Privacy Policy

Where we rely on our legitimate interests, You may object to the processing as described in Section 9.

Providing Your Registration and billing data is necessary to conclude and perform the contract for the Service; without it, we cannot provide the Service to You. Giving consent to marketing communications is optional and does not affect Your use of the Service.

We do not make decisions that produce legal effects concerning You, or similarly significantly affect You, based solely on automated processing, including profiling.

5. AI Features

When You use AI Features, the Input and relevant User Data are sent to large language models provided by our External Suppliers, which process them on our behalf under terms that do not permit them to use such data to train their models. We do not use User Data, Input, Output, or Usage Data to train or fine-tune artificial intelligence or machine learning models. We may use Aggregated Data, which does not identify You or any individual, to develop and improve the models and features we use to provide our products and services, as set out in Section 7.10 of the Terms of Service.

6. Who We Share Personal Data With

We do not sell Personal Data. We share Personal Data only with the following recipients, and only to the extent necessary for the purposes described in this Privacy Policy:

• Service providers that process Personal Data on our behalf and under our instructions, bound by contractual obligations of confidentiality and data protection: Amazon Web Services and Google Cloud Platform, for hosting and infrastructure; Framer, for hosting the Website; ClickHouse, for analytics data storage; PostHog, for product analytics; Sentry, for error and performance monitoring; Intercom, for customer communication, chat, and product updates; Help Scout, for email support; Kit (ConvertKit), for newsletters and product updates; and OpenAI, Anthropic, xAI, Perplexity, Google (Gemini API), and OpenRouter, for large language model inference, including the AI assistant that answers support chats. The providers that process customer data on our behalf are listed in Annex 3 of the Data Processing Addendum.

• 2Checkout, as merchant of record for online purchases, as described in Section 3.3.

• Google, for Website analytics and advertising, as described in Section 11.

• The customer that owns an Account, and the Users and recipients the customer chooses, with respect to Personal Data relating to that Account.

• Professional advisers, such as lawyers, accountants, and auditors, who are bound by confidentiality obligations.

• Competent authorities, courts, and other parties, where we are required to do so by law or to establish, exercise, or defend legal claims, as described in Section 10.2 of the Terms of Service.

• A successor entity, in connection with a merger, acquisition, corporate reorganization, or sale of all or substantially all of our assets, as described in Section 18.2 of the Terms of Service, subject to the protections of this Privacy Policy.

All Caphyon employees who handle Personal Data are subject to contractual obligations of confidentiality, have access only to the data they need for their role, and receive appropriate training.

7. International Data Transfers

We store Personal Data in data centers located in the United States and the European Union. Some of our service providers, such as Intercom, Help Scout, PostHog, and certain large language model providers, are based in the United States or other countries outside the European Economic Area. We transfer Personal Data to the United States, including for storage, and to these providers only on the basis of an appropriate transfer mechanism under Chapter V of the GDPR, such as an adequacy decision of the European Commission (including the EU-U.S. Data Privacy Framework, for providers certified under it) or the Standard Contractual Clauses adopted by the European Commission, together with supplementary measures where required. You may request a copy of the relevant safeguards by contacting us at legal@caphyon.com.

8. How Long We Keep Personal Data

We keep Personal Data only for as long as necessary for the purposes for which it was collected, in particular:

• Registration and Account data: for as long as Your Account exists. When Your Account is cancelled or terminated, Your data is handled as set out in Section 7.8 of the Terms of Service: You may request an export during the 30-day Export Window, after which the data is archived securely for 6 months and then permanently deleted. Accounts without an active paid Subscription may be terminated after six (6) months of inactivity, as set out in Section 14 of the Terms of Service.

• Order, billing, and accounting records: for the period required by Romanian accounting and tax law, currently up to 10 years.

• Support communications: for as long as Your Account exists, and then deleted together with Your Account data, unless needed to establish, exercise, or defend legal claims.

• Usage Data: for up to 6 months, except error reports, kept for 90 days, and system logs, kept for 30 days; after that, it is deleted or anonymized.

• Marketing data: until You withdraw Your consent or unsubscribe. We keep a record of Your opt-out to make sure we do not contact You again.

• Public Data: for as long as needed to provide historical search and AI visibility data in the Service and to create Aggregated Data.

• Cookie data: for the lifetime of each cookie, as described in Section 11.

Copies of deleted data may remain in our backups until they are overwritten in the ordinary course of our backup cycle. We may keep Personal Data for longer where required by law or where necessary to establish, exercise, or defend legal claims.

9. Your Rights

Under the GDPR, You have the following rights in relation to Your Personal Data:

• Access: to obtain confirmation of whether we process Your Personal Data and a copy of it, together with information about the processing, including the source of the data (Article 15).

• Rectification: to have inaccurate Personal Data corrected and incomplete Personal Data completed (Article 16).

• Erasure: to have Your Personal Data deleted, for example where it is no longer necessary for the purposes for which it was collected, where You withdraw Your consent, or where You successfully object to the processing (Article 17).

• Restriction: to have the processing of Your Personal Data restricted, for example while we verify its accuracy or assess Your objection (Article 18).

• Portability: to receive the Personal Data You provided to us in a structured, commonly used, and machine-readable format, and to have it transmitted to another controller, where the processing is based on consent or contract and carried out by automated means (Article 20).

• Objection: to object at any time to processing based on our legitimate interests, on grounds relating to Your particular situation, and to object at any time to processing for direct marketing purposes, in which case we will stop that processing (Article 21).

• Withdrawal of consent: to withdraw Your consent at any time, without affecting the lawfulness of processing carried out before the withdrawal. You can unsubscribe from marketing emails using the link in each email.

• Complaint: to lodge a complaint with a supervisory authority, in particular in the EU Member State of Your habitual residence, place of work, or the place of the alleged infringement. Our lead supervisory authority is the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), www.dataprotection.ro.

To exercise Your rights, contact us at legal@caphyon.com. We may ask You to verify Your identity before responding. We will respond within one month of receiving Your request; for complex or numerous requests, this period may be extended by two further months, in which case we will inform You. Exercising Your rights is free of charge, unless a request is manifestly unfounded or excessive. For Personal Data that we process on behalf of a customer, see Section 2.2.

10. Security

We maintain and regularly review a security program with appropriate technical and organizational measures to protect Personal Data against unauthorized access, processing, disclosure, or loss. These measures include encryption of data in transit using HTTPS/TLS, storage of passwords only in encrypted form, the OAuth authorization protocol for External Connections so that Your credentials for External Suppliers are not shared with the Service, restriction of access to authorized personnel on a need-to-know basis, logging of access to production systems, regular backups, and failover arrangements. The Service is hosted on Amazon Web Services and Google Cloud Platform infrastructure in data centers located in the United States and the European Union. Payment card data is handled by 2Checkout, which is certified under the Payment Card Industry Data Security Standard (PCI DSS) Level 1. The measures that apply to customer data are described in more detail in Annex 2 of the Data Processing Addendum.

If we become aware of a Personal Data Breach affecting Personal Data we process as controller, we will notify the competent supervisory authority where required by the GDPR and, where the breach is likely to result in a high risk to Your rights and freedoms, we will inform You by email without undue delay. Personal Data Breaches affecting customer data are handled in accordance with the Data Processing Addendum.