Privacy Policy

Capi Agent ("the Platform", "we") is a multi-tenant SaaS platform that runs one AI agent (shown as Seli, Helpi, Adso, Watso, Webi, and Mailo depending on the channel, but it is the same engine) which answers your store's customers over WhatsApp, Instagram, Messenger, X, the chat widget on your website, and email — together with a dashboard holding a CRM, a unified inbox, campaigns and automations, analytics, a knowledge base, and billing. A seventh agent, Capi (the manager), talks only to you inside the dashboard, reads your store's numbers, and proposes actions that run only once a person approves them — it never reaches your customers.

This policy covers two legally different situations, and it matters to tell them apart:

• Your data as a merchant (we are the Controller): your account, organization, team members, subscription, and your use of the dashboard and the website.
• Your customers' data (we are the Processor): conversations, phone numbers, emails, social-account identifiers, orders, carts, tags, notes, and consent state. This data stays yours; we process it on your behalf and only on your documented instructions. We never sell it, never use it for advertising, and never train models on it.

The contractual terms for our role as processor are in the Data Processing Addendum, and the technical protections are on the Security page. This policy applies to the marketing website, the dashboard, the widget embedded in your store, and every channel you connect to the Platform.

Who the controller is: the legal entity operating the Platform is REACHİCA İNŞAAT GAYRİMENKUL DİJİTAL PAZARLAMA VE YÖNETİM HİZMETLERİ LİMİTED ŞİRKETİ — a limited liability company registered in Türkiye, tax office Esenyurt, tax number 8331049228, with its registered address at Piri Reis Mah. 2307. Sk. Noverist B Blok No: 2/1, İç Kapı No: 120, 34512 Esenyurt, İstanbul, Türkiye. For any question or request about your personal data, write to legal@capiagent.com.

a. Account and organization data: name, email address, a bcrypt-hashed password (or your Google sign-in data: name, verified email, and profile picture — we never see your Google password), your two-factor secret and backup codes (encrypted), organization and store names, roles and permissions, team invitations, and your subscription status as iyzico reports it to us.

b. Store data: products, prices, inventory, orders and their statuses, coupons, customers, and abandoned carts — received by connecting your platform (Salla, Zid, Shopify, WooCommerce, ikas, IdeaSoft, Ticimax, T-Soft, PlatinMarket) or entered manually. Your platform's access tokens are stored encrypted. Where you enable it, our storefront script also reports the carts shoppers fill before checkout — the products and total, and the name, email and phone of a shopper who is signed in — so you can see open carts live.

c. Your customers' data (third-party personal data): name, WhatsApp number or email, sender identifiers on Instagram and Messenger, account identifier on X, the content of conversations and their attachments, tags, notes, order history, carts, and the consent and unsubscribe record (when, on which channel, from which source, and the exact text that was shown).

d. Channel data we receive from Meta and X: when you connect WhatsApp, Instagram, or Messenger, we receive from Meta the names and ids of your pages, the linked Instagram business account, your WhatsApp Business number, and the content of inbound and outbound messages on those channels, along with access tokens that are stored encrypted. When you connect X, we receive the account identifier, the content of direct messages, and access and refresh tokens, stored encrypted.

e. Chat-widget data: the widget (widget.js) embedded in your store keeps a random visitor id and an attribution reference in localStorage on your own store's domain — not third-party cookies — plus the content of the messages the visitor types.

Ad tracking: when a visitor lands on your store from an ad, the widget keeps the click ids the ad platform put on the URL (fbclid, ScCid, ttclid, gclid / wbraid / gbraid, and Meta's pixel cookie values when your store runs a Meta pixel) in local storage on your store's domain for 28 days, and sends them to us with the visitor's messages — so the ads dashboard can tell which ad led to a conversation and an order, and so a purchase event can be sent back to that platform if you turned that on. No cookie is set by us for this.

f. Technical data: IP address, browser and device type, the dashboard pages you visited, error logs (via Sentry, with no personal data by default — only ids and error kinds), and rate-limit records.

g. Audit logs: we record sensitive operations (data exports, permission changes, campaign sends, AI action approvals, settings changes with the before and after values) with the acting user and timestamp — never credentials or keys.

h. Click and attribution data: links we place in your messages are rewritten to redirect links (/r/:token) so sales can be attributed to your campaigns. Suspect clicks (bots, link previews) are labelled as such, not deleted.

We do not collect payment-card data at all. The whole payment flow happens at iyzico.

• From you directly: at sign-up, in dashboard settings, the knowledge base, templates, and manual entry of customers or products.
• From your store platform: through OAuth (Salla, Zid, Shopify, ikas, IdeaSoft) or through credentials you enter (T-Soft, PlatinMarket), and through signature-verified webhooks.
• From Meta: through Embedded Signup for WhatsApp (scopes whatsapp_business_management and whatsapp_business_messaging), and through Facebook Login for Business for Messenger (pages_show_list, pages_messaging, pages_manage_metadata, business_management) and Instagram (instagram_basic, instagram_manage_messages in addition to the Messenger scopes).
• From X: through OAuth 2.0 with PKCE, with the scopes tweet.read, users.read, dm.read, dm.write, offline.access.
• From Google: if you choose Google sign-in — name, verified email, and profile picture; the account is linked by the same email.
• From your ad accounts (Meta, Snapchat, TikTok, Google Ads): only when you connect one with its own sign-in button (Facebook Login for Business on Meta; OAuth on Snapchat, TikTok and Google). We read your ad accounts (status, currency, spend, whether a payment method is present), and the assets an ad needs: Meta Pages, WhatsApp Business accounts and numbers, pixels and datasets; Snapchat organizations, public profiles and pixels; TikTok pixels and linked TikTok identities; Google Ads customer accounts and conversion actions (Capi creates its own «Capi – Purchase» action). We read each campaign's spend and results and keep a daily summary per campaign. With your approval in the dashboard we create, pause, resume, change the budget of and stop campaigns in your own ad account — you pay the platform directly; Capi never holds ad money. Access tokens are stored encrypted and removed when you disconnect. You can also revoke access on the platform: Meta Business Settings → Integrations → Connected apps; TikTok at ads.tiktok.com/ac/page/authorizations; Google and Snapchat from your account's connected-apps settings (disconnecting in Capi also revokes the Google and TikTok grants).
• Google user data (Limited Use): Capi Agent's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use Google Ads data only to show you your accounts and their results and to create and manage the campaigns you approve. We do not sell it, use it for advertising, or use it to train general-purpose AI models, and no one at Capi reads it except with your permission, for security, or where the law requires.
• From your store's visitors: through the chat widget, and through email arriving at the support address you enable (an inbound mailbox via Resend).
• From iyzico: subscription status and payment outcome only.
• From our own systems: operational, security, and error logs.

• Running the agent: generating replies, searching your products and knowledge base, tracking orders, issuing coupons, refund and cancellation requests, and escalating to a person — within the limits you set.
• Inbox and CRM: gathering conversations from every channel in one place, customer profiles, tags, and notes.
• Automations and campaigns: abandoned-cart messages, order status notifications, and the WhatsApp/email campaigns you create — with a consent gate before every send.
• Analytics and attribution inside your account: measuring conversations, conversion, attributed sales, weekly insights, and mining unanswered questions for your knowledge base — all of it reads your own store's data only.
• Agent evaluation (opt-in per store): replaying frozen transcripts in a sandbox with no writes to your store, to measure quality.
• Billing and subscription management, plan limits, and the AI usage meter.
• Security and abuse prevention: rate limiting, webhook signature verification, audit logs, and detecting unauthorized access.
• Advertising our own service (marketing website only): measuring Capi Agent's own ads on Snapchat and showing Capi Agent's own ads on Snapchat to visitors of our public website (retargeting), through the Snap Pixel, doing the same on TikTok through the TikTok Pixel, and on Facebook and Instagram through the Meta Pixel — only after you turn on "Advertising cookies". Your store data and your customers' data are never used for this.
• Technical support — we access your account data only when you ask us for help or when there is an incident we are investigating.
• Legal compliance: accounting records, responding to binding legal requests, and incident notification.

We operate in Saudi Arabia and Turkey and serve merchants who may be subject to the Saudi Personal Data Protection Law (PDPL), the Turkish Personal Data Protection Law (KVKK No. 6698), or the EU GDPR. For your data as a merchant, we rely on:

• Performance of a contract — to run the service you subscribed to, including the trial (GDPR Art. 6(1)(b); KVKK Art. 5/2-c).
• Legal obligation — for invoices, accounting records, and responding to binding requests (GDPR Art. 6(1)(c); KVKK Art. 5/2-ç).
• Legitimate interest — for platform security, fraud prevention, rate limiting, and improving the service (GDPR Art. 6(1)(f); KVKK Art. 5/2-f).
• Consent — for marketing-website analytics and for the Snap Pixel, TikTok Pixel and Meta Pixel advertising cookies on the marketing website (each given separately through the cookie banner, withdrawn from "Cookie settings" at the bottom of the page) and for any processing not covered by the bases above (GDPR Art. 6(1)(a); KVKK Art. 5/1). You can withdraw it at any time.

For your customers' data, you as the controller determine the legal basis (usually performance of the sales contract with your customer, and explicit consent for marketing messages), and we process on your instructions under the Data Processing Addendum.

For merchants in Turkey: the Turkish version of this policy is written as the information notice (aydınlatma metni) required by Article 10 of the KVKK — the controller's identity, processing purposes, legal bases, to whom and why data is transferred, the collection method, and your rights under Article 11. This English version carries the same meaning.

To generate the agent's replies, we send the conversation context to a language-model provider: Anthropic (the default), OpenAI, or Google — whichever you choose for your organization. If a provider is down, we try the next one you enabled; if all of them fail, the conversation is handed to a person on your team — it is never dropped silently.

• We send the minimum context: the system prompt (your rules and agent settings), the last 12 messages of the conversation, and the snippets the tools fetch (matching products capped at 200 characters of description each, knowledge-base answers capped at 500 characters, and order status). Not your whole database. Replies are capped at 800 output tokens and at most 5 tool rounds.
• Prompt caching is enabled with Anthropic to reduce cost: the prompt prefix may be cached at the provider for up to 1 hour on WhatsApp and 5 minutes on the widget.
• These providers process data as subprocessors, and under their commercial API terms they do not use inputs or outputs to train their models. We train no model on your data, and one merchant's data never influences another merchant's agent.
• If you use your own API key, it is stored encrypted (AES-256-GCM), used only for your organization's requests, and the usage is billed to you by the provider directly.
• The agent runs at an autonomy level you set (from "observe" to "autonomous"; the default is "approve") and under hard caps (maximum automatic refund, maximum discount percentage). Any action that spends money, grants a discount, or changes an order and exceeds a cap goes to human approval on the actions page (/dashboard/ai-agent/actions) instead of running.
• No decision with a legal or similarly significant effect on a customer is made without human involvement, and a customer can ask for a person at any time. The agent does not claim to be human when asked directly.

Full details (tools, levels, external text, and injection defenses) are in the AI Policy.

• WhatsApp: through Meta's WhatsApp Cloud API. A 24-hour customer-service window; outside it, only Meta-approved templates. We monitor your number's quality rating every 6 hours and slow sending if it drops. Conversation fees are paid by you to Meta directly.
• Instagram and Messenger: through Meta's Messenger Platform, on the same Meta app. The page access token is encrypted on our side. The 24-hour window is enforced.
• X: direct messages through OAuth 2.0. The refresh token is encrypted and refreshed on every send.
• Website widget: keeps the visitor id and attribution reference in localStorage on your store's domain, with no third-party cookies. It shows a notice you configure (for example "AI assistant"). Widget settings are cached for 60 seconds.
• Email: through Resend, with two separate domains you own: a support address (inbound conversations) and a marketing sender (campaigns); you verify DNS for your domains from the dashboard. Outbound attachments are not supported.
• TikTok and Snapchat: not available at this time. We neither receive nor send on them.

You can disconnect any channel from the integrations page (/dashboard/integrations?tab=channels) — disconnecting clears the stored tokens and identifiers. If you deauthorize our app from your Facebook, Instagram, or X settings, our access stops immediately, and you delete the remaining conversations from the dashboard or by emailing privacy@capiagent.com. When a person on your team takes over a conversation, it stays with them — the agent never takes it back automatically. More detail in the Channel Policies.

A published store can be searched by AI shopping assistants such as ChatGPT and Claude, through our shopping server (MCP). The merchant can switch this off at any time. This is the only part of the service used directly by shoppers who are not talking to the merchant.

• What reaches us: only what the assistant sends to search the catalog: search words, a price range, a category, or a product id. We do not receive the shopper's conversation, name, account, contact details, or location.
• What we return: what the storefront already shows any visitor: product name, description, price, images, options, whether it is in stock, and its link. Never cost prices, stock counts, or anything about customers or orders.
• What we keep: daily counters per store and assistant (how many searches, how many products returned). We do not store the search words. The caller's IP address is used only for rate limiting and is discarded when the one-minute window ends.
• Links: product links carry a source tag (utm_source=capi-mcp) so the merchant can see which sales started in an assistant. The tag names the assistant, not the person.
• Purchases are completed on the merchant's own website, under the merchant's privacy policy. The assistant's handling of the conversation is governed by its provider's policy.

The Capi app: one app in the Claude and ChatGPT app directories that searches the products of every store that turned on “Show my products in the Capi app”, so a store's products appear beside other stores'. Everything above in this section applies to it; no store appears there unless it turned this on itself, and a store that unpublishes, lets its subscription end or requests account closure leaves it immediately.

Managing the store from the merchant's own AI assistant: a merchant can connect their own Claude, ChatGPT or other assistant account to their store account with us, to ask it about sales and customer service and have it change the store's settings for them. Connecting is the merchant's decision, made with explicit consent, and can be revoked at any time from the dashboard. The assistant receives: the store's settings, knowledge base, products and aggregate figures, and conversation transcripts with phone numbers and email addresses masked. It never receives the customer list or customers' contact details, order addresses or payment data. What reaches the assistant is processed by the company that runs it under the merchant's own account terms there, and our deletion periods do not extend to it. Every change the assistant makes is recorded in the activity log under the merchant's name.

Because you are the controller of your customers' data, you commit to the following as a condition of using the Platform:

• Obtain explicit opt-in consent before sending any marketing message on any channel, and keep proof of it. The Platform records the opt-ins and opt-outs that pass through it, but the legal responsibility is yours.
• Honour unsubscribe requests immediately — the Platform detects opt-out keywords in Arabic and English, provides unsubscribe links in email, and stops sending automatically.
• In Turkey: the Platform is not integrated with the Message Management System (İYS). If you send commercial electronic messages to recipients in Turkey, registering with İYS and obtaining consent through it is your responsibility.
• Publish a privacy notice for your own store stating that you use AI Sales Agent as a processor for conversations, and tell your customer they are talking to an AI assistant where that is required.
• Comply with Meta's WhatsApp Business and Messenger policies, the rules of X, and your store platform's policies.
• Handle your customers' requests (access, rectification, erasure) from the dashboard, and ask us for help when you need it.
• Choose the conversation retention window that suits you, and set the agent's caps before running it on a live channel.

We do not sell your data or your customers' data to anyone, and we do not share it for advertising (the only exceptions are the Snap Pixel, the TikTok Pixel and the Meta Pixel on our public marketing website, which receive visit data only after you turn on "Advertising cookies" — described below; store and customer data never go to them). We share it only with providers that are necessary to run the service, each within the limits of its purpose:

• Vercel — application hosting, compute, edge network, and scheduled jobs (USA / global network).
• Neon — the primary PostgreSQL database (USA / EU).
• Cloudflare R2 — storage for conversation attachments, uploads, and nightly backups (Cloudflare's global network).
• Upstash — Redis for rate limiting, locks, and short-lived cache, and QStash as the job queue for campaign sends and syncs (job payloads carry ids, not message bodies).
• Anthropic / OpenAI / Google — language-model inference per your choice (USA).
• Meta Platforms — WhatsApp, Instagram, Messenger: message content and customer identifiers on those channels. If a merchant turns on ad data sharing (off by default, switched on from the Ads page and recorded), we also send Meta a purchase event for an order that came from a Click-to-WhatsApp ad: the click id Meta itself issued, the event name, the order's value and currency, the order id and the time — no name, phone number, email, address or message, except what «enhanced matching» below describes, and then hashed. The same switch covers a Meta ad that opens a page in the store (not WhatsApp): if the merchant connects their Meta pixel, we send the purchase event to that pixel through the Conversions API — the click id Meta put on the landing URL and the pixel cookie value, the landing page URL, the visitor's browser string (User-Agent), the event name, the order's value, currency and id, and the time. No name, phone, email, address or message, except what «enhanced matching» below describes, and then hashed.
• Snap Inc. — only if a merchant turns on Snap data sharing (off by default, switched on from the Ads page and recorded): a purchase event for an order that started from a chat opened on a landing page carrying Snap's click id — that click id, the landing page URL, the event name, the order's value, currency and id, and the time. Never a name, phone number, email, address or message, except what «enhanced matching» below describes, and then hashed.
• TikTok (ByteDance) — the same, only if a merchant turns on TikTok data sharing: a purchase event for an order that started from a chat opened on a landing page carrying TikTok's click id (ttclid) — that click id, the landing page URL, the event name, the order's value, currency and id, and the time. Never a name, phone number, email, address or message, except what «enhanced matching» below describes, and then hashed.
• Google LLC (Google Ads) — the same, only if a merchant connects their Google Ads account and turns on Google data sharing: a conversion for an order that started from a chat opened on a landing page carrying Google's click id (gclid, gbraid or wbraid) — that click id, the order's value, currency and id, and the time, sent to the merchant's own conversion action through Google's Data Manager API under the merchant's own Google sign-in consent. Never a name, phone number, email, address or message, except what «enhanced matching» below describes, and then hashed.
• The order's own data and shopping events (since 08.10.2026): under the same switch for each platform, we also send the purchase event when the order itself carries that platform's click id — from the landing URL the store platform records (such as Shopify and WooCommerce) or a custom store's tracking field — together with the buyer's browser string. To Meta, TikTok and Snap we send shopping events (product viewed, added to cart, checkout started) only for a visitor who came from that platform's ad: the click id, the page URL, the product id, its catalog value and the time — and not when the store's own pixel already sends them. For WhatsApp conversations that came from a Meta ad we also send a «lead» event at the buying moment and an «order cancelled» event for an order counted as a purchase and then cancelled — with the click id Meta issued and nothing else.
• «Enhanced matching» (off by default): a separate switch on the Tracking & pixels page, turned on by the merchant and recorded in their name. When it is on, every purchase event sent to a platform the merchant shares data with also carries the buyer's email, phone, name, city, country, postcode and our customer id — hashed with SHA-256 before they leave, so the platform receives only the fingerprint it matches its own users against — and the order's IP address as is, because the platforms require it unhashed. Its only purpose is to credit the sale to the ad it came from, even when the order carries no click id. None of this data leaves as readable text, nor do messages or the full address. Turning the switch off stops it at once.
• Meta, Snap, TikTok and Google — ads a merchant launches from Capi: the ad text and images go to the ad platform the merchant chose, only when they press launch. Ad images are rendered from the product's own photos and kept in our storage; an optional AI variant is generated by OpenAI from the product photo, without faces, text or prices, is labelled as AI in the dashboard and in the ad where the platform or the law requires it (Snapchat receives it declared as AI-generated).
• Video ads, catalog ads and TikTok search keywords: a product video the merchant uploads — or a slideshow made in their own browser from the product's photos — and its cover frame are kept in our storage and sent only to the platforms (Meta, TikTok, Snapchat) the merchant launches it on; an upload never confirmed is deleted after 24 hours. For catalog ads we read the product catalogs and product sets the merchant already has on Meta or TikTok and match them to their Capi products (to respect stock and margin rules); we link the merchant's pixel to a catalog, or create a product set in it, only after they confirm it. To suggest TikTok search keywords, an AI model reads what customers asked in the merchant's conversations — customer messages only, with phone numbers and emails masked before the text leaves Capi; the merchant reviews every keyword before launch.
• Customer lists for ad audiences (Meta, Snap, TikTok, Google): only when a merchant turns on audiences for a platform, accepts that platform's terms and has its data sharing on, we upload the phone numbers and emails of consenting, non-blocked customers, hashed with SHA-256 before they leave, as a customer list — for example to exclude recent buyers. Names, addresses, orders and messages are never sent. Customers are removed from the platform's list when they withdraw consent or are blocked, when data sharing or audiences are switched off, or when the list is deleted. Lists refresh daily.
• Cash-on-delivery risk (no one else): to estimate whether a cash-on-delivery order may be cancelled, we read on our side the conversation of the 48 hours before the order and the order's own fields. The score stays in Capi; nothing of it is sent to an ad platform.
• X Corp — X direct messages.
• Resend — marketing and transactional email sending and the inbound support mailbox (USA).
• iyzico — payments and subscriptions; card data is held by iyzico only.
• Google (Sign-in) — authentication of dashboard users.
• Sentry — error monitoring with no personal data by default.
• Google Analytics 4 / Google Tag Manager / Microsoft Clarity — on the marketing website only, and only after you accept in the cookie banner. They never run inside the dashboard or the widget. Details and the cookies by name are in the Cookie Policy.
• Snap Inc. (Snap Pixel) — on the public marketing website only, and only after you turn on "Advertising cookies" in the cookie banner; before that the Snap script is not even downloaded. Purpose: measuring Capi Agent's own ads on Snapchat and showing them to our website visitors (retargeting). Data: the page URL and referrer, IP address, browser and device information (user agent), and the pixel's cookie identifier, with a page-view event only — no name, email or phone number (USA). Never present in the dashboard, the sign-in and sign-up pages, or the widget on merchants' stores; merchant data and their customers' conversations never go to it. Snap may also process this data under its own privacy policy.
• TikTok (TikTok Pixel) — TikTok Pte. Ltd. (Singapore) and its group companies. On the public marketing website only, and only after you turn on "Advertising cookies" in the cookie banner; before that the TikTok script is not even downloaded. Purpose: measuring Capi Agent's own ads on TikTok and showing them to our website visitors on TikTok (retargeting). Data: the page URL and referrer, IP address, browser and device information, the pixel's cookie identifier, page views, and clicks on buttons on the page — no name, email or phone number (automatic advanced matching is off). Data may be transferred outside your country, including to Singapore and the USA. Never present in the dashboard, the sign-in and sign-up pages, or the widget on merchants' stores, and never in emails; merchant data and their customers' conversations never go to it. TikTok may also process this data under its own privacy policy.
• Meta (Meta Pixel) — Meta Platforms Ireland Limited for visitors in the EU/EEA, and Meta Platforms, Inc. (USA) elsewhere. On the public marketing website only, and only after you turn on "Advertising cookies" in the cookie banner; before that the Meta script is not even downloaded. Purpose: measuring Capi Agent's own ads on Facebook and Instagram and showing them to our website visitors on Facebook and Instagram (retargeting). Data: the page URL and referrer, IP address, browser and device information, the pixel's cookie identifier, and page views — automatic button-click events and reading of page content are switched off, and no name, email or phone number is sent. Data may be transferred to the USA. Never present in the dashboard, the sign-in and sign-up pages, or the widget on merchants' stores, and never in emails; merchant data and their customers' conversations never go to it. Meta may also process this data under its own privacy policy.
• GitHub Actions — runs the nightly backup job.
• Your store platform (Salla, Zid, Shopify, WooCommerce, ikas, IdeaSoft, Ticimax, T-Soft, PlatinMarket) — within the scope you authorize at connection time.

The full list with the purpose, data type, and location of each provider is on the Subprocessors page. We announce any material addition by email to the account owner and by an in-dashboard notice before it takes effect, and you have the right to object and terminate your subscription.

We may also disclose data when a binding law or court order requires it, or to protect our rights and the safety of users.

The providers above process data mainly in the United States and the European Union, that is outside Saudi Arabia and Turkey. In those cases we rely on Standard Contractual Clauses (SCCs) or equivalent provider commitments, and restrict access to the minimum needed to run the service.

The Snap Pixel on our marketing website sends the visit data described above to Snap Inc. in the United States, and only after you turn on "Advertising cookies". The TikTok Pixel likewise sends the visit data described above to TikTok, and it may be transferred outside your country, including to Singapore and the United States, again only after you turn on "Advertising cookies". The Meta Pixel sends the visit data described above to Meta, and it may be transferred to the United States, likewise only after you turn on "Advertising cookies". Those transfers rest on your consent, which you can withdraw at any time from "Cookie settings".

If the law that applies to you (PDPL or KVKK) requires an additional basis for transferring your customers' data abroad, we document that basis with you in the Data Processing Addendum, and you as the controller ensure your customers are informed of the transfer in your store's privacy notice.

The trial: signing up starts a 14-day free trial with no card. If it ends without a subscription, your account switches to read-only — you can see everything, billing and settings still work, but agent replies, campaigns, and automations stop. We do not delete your data because a trial ended. The same applies when an account is suspended for a failed payment: the data stays readable and sending stops.

Closing the account: when you request closure from the data-rights settings (/dashboard/settings/data-rights; it asks you to type the organization name to confirm), deletion is scheduled after a 30-day grace period during which you can cancel it with one click. After that, the account's data is permanently erased: customers, orders, conversations, and integrations — erased within 30 days of closing the account.

Conversations: a per-merchant setting on the same page: either delete dormant conversations automatically after a number of days you choose, or keep them permanently (an explicit choice). Manual deletion from the dashboard is immediate and irreversible.

The nightly backup is stored in our own Cloudflare R2 bucket and pruned after 7 days, so anything you delete leaves the backups within 7 days at most.

• Encryption in transit over HTTPS/TLS on every connection, with HSTS and an enforced Content Security Policy (CSP).
• Every secret in the database is encrypted with AES-256-GCM (AI keys, platform tokens, WhatsApp, Meta, and X credentials, two-factor secrets). Decrypted values are never logged or sent to the browser.
• Passwords are stored with bcrypt — we cannot see or recover them. Optional two-factor authentication (TOTP) with single-use backup codes, and rate-limited login attempts.
• Full isolation between organizations — every query is scoped to the user's organization and active store, and permissions are always checked on the server.
• Signature verification of every inbound webhook (HMAC-SHA256) and every job-queue message, with timing-safe comparison.
• A nightly backup at 03:30 UTC to our own bucket, retained for 7 days.
• Text from external sources (product descriptions, knowledge-base answers) is treated as untrusted data before it reaches the model.

Incident notification: if we confirm a personal-data breach affecting your account, we notify you without undue delay and no later than 72 hours after confirmation, by the account email and an in-dashboard notice, with the facts known at the time — so you can notify your regulator and your customers according to your own obligations. Full details and vulnerability reporting are on the Security page and via security@capiagent.com.

As a merchant, you have the following rights over your data, and you can exercise most of them yourself from the dashboard:

• Access and portability: from the data-rights settings (/dashboard/settings/data-rights) you export your whole account as one JSON file (organization, stores, customers, orders, conversations and messages, products, campaigns…) capped at 5,000 rows per collection, with a manifest stating the caps and what was excluded. Encrypted tokens and keys are never exported. CSV exports of customers, products, and orders also exist.
• Rectification and erasure: edit or delete any customer from the customers page (/dashboard/customers), and delete the whole account as described under retention.
• Objection and withdrawal of consent: against any processing based on legitimate interest or consent, by contacting us.
• Complaint: if you believe there has been a violation, you have the right to lodge a complaint with the competent authority: the Saudi Data and AI Authority (SDAIA) in Saudi Arabia, the Personal Data Protection Board (KVKK Kurulu) in Turkey, or your country's data protection authority in the EU.

Your store's customers: if one of your customers sends you a request (access / erasure / rectification / portability), you can fulfil it yourself from the customers page. If you need technical help with it, email us and we assist within 30 days at most. If a customer of yours contacts us directly, we refer them to you as the controller and let you know. The practical steps are on the Data Deletion page.

• Strictly necessary cookies in the dashboard: the sign-in session, the active store, language, theme, and the CSRF protection cookies from the auth library — the Platform does not work without them.
• Analytics cookies: Google Analytics 4 / Tag Manager / Microsoft Clarity on the marketing website only; their cookies are set only after you accept in the cookie banner (before that Google Analytics counts visits without cookies); your choice is stored in the cookie_consent cookie.
• Advertising cookies: the Snap Pixel (_scid, _sctr, _schn, and sc_at set by Snap on snapchat.com) on the marketing website only, set only after you turn on "Advertising cookies"; your choice is stored in the cookie_consent_ads cookie. The TikTok Pixel (_ttp, _tt_enable_cookie, ttcsid and ttcsid_*, first party, up to 13 months; TikTok may also use its own cookies on tiktok.com) and the Meta Pixel (_fbp and _fbc, first party, 90 days, _fbc only when you arrive from a click on a Meta ad; and fr, set by Meta on facebook.com, third party, 90 days) follow the same rule. Turn it off from "Cookie settings" and all three pixels stop from the next page load.
• The widget on your store: localStorage only (a visitor id and an attribution reference), with no cookies from us on your store's domain.
• Email: click redirect links and unsubscribe links. We use no hidden tracking pixels.
• Apart from the Snap Pixel, the TikTok Pixel and the Meta Pixel above, we use no advertising cookies and no cross-site third-party tracking — none in the dashboard, the widget, or emails — and your store data and your customers' data are never used for advertising.

The full list is in the Cookie Policy.

The Platform is intended for business use by people over 18. We do not knowingly collect children's data, and if we discover that we have received such data we delete it immediately. If your store serves minors, you as the controller are responsible for the legal basis for messaging them.

We may update this policy as the Platform evolves. We notify you of any material change (for example a new subprocessor, a new channel, or a change in the purpose of processing) by the email registered on your account or by an in-dashboard notice before it takes effect. The date of the last update is shown at the top of the page, and non-material changes (wording, clarification) are published directly.

For any privacy question or to exercise your rights: privacy@capiagent.com or via the contact page. We reply within 5 business days at most. For security incidents: security@capiagent.com, and for contractual matters: legal@capiagent.com.