Capable — Privacy Policy

Effective date: 2026-10-19 · Version: 1.13

Updated 2026-10-19 (v1.13): specified the synchronized LinkedIn messages, chats, attendees and attachments Unipile stores, independently of Capable’s local selections; described the existing owner-scoped local export and targeted-erasure workflow and its limits; clarified the vendor-stated routing and residual-retention limits (Sections 3, 4.7, 8 and 9). This notice update does not add a provider or change account access, sign-in or data flows.

Updated 2026-10-17 (v1.12): stated the six-month retention of recording video and audio (Sections 4.2 and 9); described soft-deletion retention precisely (Section 9); corrected the connection-secret description: a connected LinkedIn account's session is held by the provider and Capable stores an account identifier, not the credential (Section 10). No data flow changed.

Updated 2026-10-16 (v1.11): clarified Unipile’s processing of connected LinkedIn history, selected imports into Capable, owner-reviewed sharing to CRM notes, and provider locations (Sections 3, 4.7, 8 and 9). This clarification does not enable additional LinkedIn features.

Updated 2026-10-15 (v1.10): the LinkedIn extension recognizes contacts and controls tracking without text entry; exact provider-reported emails from a verified profile can link an existing workspace contact or populate a new contact under the conditions in Section 4.7.

Updated 2026-10-07 (v1.9): an Authorized User can share one recorded call with a person outside the workspace through a private link that expires and can be turned off; the recipient's email address and when the link was played are kept with the recording (Section 4.2).

Updated 2026-10-02 (v1.8): if you accepted analytics on our website and then sign up from a link there, we link those website visits to your account, and we record the campaign a new account arrived from (Section 6).

Updated 2026-10-01 (v1.7): after you sign up we send you onboarding emails, starting with a welcome email. They are sent through PostHog, which holds your email address and first name for that purpose, and each has an unsubscribe link (Sections 3, 5, 6 and the sub-processor list).

Updated 2026-09-30 (v1.6): clarified WorkOS's United States processing for enterprise single sign-on and directory sync, and the applicable transfer safeguards (Section 8 and the sub-processor list).

Updated 2026-09-30: this version describes sign-in with a one-time email code and enterprise single sign-on (Sections 3 and 10); the meeting recorder's default-on posture and its pre-meeting notice with one-click opt-out (Section 4.2); files uploaded to records (Section 4.2a); meeting scheduling and public booking pages (Section 4.2b); the LinkedIn integration beta (Section 4.7); product events sent by your own systems (Section 4.8); the calendar write scope used for scheduling (Sections 4.1 and 4.1a); Stripe as our live payment processor and WorkOS and Unipile as sub-processors (Section 7); retention for the new data types and read-only access after a trial ends or a subscription lapses (Section 9).

Clarified 2026-09-19: supported user-connected assistants include Claude, ChatGPT, and Codex. Authorized MCP responses disclose the requested data to the connected provider; provider terms and account settings govern its processing. See Section 4.4.

Updated 2026-07-20: you can now connect any IMAP mailbox (for example Fastmail, iCloud, Yahoo, or a company mail server) as an alternative to Google or Microsoft. Because IMAP has no sign-in flow, you connect it by entering your mailbox server and a password (ideally a revocable, provider-issued app-specific password), which we store encrypted at rest under a dedicated key. The connected mail (your Inbox and Sent folder) follows the same posture as Google/Microsoft — email content stored encrypted at rest, access-controlled, returned to connected AI assistants only on authorized requests, and deleted with the related activity. IMAP is mail-only (no calendar), and a direct IMAP connection adds no new sub-processor. See Sections 3, 4.1b, and 10.

Updated 2026-07-08: you can now sign in with Microsoft (Entra ID) as well as Google, and — on your authorisation — Capable connects your Outlook (Microsoft 365) mail and calendar to power the CRM. The connected Microsoft data follows the same posture as Google (email content and calendar agendas stored encrypted at rest, access-controlled, returned to connected AI assistants only on authorized requests, and deleted with the related activity). See Sections 3, 4.1a, and 4.6.

Updated 2026-06-26: email message content and calendar meeting agendas (event descriptions) are now stored at rest to power in-app reading and search — encrypted, access-controlled, returned to connected AI assistants only on authorized requests, and deleted with the related activity. See Sections 4.1 and 4.4.

This Privacy Policy explains how Capable Agents AB ("Capable", "we", "us", "our") handles personal data in connection with our website and our AI-native CRM service (the "Services"). It applies to visitors to our website and to the people whose personal data we process in operating the Services.

Capitalised terms not defined here have the meaning given in our Terms of Service.

1. Who we are

Capable is a limited liability company (aktiebolag) incorporated in Sweden, with organisationsnummer 559504-0444 and VAT number SE559504044401, registered office at Bäckaskiftsvägen 68, 122 42 Enskede, Sweden.

• Privacy contact / data protection point of contact: hello@capable.run.
• UK GDPR Article 27 representative: Not applicable. Capable does not currently offer the Services to, or monitor the behaviour of, data subjects in the United Kingdom, and so is not required to designate a representative under Article 27 of the UK GDPR. A UK representative will be appointed before onboarding any UK customer.

We are established in the European Union. Accordingly, we are not required to designate an EU Article 27 representative. We do not currently target or monitor data subjects in the United Kingdom; if and when we do, we will appoint a UK Article 27 representative and update this Policy.

2. Scope and our two roles

We act in two distinct roles, and the legal framing differs by role:

• Controller. For personal data relating to our own relationship with you — account and identity data, billing and contact details, website-visitor and product-usage data, and support communications — we are the controller and this Privacy Policy is our notice to you under Articles 13 and 14 GDPR.
• Processor. For Customer Data that a customer's Authorized Users submit to or generate in the Services (CRM accounts, contacts, opportunities, notes, tasks, touches, transcripts, uploaded files, connected Google, Microsoft, IMAP, and LinkedIn data, and product events sent by the customer's own systems, as described below), we act as a processor on the customer's behalf. The customer is the controller and decides why and how that data is processed. Our processing of Customer Data is governed by our Data Processing Agreement ("DPA"). If you are an individual whose data appears in a customer's CRM, please direct privacy requests to that customer (the controller); we will assist them as their processor.

3. Categories of personal data we process

As controller (our own relationship with you)

As processor (Customer Data we process on a customer's behalf)

We do not intentionally process special categories of personal data as a controller, and customers must not place special-category data in the Services except in compliance with the Acceptable Use Policy and applicable law.

4. How specific data flows work

4.1 Connected Google data — email content + calendar agendas stored securely

When an Authorized User signs in with Google, Capable requests scopes to (a) authenticate the user, (b) read Gmail data, and (c) read and write limited Calendar data. We use this connected data, on the customer's instruction, to populate the CRM with accounts, contacts, and touches, to let the AI assistant help with email content, and to support meeting scheduling.

• Gmail: we request the gmail.readonly scope. The automatic inbox import that populates your CRM reads message header metadata (such as From, To, Cc, Date, Subject, and List-Unsubscribe) and stores accounts, contacts, and activity. As Capable keeps your CRM up to date, it also reads and stores the readable content of your emails so you can view and search your correspondence inside the app. Email content is stored encrypted at rest and is access-controlled to your workspace. When you ask a connected AI assistant to summarize, extract from, or draft a reply using stored content, Capable returns the requested content to that assistant provider as described in Section 4.4. You can delete stored email content at any time: deleting the related activity in Capable purges the stored content, and it is also removed when your account data is deleted (see Section 9).
• Calendar: we request read access (calendar.readonly) and the calendar.events scope, which we use only to create, move, and cancel the meeting holds and invitations you schedule through Capable. We read event titles, attendees, and start/end times (duration), and — only to recover a meeting join link — we may scan an event for a join URL. We also read and store the event description (the meeting agenda) on the corresponding activity so you (and the AI assistant acting in your own session) can see what a meeting was about; before storage we scrub obvious join credentials (such as passcodes and dial-in PINs) from the description. Stored agendas are encrypted at rest, access-controlled to your workspace, and returned to connected AI assistants only on authorized requests, and are purged when the related activity is deleted (see Section 9). We never persist calendar event locations or attachments.

Connected Google data is used to identify business relationships, file activity to the right records, and assist you with your own email. We do not sell it or use it for advertising, and disclose it to a connected AI assistant only through authorized MCP requests as described in Section 4.4. Google OAuth refresh tokens are stored encrypted.

4.1a Connected Microsoft data — email content + calendar agendas stored securely

When an Authorized User signs in with Microsoft (Microsoft Entra ID / Azure AD), Capable can, on the customer's authorisation, connect the user's Outlook (Microsoft 365) mailbox and calendar through Microsoft Graph to power the CRM in exactly the same way Google does. The posture is identical by design to Connected Google data (Section 4.1).

• Outlook mail: we request the Microsoft Graph Mail.Read scope (read-only access to the signed-in user's own mailbox). The automatic inbox import that populates your CRM reads message header metadata (such as From, To, Cc, Date, and Subject) and stores accounts, contacts, and activity. As Capable keeps your CRM up to date, it also reads and stores the readable content of your Outlook emails so you can view and search your correspondence inside the app. Email content is stored encrypted at rest and is access-controlled to your workspace. When you ask a connected AI assistant to summarize, extract from, or draft a reply using stored content, Capable returns the requested content to that assistant provider as described in Section 4.4. You can delete stored email content at any time: deleting the related activity in Capable purges the stored content, and it is also removed when your account data is deleted (see Section 9).
• Outlook calendar: we request the Microsoft Graph Calendars.Read scope for reading, and Calendars.ReadWrite, which we use only to create, move, and cancel the meeting holds and invitations you schedule through Capable. We read event titles, attendees, and start/end times (duration), and we also read and store the event description (the meeting agenda) on the corresponding activity so you (and the AI assistant acting in your own session) can see what a meeting was about; before storage we scrub obvious join credentials (such as passcodes and dial-in PINs) from the description. Stored agendas are encrypted at rest, access-controlled to your workspace, and returned to connected AI assistants only on authorized requests, and are purged when the related activity is deleted (see Section 9). We never persist calendar event locations or attachments.

Connected Microsoft data is used to identify business relationships, file activity to the right records, and assist you with your own email. We do not sell it or use it for advertising, and disclose it to a connected AI assistant only through authorized MCP requests as described in Section 4.4. Microsoft OAuth refresh tokens are stored encrypted with a separate key from Google's, so a compromise of one provider's key does not affect the other.

4.1b Connected IMAP mailbox data — mail content stored securely

If your email is not hosted by Google or Microsoft, you can connect any IMAP mailbox (for example Fastmail, iCloud, Yahoo, Zoho, or a company mail server) as an alternative source. IMAP is an open mail-access protocol with no sign-in / OAuth flow, so — unlike Google/Microsoft — you connect it by entering your mail server details and a mailbox password. We strongly recommend using a provider-issued app-specific password (revocable, scoped to mail access) rather than your primary login password.

• The mailbox credential is stored encrypted at rest using AES-256-GCM under a dedicated key (separate from the Google and Microsoft keys, so a compromise of one provider's key does not affect another). It is never written to logs, never returned to your browser after you enter it, and is used only to read your mail on your instruction. Connections are always made over TLS.
• Mail we read + store: we read your Inbox and your Sent folder (reading Sent is what lets Capable recognise the companies you have emailed). We read message header metadata (such as From, To, Cc, Date, and Subject) and store accounts, contacts, and activity, and we read and store the readable content of those emails so you can view and search your correspondence inside the app. Email content is stored encrypted at rest, access-controlled to your workspace, returned to a connected AI assistant only on an authorized request (Section 4.4), and deleted when you delete the related activity or your account data (Section 9).
• Mail-only. IMAP carries no calendar data, so a mailbox-only connection does not power meeting import, the meeting recorder, or in-app scheduling.
• No new sub-processor. A direct IMAP connection is made from Capable to your own mail provider's server; that provider is your mail host, not a sub-processor of Capable. The connected data is processed by the same sub-processors that run the rest of the Services (hosting, storage, background jobs) — see legal/subprocessors.md.
• Disconnecting. You can disconnect the mailbox at any time in Settings → You, which deletes the stored credential and its sync state. Because there is no server-side token to revoke for a password, you should also revoke the app-specific password in your own mail provider's settings.

4.2 Meeting recorder

The meeting recorder is a bot provided by Recall.ai that joins video calls (Zoom, Google Meet, Microsoft Teams, Webex), records them, and has the recording transcribed using Deepgram speech-to-text (routed through Recall). The resulting transcript and recording link are stored as a meeting touch on the relevant CRM record, and the recording can be played from the record.

• On by default, for customer calls only. New workspaces start with the recorder on; a workspace admin can switch it off at any time. The recorder joins automatically only meetings with at least one attendee from outside the workspace's organisation. Internal-only meetings are never recorded automatically. An Authorized User can also ask Capable to record a specific call.
• Notice in the meeting. The bot is named, appears in the participant list, and posts a notice in the meeting chat that the call is being recorded.
• Notice before the meeting, with one-click opt-out. One hour before a meeting the recorder is booked for, every external attendee receives an email from "{host} via Capable" (reply-to the host) saying that the meeting will be recorded and transcribed for meeting notes, with one button: Don't record this meeting. Clicking it cancels the recording — only the recording, never the meeting — and tells the host. The opt-out (the attendee's email and the meeting) is stored so it continues to be honoured. A workspace admin can switch these notices off.
• Who sees recordings. Transcripts and recordings are workspace data: visible to the workspace's Authorized Users under its roles, returned to a connected AI assistant only on an authorized request (Section 4.4), and deleted with the related activity. Video and audio are kept for six months after the call and then deleted; the transcript remains with the activity.
• Sharing a recording outside the workspace. An Authorized User who can edit a call may share that one recording with people outside the workspace — typically someone who was on the call and asked for it. Each person gets a private link, either emailed from "{user} via Capable" (reply-to the user) or copied by the user to send themselves. The link opens a page that plays the recording and, unless the user excludes it, its transcript; it shows the meeting's title and time and who shared it, and nothing else from the workspace. Every link expires (14 days unless the user chooses between 1 and 90), can be turned off at any time, and stops working when the call is deleted. We keep, with the recording, the recipient's email address, when the link was created, expires and was turned off, and how many times and when it was played; we store only a fingerprint of the link itself, never the recording's media. These records are deleted with the recording. Deciding to share a recording, and with whom, is the customer's choice as controller.

Recording and transcription are processor activities performed on the customer's behalf and under the customer's control of who and what is recorded. The built-in notices assist customers, but customers remain responsible for obtaining any consents required for recording in the relevant jurisdictions.

4.2a Uploaded files

Authorized Users can attach files (for example a contract or a slide deck) to any record. Uploaded files are stored in a private storage bucket, encrypted at rest, and downloadable only by the workspace's Authorized Users through short-lived signed links. No AI assistant or automated process reads the contents of uploaded files — they are stored and displayed for humans. Deleting an attachment, or the record it belongs to, removes the stored file immediately.

4.2b Meeting scheduling and public booking pages

On an Authorized User's instruction, a connected AI assistant can find times, and Capable then creates meeting holds and invitations on that user's connected Google or Microsoft calendar; the invitation is sent from the user's own calendar, not by Capable. An Authorized User can also switch on a personal booking page (a public link). A guest who opens it sees the host's availability, enters their name and email, and books a time; Capable creates the calendar event and records the guest as a contact in the host's workspace. A booking never creates an account (company) record by itself.

4.3 Company facts (domain-level, not individuals)

To enrich an account, we look up public, company-level facts by domain — for example industry, headquarters, employee count, founding year, logo, and brand colour — using Brandfetch and Logo.dev, cached across workspaces in a domain-facts cache. This enrichment operates at the company/domain level only; we do not perform per-person or per-contact enrichment.

4.4 How connected AI assistants process data

Capable does not operate a server-side large language model or make server-side model inference requests on your behalf. Authorized Users can connect supported AI assistants through MCP (Model Context Protocol), including Anthropic's Claude and OpenAI's ChatGPT and Codex, using their own provider accounts. On an authorized request, Capable returns the requested, permitted Customer Data to the connected assistant and can perform permitted CRM actions. Data returned through MCP is disclosed to and processed by the connected assistant provider under the agreement, account type, and settings applicable to the Authorized User or their organisation. Users and workspace administrators control these connections and can revoke access.

Returned data can include CRM records, notes, reports, correspondence, and meeting content when permitted by the connection and requested by the user. Capable does not use Customer Data to train AI models. The connected provider's retention and model-improvement rules depend on its terms, account type, and settings; connecting through MCP does not by itself disable those uses. Review your provider's OpenAI data controls or Anthropic privacy controls before connecting sensitive workspace data. Disconnecting prevents future access through that connection; handling of data already returned remains subject to the provider's terms and controls.

4.5 Google API Services User Data Policy — Limited Use

Capable's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• Use is limited to user-facing features. Google user data is used only to provide and improve the user-facing features Capable offers — namely signing the user in, surfacing the user's own email and calendar data into their CRM (including storing email content so the user can read and search it), and helping the user summarize, extract, or draft (see Section 4.1). We do not use it for any other purpose.
• No advertising. Google user data is not used for advertising or for any advertising purpose.
• No selling or unrelated transfer. Google user data is not sold and is not transferred to others, except as necessary to provide or improve these user-facing features, to comply with applicable law, or as part of a merger, acquisition, or sale of assets (with notice to affected users).
• No AI/ML model training. Google user data is not used to develop, improve, or train generalized or non-personalized artificial intelligence and/or machine learning models. Capable does not use this data for model training. Authorized disclosures to connected assistants are described in Section 4.4; users must choose provider terms and settings consistent with these use limits.
• No human reading. Humans do not read Google user data unless (a) the user gives affirmative consent to view specific data (for example, for support); (b) it is necessary for security purposes (such as investigating abuse), or to comply with applicable law; or (c) the data is aggregated and anonymized and used to improve the Services.

Consistent with the scope limits in Section 4.1, the Google data we store is Gmail header metadata, Gmail message content (the readable text of your emails, stored encrypted at rest and access-controlled to your workspace so you can read and search it — returned to connected AI assistants only on authorized requests, and deleted when you delete the related activity or your account data), and the Calendar metadata above (titles, attendees, duration, and a meeting join URL) plus the event description (the meeting agenda) stored on the corresponding activity, scrubbed of obvious join credentials, encrypted at rest, returned to connected AI assistants only on authorized requests, and deleted with the related activity (never event locations or attachments).

4.6 Microsoft Graph data — use limits

Our use of data obtained through Microsoft Graph (Outlook mail and calendar) is subject to the same commitments as Connected Google data, and to Microsoft's applicable API terms. Specifically:

• Use is limited to user-facing features. Microsoft Graph data is used only to provide the user-facing features Capable offers — signing the user in, surfacing the user's own Outlook mail and calendar data into their CRM (including storing email content so the user can read and search it), and helping the user summarize, extract, or draft (see Section 4.1a). We do not use it for any other purpose.
• No advertising. Microsoft Graph data is not used for advertising or for any advertising purpose.
• No selling or unrelated transfer. Microsoft Graph data is not sold and is not transferred to others, except as necessary to provide these user-facing features, to comply with applicable law, or as part of a merger, acquisition, or sale of assets (with notice to affected users).
• No AI/ML model training. Microsoft Graph data is not used to develop, improve, or train generalized or non-personalized artificial intelligence and/or machine learning models. Capable does not use this data for model training. Authorized disclosures to connected assistants are described in Section 4.4; users must choose provider terms and settings consistent with these use limits.
• No human reading. Humans do not read Microsoft Graph data except on the same limited grounds as Section 4.5 (affirmative user consent for specific data, security/legal necessity, or aggregated-and-anonymized improvement of the Services).

We request Microsoft Graph permissions on a delegated, least-privilege basis for the signed-in user's own mailbox and calendar. The Microsoft data we store is Outlook mail header metadata, Outlook mail message content (stored encrypted at rest, access-controlled, returned to connected AI assistants only on authorized requests, and deleted with the related activity or your account data), and calendar event metadata (titles, attendees, duration) plus the event description (the meeting agenda) stored on the corresponding activity — scrubbed of obvious join credentials, encrypted at rest, returned to connected AI assistants only on authorized requests, and deleted with the related activity (never event locations or attachments).

4.7 Connected LinkedIn data (beta)

Where Capable has enabled it for a workspace, an Authorized User can install the Capable for LinkedIn browser extension and, separately, connect their own LinkedIn account so that selected conversations are synced into Capable. The transport for conversation sync is provided by Unipile (a sub-processor — see legal/subprocessors.md); the user approves their existing LinkedIn session through the provider, and Capable never receives LinkedIn passwords or session cookies.

• Provider processing and selected imports. Connecting requests full message-history synchronization at Unipile. Unipile states that it stores all synchronized V1 messages, chats, attendees and attachments until connected-account deletion, including history beyond the conversations selected for import into Capable. Capable discovers private conversation and participant metadata so the owner can choose conversations. Dedicated message-body imports into Capable require the owner's selection and a linked, live CRM contact. These local selection controls do not limit the provider's account-level synchronization.
• Private to the connecting user. Imported conversations, their messages, and their participants are visible only to the connecting user and named teammates that user explicitly grants access. Admins and managers have no override. Private conversations are excluded from shared timelines, global search, summaries and caches, and are returned to a connected AI assistant only through an authorized private read.
• A separate choice to publish a CRM note. The owner can review one message, its destination contact and the shared visibility, then explicitly confirm saving it as a CRM note. That note follows ordinary CRM permissions and may be read by permitted teammates or their connected assistants. Revoking a private conversation grant or removing private history does not retract that independently published note; it must be managed separately.
• Contact-first controls. Turning sync off stops local message imports and keeps retained history; removing a conversation's history deletes its retained messages and grants; unlinking or deleting its contact turns sync off. Disconnecting stops local imports and requests deletion of the connected provider account while retaining local history. Deleting all imported history or removing the owner from the workspace deletes the local connection and private content and queues provider-account deletion. These controls do not delete original messages at LinkedIn or independently published CRM notes.
• Local data-rights review. Capable provides an authenticated owner-scoped workflow to export retained local private conversation data for review and to confirm erasure of specifically selected local messages and, where chosen, associated participant metadata. The review must follow the customer controller's instructions and protect other participants' information before disclosure. Selected erased messages are prevented from returning through local replay; this does not erase original LinkedIn messages, separately published CRM notes or all data held by Unipile. Provider-held data and any retained exceptions require separate handling.
• Contact recognition. With the connecting user's LinkedIn connection and the workspace feature enabled, Capable can verify the exact profile through Unipile and compare provider-reported emails with existing workspace contacts, including contacts collected from email. A unique verified match can attach the LinkedIn profile to the existing contact without changing its other details. Provider emails are used on the server for matching and are not sent to the extension as matching evidence. Linking preserves the existing contact’s email; creating a new contact from a verified profile with one usable email can save that email on the new CRM record. Conflicting identities do not auto-link.
• Nothing is sent. Capable never sends LinkedIn messages. The extension shows contact and tracking status beside a profile or a one-to-one conversation, automatically checks existing contacts and lets the user save or link a contact and turn tracking on or off without typing. Earlier extension versions also offered manual notes and follow-ups. The extension does not read message bodies from the LinkedIn page, does not collect profiles in bulk, and stores no general browsing-history log.
• The extension's own data handling, including its compliance with the Chrome Web Store User Data Policy and its Limited Use requirements, is described in the LinkedIn extension privacy supplement at https://crm.capable.run/guides/linkedin-extension/privacy, which takes precedence over this Policy for the extension.

4.8 Product events sent by your own systems (inbound capture)

Where enabled for a workspace, a customer's own product or backend can send its sign-up and usage events to Capable through a send-only API key (an industry-standard identify / group / track format). Capable reduces each event to a strict, bounded set of fields before storing it — unknown fields are dropped and property counts are capped — and then applies it through the same governed write path as every other change:

• a person with a verified email becomes a contact (an existing contact is matched, and a machine source never overwrites what a human recorded);
• only the events an admin selects are recorded on that person;
• an organisation is suggested for a human to confirm as an account, unless the admin has named specific milestone events from a backend source that may create the account automatically;
• capture never creates leads, opportunities, or tasks, and never edits or removes anything.

The identity ledger keeps only the product's identifiers, email, verification state, and organisation name. A receipt's message content is cleared as soon as it is processed, and receipt records are purged after 180 days. A hashed suppression keeps an erased person erased even if the product sends them again. The key can never read data. The customer's own systems are the source of these events and are not sub-processors of Capable; the customer is responsible for the lawful basis of the personal data it sends.

5. Purposes and legal bases (controller processing)

Where we rely on legitimate interests, you have the right to object (see Section 11).

6. Cookies and analytics

The logged-in app is cookieless by design. In-product analytics uses PostHog (EU-hosted) initialised with in-memory persistence — it sets no analytics cookie and uses no local storage. We process metadata-minimized usage signals on the basis of legitimate interests (a first-party, cookieless, metadata-only analysis of authenticated product use, with a one-click opt-out). Identity for analytics comes from your authenticated session, not from a cookie. Session-replay and autocapture are aggressively masked because the app renders Customer Data.

• Opt-out: every Authorized User can opt out of product analytics at Settings → You. The preference is stored server-side (cookieless) so it persists across sessions and devices.
• Onboarding emails: when you sign up, our server tells PostHog that you signed up, and PostHog sends you a welcome email from us. To address it, PostHog keeps your email address and first name on your analytics profile. Every onboarding email has an unsubscribe link. If you have opted out of product analytics, the sign-up event is not sent and no welcome email is triggered.
• Linking your website visits to your account: if you accepted analytics on our marketing website and then sign up or sign in from a link there, the link carries your website analytics identifier, and our server tells PostHog that the website visitor and your account are the same person, so we can see which pages and campaigns lead to sign-ups. A link into the app may also carry campaign tags (for example "linkedin"); for a new account we record them as the campaign you arrived from. Nothing is added to the link if you declined analytics on the website, and nothing is linked if you have opted out of product analytics.
• Consent record: we keep a durable, metadata-only consent record (a consent_events log) of analytics decisions, stamped with our current consent policy version. This record never contains Customer Data.
• Marketing website cookies: our separate marketing website uses essential cookies and, subject to a consent banner there, analytics cookies. Those are described in our Cookie Policy. There is no cookie banner inside the logged-in app because the app is cookieless.

7. Sharing and sub-processors

We share personal data only as needed to run the Services and our business:

• Sub-processors that process Customer Data on our behalf — for example our hosting, storage, email-delivery, error-monitoring, and analytics providers. The current list, with purpose and location, is at legal/subprocessors.md.
• Service providers that support our own operations as controller (e.g. payment processing and tax calculation via Stripe, and enterprise single sign-on and directory sync via WorkOS).
• Professional advisers, auditors, and authorities where required by law or to establish, exercise, or defend legal claims.
• Corporate transactions — in connection with a merger, acquisition, financing, or sale of assets, subject to appropriate confidentiality and this Privacy Policy.

We do not sell personal data and do not share it for cross-context behavioural advertising (see Section 11.3). For disclosures to user-connected AI assistants, see Section 4.4 and the sub-processor list.

8. International transfers

We are established in the EU and store Customer Data primarily in the European Union, including our primary database and Supabase-managed authentication and session storage. Enterprise single sign-on and directory sync through WorkOS process identity, organisation and directory data in the United States, including primary and backup hosting, where those features are enabled. WorkOS's Data Processing Addendum includes EU SCCs for these transfers, with Module Two where Capable acts as controller and Module Three where Capable acts as processor for a customer. See the sub-processor list for the data categories and purposes.

Some sub-processors process data outside the European Economic Area. Where we transfer personal data to a country that has not received an EU adequacy decision, Capable acts as the data exporter and we rely on appropriate safeguards under Chapter V GDPR, in particular:

• the Standard Contractual Clauses (EU SCCs) adopted by the European Commission;
• the UK International Data Transfer Addendum to the EU SCCs for transfers subject to UK GDPR; and
• the Swiss addendum for transfers subject to the Swiss Federal Act on Data Protection,

together with supplementary technical and organisational measures where appropriate. You can ask us for more information about the safeguards in place using the contact details in Section 14.

For connected LinkedIn accounts, Unipile identifies hosting in France and onward proxy/support processing that may occur in Israel, the United States or Singapore depending on the service and configuration. Its revised DPA, Annex 1, identifies the hosting, optional proxy and support providers and their stated transfer mechanisms. That inventory does not establish which optional routes are used for a particular connected account. France hosting alone does not mean all processing remains in the EU. See the sub-processor list.

9. Retention

• Customer Data is retained for as long as the customer's account is active and then handled in accordance with the Terms of Service and DPA: a 30-day post-termination export window, after which Customer Data is deleted or returned, subject to our soft-deletion model and backup cycles and to any retention required by law.
• We use soft deletion across the Services: a soft-deleted record is removed from active use and stays recoverable until it is purged with the related workspace or account data, on a deletion request, or by a scheduled purge once we set one. Meeting recordings are different: video and audio are deleted six months after the call, while the transcript remains until the related activity is deleted.
• Uploaded files are removed from storage immediately when the attachment or its record is deleted.
• Recording opt-outs are kept so that an attendee's choice not to be recorded continues to be honoured.
• Product events (capture): a receipt's message content is cleared as soon as it is processed, and receipt records are purged after 180 days; the identity ledger keeps only the product's identifiers, email, verification state, and organisation name, and a hashed suppression keeps an erased person erased.
• LinkedIn conversations (beta): local retained history remains when sync is turned off or the account is disconnected. Removing a conversation's history deletes its messages and grants; deleting all imported history or removing the owner deletes the local connection and private content. Independently published CRM notes follow the normal CRM retention and deletion rules. Provider-account deletion is requested on disconnection and full connection teardown and is retried if unavailable. Unipile states that synchronized V1 messages, chats, attendees and attachments remain stored until connected-account deletion; a local pause or selected local erasure does not delete that provider-held history. A successful provider deletion response does not establish that every residual log or backup copy has expired.
• Read-only, not deleted: when a trial ends without a subscription, or a subscription lapses, the Workspace becomes read-only and its data stays visible and exportable; nothing is deleted on entering read-only mode.
• Backups (including point-in-time recovery) are retained for a limited rolling window and then expire; data deleted from production is removed from backups as those backups age out.
• Account and billing records we hold as controller are retained for the life of the relationship and for the period required by applicable tax and accounting law (in Sweden, generally up to seven years for accounting records).
• Usage and consent logs are retained in metadata-minimized form for as long as needed for the purposes described, then deleted or aggregated.

We will delete or anonymise personal data when it is no longer needed for the purposes for which it was collected, unless a longer retention period is required or permitted by law.

10. Security

We build to SOC 2 principles (we are not yet SOC 2 certified) and apply technical and organisational measures appropriate to the risk, including: encryption in transit (HTTPS) and at rest; least-privilege access with sign-in only through Google, Microsoft, enterprise single sign-on, or a one-time email code fenced to existing users and invitees (no passwords); documented access controls; audit logging from day one; backups with point-in-time recovery and a disaster-recovery plan; an incident-response process; and vendor (sub-processor) management. More detail is in our Security overview and in Annex II of the DPA. Our error-monitoring is configured not to send personal data by default.

Connection secrets are treated with particular care: Google and Microsoft OAuth refresh tokens and — where you connect it — your IMAP mailbox password are each encrypted at rest with AES-256-GCM under separate, dedicated keys, are never written to logs, and are never returned to the browser. A connected LinkedIn account's session is held by the provider (Unipile, Section 4.7); Capable stores a provider account identifier, not your LinkedIn credential. We recommend using a revocable app-specific password for IMAP so the credential can be scoped to mail access and revoked at your provider independently of your primary password.

11. Your rights

11.1 GDPR and UK GDPR

Subject to the conditions in the GDPR and UK GDPR, you have the right to: access your personal data; rectify inaccurate data; erase data ("right to be forgotten"); restrict processing; data portability; object to processing based on legitimate interests (including direct marketing); and not be subject to solely automated decisions producing legal or similarly significant effects. Where we rely on consent, you may withdraw it at any time without affecting prior processing.

If your personal data appears in a customer's CRM, that customer is the controller; we will refer your request to them and assist as their processor.

How to exercise your rights: contact hello@capable.run. We respond within the timeframes required by law. You have the right to lodge a complaint with a supervisory authority — for Capable, the lead authority is the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten / IMY, imy.se) — and you may also complain to the supervisory authority of your habitual residence, place of work, or place of the alleged infringement.

11.2 California (CCPA/CPRA) and other US state privacy laws

Where the CCPA/CPRA applies, you have rights to know/access, delete, correct, and to opt out of the "sale" or "sharing" of personal information and of certain targeted advertising, and the right not to be discriminated against for exercising these rights. To exercise them, contact hello@capable.run.

11.3 We do not sell or share personal information

We do not "sell" personal information and we do not "share" it for cross-context behavioural advertising, as those terms are defined under the CCPA/CPRA. Our cookieless, first-party product analytics is not a sale or a share: it is metadata-minimized, runs on legitimate interest, sets no advertising identifiers, and is not disclosed to third parties for advertising. For Customer Data, we act as a service provider/processor and process it only on the customer's documented instructions.

12. Children

The Services are a business tool not directed to children. We do not knowingly collect personal data from children under 16. If you believe a child has provided us personal data, contact hello@capable.run and we will take appropriate steps.

13. Changes to this Policy

We may update this Privacy Policy from time to time. We will post the updated version with a new effective date and version number and, for material changes, provide additional notice. Where a change materially affects analytics consent, we bump the consent policy version.

14. Contact

• Privacy & security: hello@capable.run
• Postal: Capable Agents AB, Bäckaskiftsvägen 68, 122 42 Enskede, Sweden
• UK GDPR representative: Not applicable (no UK Article 27 representative appointed — see "Who we are")
• Lead supervisory authority: Integritetsskyddsmyndigheten (IMY), Sweden