Status: Preview-only draft, aligned with the 24 July 2026 Lovable implementation testing of Dealfront on capptions.com. Items marked Unverified remain to be reconciled by Capptions.
Our different data-protection roles
Capptions plays two distinct roles under the GDPR, and it is important to tell them apart.
Capptions as processor — your product data. When you upload data into the Capptions products in the course of your work (inspections, audits, photos, employee records, Seveso safety reports and similar), your employer is the controller and Capptions acts as processor under the Data Processing Agreement. We do not use that data for our own purposes and we do not use it to train AI models.
Capptions as controller — account, billing, support, marketing, website data. For the data described below Capptions is the controller. This includes information you provide when creating an account, when we invoice you, when you contact support, when you subscribe to marketing, and when you visit our public websites.
Personal data we collect and how we use it
We collect personal data to serve you as a (potential) customer.
Contact details — When filling out a form or registering for an event we save information such as your first and last name, business email, phone number, job title and company name. We use this information to provide support and, where you have opted in, to send you marketing-related emails such as newsletters and event invitations. You can unsubscribe at any time using the link at the bottom of any email or by writing to privacy@capptions.com.
Payment details — When you subscribe to paid services we process the payment information necessary to bill you.
Support conversations — Tickets and chat transcripts are stored in a secure database to resolve your requests.
Website data
When you visit our public websites Capptions collects a limited set of website data, described below. See the Privacy & Cookie Policy §3 and the LIA Summary for the full assessment.
Strictly necessary cookies and storage
Used for authentication, session security, load-balancing and CSRF protection on Capptions websites and inside the products. These are set on the basis of Article 5(3) ePrivacy exemption and do not require consent.
Functional cookies and storage
Used to remember UI preferences such as language and sidebar state. Set without consent, retained for up to 12 months.
Analytics — cookieless business-visitor identification (Dealfront)
Capptions uses Dealfront (formerly Leadfeeder) Web Visitors on Capptions-controlled websites to identify, at the organisation level, which businesses visit our public content.
- Legal basis for the cookieless layer: Article 6(1)(f) GDPR — legitimate interests.
- Legal basis for any consent-dependent Dealfront functionality: Article 6(1)(a) GDPR — consent.
- Verified by Lovable implementation testing (24 July 2026): the tracker is initialised with
ldfdr("consent", "denied")before injection; no persistent Dealfront visitor cookie is written before analytics consent; no persistent Dealfront identifier is stored inlocalStoragebefore analytics consent; no browser fingerprinting is implemented for Dealfront; the pre-consent output is company-level, not named-person-level. - IP addresses are briefly processed at the start of the session and stored in shortened form (Dealfront IP Anonymization enabled).
- The output describes website visitors who have not directly identified themselves to Capptions, at the organisation level. We do not describe the processing as anonymous.
- Intended domain scope:
capptions.com,www.capptions.com,try.capptions.com,seveso.app. Lovable preview / project domains andlocalhostare excluded. - Retention, Data Processing Agreement and exact Dealfront processor entity: Unverified pending reconciliation.
- Dealfront File Tracking and Video Tracking decision: Pending. When a decision is recorded, the associated file-download and video-play event categories will be disclosed here.
Marketing cookies
Used to measure the effectiveness of campaigns on capptions.com (e.g. HubSpot). Set only after you accept the marketing cookie category in the consent banner; retained for up to 13 months.
Your rights
You can request to access, correct, complete, erase, restrict, port or object to the processing of your personal data. Email privacy@capptions.com with a clear subject line and be as specific as possible. We respond within 30 days. If we cannot resolve your complaint, you can contact your national data-protection authority.
Data security
We apply technical and organisational measures appropriate to the risk, including secure-by-design architecture, encryption in transit (TLS 1.3) and at rest (AES-256), multi-factor authentication, strict access controls, audit logging and segregated tenants. Capptions is ISO/IEC 27001 certified and SOC 2 Type II attested. See the Security Statement for the full posture.