4. AI Processing

When you use text AI features (social package generator, blog drafting, SEO schema, taglines, audience recommendations, the preview advisor, the client preview), your brand data — and, for the advisor, your messages — is sent to Anthropic’s Claude API for processing. When you generate images (logos, banners, social images, website designs), the image prompt — which includes your business name, brand descriptors and, for a website design, the answers you give — is sent to OpenAI’s image API. Neither Anthropic nor OpenAI uses API inputs to train their models. Generated content is returned to you and is not retained by either provider to build their models.

5. Data Sharing

We do not sell your data. We share data only with:

• Supabase — database hosting and authentication (EU region)
• Stripe — payment processing
• Anthropic — AI text generation (when you use AI features)
• OpenAI — AI image generation (when you generate images)
• Vercel — application hosting
• Resend — sending our emails (including preview-advisor questions passed to our support team)
• Google — Google Workspace, the mailbox our letters to businesses are sent from (see section 9b)
• Microsoft — Microsoft 365, our support mailbox (support@caprabrand.com), where replies to those letters arrive
• Third-party platforms — only the content you explicitly choose to publish

5b. International Transfers

Your data is stored in the EU (Supabase, EU region). Some of the processors listed above are established in the United States — Stripe, Anthropic, OpenAI, Vercel, Resend, Google and Microsoft. Where personal data is transferred to them outside the EEA, those transfers rely on the European Commission’s Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework. You may request further information about these safeguards using the contact details below.

6. Data Storage & Security

Your data is stored in Supabase (PostgreSQL, EU West region) with row-level security policies, and is encrypted at rest by our database provider. All connections use TLS. API tokens you generate for our own API are hashed with SHA-256 and never stored in plaintext — we cannot read them back, only verify them. Credentials for third-party platforms are stored so we can publish on your behalf, and are not additionally encrypted at the column level.

7. Your Rights

You can: access and export your data at any time via the dashboard; update or correct your information; delete your account and all associated data by contacting support. Under the GDPR you also have the rights to data portability, to restrict or object to processing carried out on the basis of our legitimate interests, and to withdraw consent where processing relies on it.

You have the right to lodge a complaint with a supervisory authority. Our lead authority is the Commission Nationale de l'Informatique et des Libertés (CNIL) — https://www.cnil.fr. You may also complain to the authority in your own country of residence.

8. Cookies

We use first-party cookies only. We do not use advertising cookies, and we do not track you across other websites.

• Authentication — Supabase session cookies that keep you signed in. Strictly necessary.
• cb_brand — remembers which brand you last had selected. Strictly necessary.
• caprabrand-language — remembers your language choice.
• caprabrand-theme — remembers light or dark mode.
• cb_attr — audience measurement. On your first visit only, this records how you arrived: any campaign tag in the link (utm_*) and the website that referred you. It stores the referring site’s domain name and the page you landed on. It does not store your IP address, does not build a profile, is never combined with data from other sites, and is never shared with or sold to anyone. We use it solely to understand which channels bring people to CapraBrand. It expires after 180 days.

9. Data Retention

We retain your data for as long as your account is active. When you delete your account, all personal data and brand content is permanently deleted within 30 days. Conversations with the preview advisor are deleted after 90 days. Anonymised usage statistics may be retained indefinitely.

9b. Businesses We Write To

CapraBrand writes to businesses that may need it — mostly small businesses and agencies in France — to offer the service. This section is for them, whether or not we have written to you yet.

What we hold, and where it comes from. The business’s name, registration number (the SIREN in France, the company number in the UK), activity code, town and address, from the public business register (INSEE’s SIRENE, through the French government’s company API) and OpenStreetMap. From the business’s own website, its OpenStreetMap entry, or another page where it publishes its contact details: its web address, the email address and phone number it publishes, the social accounts it links to, and the text of its public page. If we write to you: our letter, whether it was delivered, and your reply. When our letter links to our preview page, the link carries the address of your business’s own website, so that the page opens with it already filled in; like every address visited on our site, it is recorded in the request logs of our host, Vercel, which keeps them for a limited period.

Why, and on what basis. To offer CapraBrand to businesses it is relevant to — our legitimate interest (Art. 6(1)(f) of the GDPR and of the UK GDPR). We write only to addresses a business publishes for its work, and every letter tells you how to stop us. The text of your public page may be read by Anthropic’s Claude API to judge whether our offer fits you; Anthropic does not use it to train its models.

Who handles it for us. Supabase (our database, EU region), Vercel (hosting), Google Workspace and Microsoft 365 (the mailboxes our letters leave from and your replies reach), Resend (our earlier letters), and Anthropic, as above.

How long we keep it. Three years after the latest of: when we found the business, our last letter to it, and its last reply. Then it is deleted, and so is the content of our letters to it. If you asked us not to write again — or your address bounced, or you marked a letter as spam — we keep only your registration number, the address, the domain, and the reason with its date, so that we never write to you again. Working copies on our own computers are deleted after 90 days; our mailboxes keep letters and replies for three years; our own internal notes that mention your business are deleted three years after they were recorded. Backups and logs at the providers above are erased on their own schedules.

Your choices. Reply “STOP” to any of our letters, or write to support@caprabrand.com, and we will not write to you again. You can also ask to see, correct or delete what we hold about your business, and complain to the CNIL (cnil.fr).

Lists our customers make. Businesses our customers save in their own Prospect Finder lists are kept under the same three-year rule. A customer who writes to a business is responsible for that message.

10. Changes

We may update this policy from time to time. Material changes will be communicated via email. The “Last updated” date at the top reflects the most recent revision.

11. Contact

For privacy questions or data requests, contact support@capraworks.com.