Status: Preview-only draft. The website-analytics section reflects Lovable implementation testing dated 2026-07-24; contractual and organisational safeguards for Dealfront remain Unverified pending reconciliation.
This Privacy & Cookie Policy explains how Capptions B.V. (“Capptions”, “we”, “us”) collects and processes personal data when you use our products and websites. It is written to satisfy Articles 13 and 14 of the EU General Data Protection Regulation (GDPR / EU 2016/679) and the Dutch UAVG.
- Effective date: 1 January 2026
- Last updated: 24 July 2026
- Version: 2026.2 (draft)
If you have a complaint about how we handle your data, please contact us first at privacy@capptions.com. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or your local EU supervisory authority.
1. Who we are
| Controller | Capptions B.V. |
| Address | Amsterdam, the Netherlands |
| KvK | 27305863 |
| Privacy contact | privacy@capptions.com |
| Security contact | security@capptions.com |
| EU representative | Not required (Capptions is established in the EU) |
For data you upload into our products in the course of your work (inspections, audits, photos, employee records, Seveso safety reports, etc.), your employer is the controller and Capptions acts as a processor under a Data Processing Agreement.
This Policy covers data for which Capptions itself is the controller: account data, billing data, support interactions, website analytics, and similar.
2. What we process, why, and on what legal basis
| Category | Examples | Purpose | Legal basis (GDPR Art. 6) | Retention |
|---|---|---|---|---|
| Account data | Name, work email, organisation, role, password hash, MFA | Provide the service, authenticate you | 6(1)(b) contract | Life of account + 12 months |
| Usage data | Logins, feature events, device/OS, IP, error logs | Operate, secure and improve the service | 6(1)(f) legitimate interest | 13 months |
| Billing data | Company, VAT, invoice address, payment metadata | Invoicing, accounting | 6(1)(b) + 6(1)(c) legal obligation (Dutch tax law: 7 years) | 7 years |
| Support data | Tickets, chat transcripts, screen recordings you share | Resolve your support requests | 6(1)(b) + 6(1)(f) | 3 years after closure |
| Marketing data | Work email, role, marketing preferences | Newsletters, product news | 6(1)(a) consent (B2B opt-in) | Until you unsubscribe |
| Website data | Cookies, storage, page views, referrer, business-visitor identification (see §3) | Measure, secure, improve the website | 6(1)(f) + 6(1)(a) for non-essential | See §3 |
| AI feature data | Prompts and prompt context derived from your tenant data | Provide AI assistance (see AI Policy) | Acting as processor on your controller’’s behalf | Not stored at provider; logs ≤ 30 days at Capptions |
We do not sell personal data and we do not use customer content to train AI models. See the AI Policy for the detailed AI data-handling commitments.
3. Website analytics and cookieless business-visitor identification
Capptions uses Dealfront (formerly Leadfeeder) Web Visitors on Capptions-controlled websites. The intended domain scope is capptions.com, www.capptions.com, try.capptions.com and seveso.app (final production hostname allowlist pending Capptions approval). Lovable preview domains, Lovable project domains and localhost are excluded and must not load the tracker.
How consent works. Lovable implementation testing of 24 July 2026 confirmed the following about the current implementation on capptions.com:
- The Dealfront tracker is initialised with
ldfdr("consent", "denied")before the tracker script is injected. - Before analytics consent, the tested implementation does not place a persistent Dealfront visitor cookie or store a persistent Dealfront browser identifier.
- No browser fingerprinting has been implemented by Capptions or Lovable for Dealfront.
ldfdr("consent", "granted")is only sent after you accept the applicable analytics-cookie category.
Rejecting analytics cookies. If you reject analytics cookies, the website does not send ldfdr("consent", "granted"). Cookieless, organisation-level identification may continue on the basis of Capptions’’ legitimate interests (Art. 6(1)(f) GDPR); no persistent Dealfront visitor cookie or browser identifier is placed. You can object at any time as described in §7 and §11.
IP addresses. Your IP address is briefly processed at the start of the website session as technically necessary to compare against Dealfront’‘s business-network database. Capptions has enabled Dealfront’’s IP Anonymization setting; shortened IP-address values are stored instead of the original complete IP address. IP anonymisation is not the same as complete anonymisation of the visit.
What Dealfront produces. Cookieless, company-level identification of website visitors who have not directly identified themselves to Capptions. The output relates to organisations, not to named natural persons. It may nevertheless relate indirectly to a natural person, particularly where the organisation is small or the circumstances of the visit make the visitor easier to infer.
What Dealfront is not used for. Dealfront is not used by Capptions for cross-site behavioural advertising or to follow visitors across unrelated third-party websites. The tracker may operate only on Capptions-controlled domains explicitly included in the approved hostname allowlist.
Retention, DPA and processor entity. The Dealfront retention period, the applicable Data Processing Agreement, and the exact Dealfront contracting entity are being reconciled and are treated as Unverified in this preview draft. The processor is described as Dealfront Finland Oy and/or another relevant Dealfront group entity until confirmed.
The full assessment is published as the LIA Summary — Cookieless Business Visitor Identification.
See the Cookie Policy for the strictly-necessary, functional, analytics and marketing cookie categories used across the website.
4. Where your data lives
Customer content and primary application databases run in the European Union, on infrastructure operated by Amazon Web Services (AWS) and/or Hetzner Online GmbH, in the Dublin (Ireland) and/or Frankfurt (Germany) regions.
A small number of supporting tools (e.g. Stripe for payments, HubSpot for marketing) are based outside the EU. Where data leaves the EEA, transfers are covered by the European Commission’’s Standard Contractual Clauses (2021/914) and, where applicable, the EU–US Data Privacy Framework. A Transfer Impact Assessment is on file for each non-EEA sub-processor. The complete, dated list is on the Sub-processors page.
3a. Dealfront Web Visitors tracking
Capptions uses Dealfront (formerly Leadfeeder) to identify, at the organisation level, which businesses visit our public websites. We do not identify you as an individual.
What we track
- Your IP address (shortened via Dealfront’s IP Anonymization).
- Pages visited.
- File downloads, video plays and form submissions.
Where we track it
Only on production domains: capptions.com, www.capptions.com, try.capptions.com and seveso.app. Preview, staging and localhost environments are excluded via a hostname allowlist.
How long we keep it
- Data is retained while Capptions’ Dealfront subscription is active.
- You can request deletion at any time via
privacy@capptions.com. - Deleted data is retained in backups for 97 days, then permanently removed.
Your rights
- Reject analytics cookies in our consent banner.
- Enable Global Privacy Control (GPC) in your browser — we honour it.
- Request deletion:
privacy@capptions.com. - Withdraw consent at any time; Dealfront then reverts to cookieless mode.
Legal basis: Article 6(1)(f) GDPR — legitimate interests (pre-consent, cookieless, organisation-level) and Article 6(1)(a) GDPR — consent (post-consent, for persistent visitor identification).
Processor: Dealfront Finland Oy (Helsinki, Finland), ISO 27001 and ISO 27701 certified, under a signed Data Processing Agreement.
More information: see the Legitimate Interests Assessment for the full assessment, and the plain-language summary for a shorter version.
5. Who we share data with
- Sub-processors strictly necessary to deliver the service, each bound by an Art. 28 DPA. See the Sub-processors list.
- Your organisation’’s administrators, who can access account and usage information of users within their tenant.
- Public authorities, only where we are legally compelled (e.g. a valid Dutch court order). We notify affected customers unless prohibited by law.
We do not share personal data for advertising, behavioural profiling or brokering.
6. Your rights
Under the GDPR you have the right to: access your personal data (Art. 15); have inaccurate data corrected (Art. 16); have your data erased where applicable (Art. 17); restrict or object to processing (Art. 18 and 21); data portability (Art. 20); withdraw consent at any time, for processing based on consent (Art. 7(3)); and not be subject to a decision based solely on automated processing that has a legal or similarly significant effect on you (Art. 22).
To exercise any of these rights, email privacy@capptions.com from the address associated with your account. We respond within 30 days.
7. Objecting to Dealfront processing specifically
You can object to Dealfront processing under legitimate interests at any time by rejecting analytics cookies, enabling Global Privacy Control in your browser, or emailing privacy@capptions.com.
8. Automated decision-making and AI
Capptions AI features generate suggestions, summaries and risk insights to support human decision-making. They do not make legally or similarly significant decisions about individuals autonomously. See the AI Policy & Trust Statement and the Seveso.app AI Statement.
9. Security
We protect personal data with technical and organisational measures appropriate to the risk, including encryption in transit (TLS 1.3) and at rest (AES‑256), strict access controls, MFA, audit logging, segregated tenants, and 24/7 monitoring. Capptions is ISO/IEC 27001 certified and SOC 2 Type II attested. See the Security Statement for the full posture.
10. Children
Capptions products are intended for professional use and are not directed at children under 16. We do not knowingly collect personal data from children.
11. Changes to this policy
When we change this Policy materially, we post the new version here, update the version number, and notify account administrators by email at least 30 days before the new version takes effect. The current draft is 2026.2.