1. Who Processes Your Data
The controller of personal data is Capitanier s.r.o., Company ID (IČO) 30077435, registered office Budovcova 188/1, 130 00 Prague 3 – Žižkov, Czech Republic, registered in the Commercial Register maintained by the Municipal Court in Prague, Section C, File 456912. The company is not registered for VAT. Contact: info@capitanier.com. No data protection officer has been appointed. Please direct all questions and requests to info@capitanier.com.
This policy describes the processing that takes place when you visit the capitanier.com website, register for and use the Capitanier service, and in connection with invoicing, support and the affiliate programme.
2. Data Uploaded to the Service by Customers
Documentation, drawings and other data uploaded by a customer to the Service belong to the customer. Where they contain personal data, the customer is their controller and we process them as a processor in accordance with the customer’s instructions and the Terms (Article 12). If your data are contained in such documents, please contact the relevant customer first; we will assist the customer in handling your request.
3. What Data We Process, Why and for How Long
| Purpose | Data | Legal basis | Retention period |
|---|---|---|---|
| Operation and security of the website and the Service | IP address, browser type, time and URL of the request (technical logs) | Legitimate interest in security and functionality (Art. 6(1)(f) GDPR) | 90 days |
| Website traffic measurement (without consent) | Pseudonymous session identifier valid only until the window is closed, pages visited, clicks on calls to action, language and device type | Legitimate interest in improving the website (point (f)) | 400 days |
| Extended traffic measurement (with consent) | Additionally, a persistent visitor identifier, time spent in sections, scroll depth | Consent (point (a)); you may withdraw it at any time | 400 days; identifier until consent is withdrawn |
| Registration, account and provision of the Service | Name, work e-mail, company, team role, login credentials (password only in encrypted form), settings, in-app activity log, conversations with the AI assistant | Performance of a contract (point (b)) | For the term of the contract, then for no more than 3 years for the protection of legal claims |
| Invoicing and payments | Company billing details (name, address, Company ID, VAT ID), contact e-mail, payment and invoice history. Payment card data is processed only by Stripe; we have no access to it. | Performance of a contract and legal obligation (points (b), (c)) | In accordance with accounting and tax legislation (usually 5 to 10 years) |
| Customer support and communication | Content of tickets and e-mails, contact details | Performance of a contract, legitimate interest (points (b), (f)) | 3 years from resolution |
| Affiliate programme | Name, e-mail, referral code, attributed registrations, commissions and payouts | Performance of a contract, legal obligation (points (b), (c)) | For the duration of participation in the programme; accounting data in accordance with legislation |
We do not use profiling or automated decision-making that would produce legal effects concerning you. Processing of documents by artificial intelligence models serves to analyse the content of the documents, not to make decisions about individuals. We do not send marketing newsletters.
4. To Whom We Disclose Data
We disclose data only to suppliers who help us operate the Service (processors), and only to the extent necessary for their task:
| Supplier | Role | Place of processing |
|---|---|---|
| Amazon Web Services EMEA SARL (Luxembourg) | Application hosting, database, file storage, e-mail delivery, IoT devices, technical logs | EU – Frankfurt region (Germany) |
| Clerk, Inc. (USA) | Sign-in, management of accounts and companies | USA |
| Stripe Payments Europe, Ltd. (Ireland) | Payments, subscriptions, invoices; for fraud prevention, Stripe acts as an independent controller | EU and USA |
| Anthropic, PBC (USA) | Processing of documents and queries by artificial intelligence models (not used for model training) | USA |
| Google Ireland Limited (Ireland) | E-mail communication (Google Workspace) | EU and USA |
| Convex, Inc. (USA) | Operation of the TechSchema technological schematics editor | USA |
For transfers to the USA, we rely on the EU–U.S. Data Privacy Framework where the recipient is certified, and otherwise on the standard contractual clauses approved by the European Commission. Otherwise, we disclose data only to public authorities where required by law.
5. Your Rights
You have the right of access to your data, the right to rectification, erasure, restriction of processing and data portability, and the right to object to processing based on legitimate interest. You may withdraw your consent at any time (e.g. via the “Cookies” link in the website footer); withdrawal does not affect the lawfulness of processing prior to it.
Please send your request to info@capitanier.com; we will handle it without undue delay and at the latest within one month. You also have the right to lodge a complaint with the supervisory authority – the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, uoou.gov.cz, or with the supervisory authority of the state of your habitual residence or place of work.
6. Security
We protect data through encryption in transit (HTTPS) and at rest, segregation of individual customers’ data at the database level, role-based access rights management, web application protection (firewall) and regular backups. Only authorised persons bound by confidentiality have access to the data.
7. Changes to This Policy
We may update this policy, e.g. in the event of changes to the Service or our suppliers. The current version is always available on this page; we will inform customers of material changes by e-mail or in the application. This version is effective from 3 November 2026.
The use of cookies and similar technologies is described separately in the Cookie Policy.