Privacy Notice

Capme Digital GmbH, c/o TechHub.K67, Kasernenstraße 67, 40213 Düsseldorf, Germany (Amtsgericht Düsseldorf, HRB 113657), represented by its managing director Steffen Rosenögger, is the controller for the processing described in this notice. Contact for anything about personal data: hello@capme.app. We have not appointed a data protection officer; the size of the company does not require one (§38 BDSG). Two roles. For the website, the free recorder, signing in, billing and support we decide why and how data is processed, so we are the controller and this notice applies. For what a company puts into its own workspace (its members, their recordings, meetings, audience lists and watch progress) that company is the controller and we process on its instructions under the Data Processing Agreement at https://capme.app/dpa. Section 7 says what that means for you if you are a member or a viewer of somebody else's workspace.

Delivery. Every request to capme.app passes through a content delivery network, which protects the site against attacks and serves it from a node near you. It processes your IP address and request headers to deliver the page and sets no cookies. The application itself runs on servers in the EU. Server logs (IP address, time, requested page, browser, referrer) are kept for a short period for security and fault finding and then deleted. Error reports (such as the error message, page address, browser and a shortened IP address) go to an error-tracking tool on our own server in the EU and are deleted after 90 days. Legal basis: our legitimate interest in a secure, working site (Art. 6(1)(f) GDPR). Analytics. We measure how the site and the product are used with an analytics tool running on our own server in the EU. It sets no cookie, stores nothing on your device and does not follow you across sites. It records page views and interface events (which button, which page) together with a country derived from your IP address; the IP address itself is not stored. Visitors within one day are told apart by a hash that rotates daily, so no persistent identifier exists. Events from the recorder carry the settings of a take (mode, quality, length, size), never its content. Events from the meeting cost calculator and the meeting hours calculator carry the numbers entered there: people, meeting lengths and how often meetings happen, days off, the salary (in the meeting hours calculator only its preset level) and the result. Never a name you type, and from a calendar file or a pasted list only totals such as hours a week, never an entry. You can opt out by setting the browser storage key op.disabled to 1 on capme.app; browsers under automation are excluded automatically. Legal basis: our legitimate interest in understanding how the product is used (Art. 6(1)(f) GDPR). No consent banner. We show none because we need none: every cookie in section 3 is strictly necessary for the service you asked for or stores a preference you set, and the analytics store nothing on your device (§25(2) TDDDG).

We set no marketing or tracking cookies. What is in use: Strictly necessary - sb-\*: your sign-in session with our own sign-in service (id.capme.app). HttpOnly; cleared on sign-out; the cookie lasts up to 400 days, the session itself ends after 30 days at the latest. - capme_meeting_invite: carries the destination of a meeting invitation across sign-in. HttpOnly; one hour. - capme_trust_access: grants access to a Trust Center document after an approved request. HttpOnly; fourteen days. - __Host-capme_pl_\*: remembers that you entered the password of a password-protected public link, for that one link. HttpOnly; twelve hours. Preferences - NEXT_LOCALE: your language. One year. - capme.site.theme, capme.meeting.theme: light or dark. One year. - capme.meeting.rail: whether the app's side rail is collapsed. One year. Browser storage (never sent to us): the recorder's settings, including the teleprompter text and any background image or logo you upload; the recorder's private file storage for your recordings (OPFS); what you enter in our calculators and the meeting audit, including the names of meetings you type there; the playback position of playlists you watch; the analytics opt-out (op.disabled); and dismissed notices.

The recorder at capme.app/studio records your screen, your camera or both in your browser. When you open the page it asks the browser for the camera and the microphone so the preview can start; you can refuse, and screen sharing is only ever requested when you press the button. The video, the audio, the background blur and the thumbnail are produced on your device. The file is written to your browser's private storage (OPFS) and stays there. No video, audio, screen content, thumbnail or file name is sent to us unless you sign in and press upload, which is a deliberate act and is described in section 6. What does reach us while you record: the analytics events of section 2, carrying the settings of the take and, if you chose one of our backgrounds, its address; for an image you uploaded, only that there was one. Recording statistics. When a take ends, the recorder sends us how it was recorded, for example the capture mode, quality, aspect ratio, length and size, the encoder, dropped frames, the plan, and which recorder features were used, such as the teleprompter, a background (its kind, never the image), blur or a logo. Later we add when the file was first saved to your device or uploaded. Never the video, the audio, the file name or anything on screen. If you are signed in to a workspace that is not on the Free plan, we store this with your account and your workspace; otherwise with nothing that points to you. We use it to improve the recorder and, in a workspace, to show statistics about its own recordings later. Legal basis: our legitimate interest in both (Art. 6(1)(f) GDPR); you can object (section 12). When your account or your workspace is deleted, the link to it is removed and the statistics stay without it. Saving the file to your device asks for an email address and the six-digit code we send to it. That creates an account (section 5). Legal basis: the contract for the free service (Art. 6(1)(b) GDPR).

You sign in with an email address and a six-digit code or the link in the same email. There are no passwords. We store the address, the time of sign-in and your language on our own sign-in service at id.capme.app, which a hosting provider runs for us on servers in the EU. The email with the code is delivered by our transactional email provider (section 9). To stop abuse we count code requests and attempts per email address and per IP address; the counters are deleted within two days (Art. 6(1)(f) GDPR). Single sign-on. A Business or Enterprise workspace can connect its own identity provider over SAML 2.0. Where it has, you sign in through that provider instead of with the code, and we process the assertion it sends us: your email address and, if the provider sends them, your name and job title. A name or job title it sends replaces the one on your workspace profile at each sign-in, and you change it at the provider rather than in Capme. The sign-in method is recorded for each session. We hold no password and no second factor; whether one is required is the identity provider's policy, not ours. Records we keep about your account: - an audit entry for each sign-in, failed code and sign-out, with your address, IP address and browser, kept 365 days, to reconstruct security incidents (Art. 6(1)(f) GDPR); - a legal-acceptance record of which version of the Terms, the Privacy Notice and, for a workspace, the Data Processing Agreement was accepted, when, from which IP address and browser, kept for the life of the account or workspace, because we have to be able to show which text applied (Art. 6(1)(c) and (f) GDPR); - your profile in a workspace: display name, job title, language and role, if you or your workspace's identity provider set them (Art. 6(1)(b) GDPR). A personal workspace on the Free plan is created when you set one up. It holds nothing but your own settings until you start a plan. We keep no self-service deletion button for an account. Write to hello@capme.app and we delete the account, its counters and its records within one month unless a workspace you own has to be deleted first (section 7).

In the free recorder, a recording leaves your browser only when you upload it. In a workspace, a take starts uploading as soon as you stop recording, so that sending it is instant; nobody sees it until you send it. A take you discard is deleted. After a retake, the earlier take is removed from the host and stays in your browser until its list of recent takes is full. Where it goes depends on the workspace: - EU hosting (Solo, Team, Business, Enterprise by default). The file is uploaded from your browser directly to our video provider, stored in its storage regions in the EU, transcoded there and streamed only to viewers who have access to it. Its delivery network serves the video from the edge node nearest the viewer. We hold the video's identifier, title, length, size, poster frame and status; the video provider holds the video. Recordings are purged after the workspace's retention window (section 7). - Your own bucket (Business and Enterprise, if the workspace chose it). The file is uploaded from your browser directly to storage the workspace operates (an S3-compatible bucket or, where offered, an Azure Blob container), and played from there. The video never passes through Capme. Its poster frame is sent to us, and our server writes it to the bucket and passes it through when a page shows it; we hold only the metadata and an encrypted credential for the bucket (an access key, or for Azure an app's client secret). The bucket's provider is the workspace's own processor, not ours. No retention window of ours applies there: the bucket's own rules decide, and we remove a recording from it only when someone deletes it in Capme. Unlisted links. A workspace can allow links that open a video or a meeting without sign-in. Such a page shows the video, the workspace name and the speakers' display names (for a speaker without one, the part of their email address before the @), and is excluded from search engines. Anyone with the link can watch, and also needs a password if the person sharing set one; a link can end on a date. The password is stored encrypted so that the people who manage the link can show it again; each time is logged. Every view is counted per link. Wrong passwords are counted per link and under a keyed hash of your IP address, which does not reveal the address, to slow down guessing; the counters are deleted within two days (Art. 6(1)(f) GDPR). Legal basis for our part: performance of the contract with the workspace (Art. 6(1)(b) GDPR) and, for the people recorded, the workspace's own basis as controller (section 7).

When a company invites you to its workspace, asks you to record a topic or puts you on the audience of a meeting, that company is the controller and we process on its behalf. It should have told you; this section says what the product does so you can check. What the workspace holds about its people: email address, display name, job title, role and language; meeting titles, descriptions and agendas with the name of each speaker; who is on the audience of a meeting; watch progress, that is how far each viewer got in each topic and when, which the meeting's organiser and the workspace's admins can see per person, or only as totals where the workspace is set that way; applause; in-app notifications; and the workspace's audit log of who changed what, with the IP address and browser of the person who made each change, kept 365 days. Retention. Hosted recordings are purged after the workspace's retention window: twelve months, which a Solo, Business or Enterprise workspace can shorten to as little as one day. Any recording can be marked to be kept; deleting a recording removes it from the host without delay. Deleting a workspace takes effect after fourteen days and then removes every recording we host, every file and row, and the sign-in of members who no longer use Capme otherwise; recordings in the workspace's own bucket stay there. When a paid plan or a trial ends and no plan follows, the recordings we host are removed 30 days after the end, while the meetings and the rest of the workspace stay readable, and the workspace is deleted in the same way 365 days after the end. Two things outlive a deleted workspace: the workspace's audit log, whose entries stay until they are 365 days old, and, for a business in another EU member state that we invoiced under the reverse charge, the evidence of its VAT check (section 8). Your rights as a member or viewer are exercised against the workspace: ask its admin, or write to us and we will pass the request on and support the workspace in answering it within the statutory month. Your own recordings you can delete yourself. Analytics that the workspace sees are mostly totals: how many meetings, how many videos, how quickly they arrive, how many of the audience finished. One list on the admin overview names people: up to ten who still owe recordings for a meeting, with how many and since when. The organiser of a meeting also sees per person whether they opened it, watched part of it (how many topics) or finished it, unless the workspace is set to show totals only. There is no scoring, ranking or performance rating in the product.

Business details. Before a workspace can start a paid plan it gives us its registered name, legal form, billing address and a tax identifier: in Germany the VAT identification number, the tax number or the commercial register number; in another EU member state the VAT identification number; outside the EU the local number. A VAT identification number from another EU member state is checked against the EU's VIES service when the details are saved, and we store VIES's answer, with its consultation number where VIES issues one, as evidence that the check was made and what it returned. A German VAT identification number, and one from another member state once VIES has confirmed it, is passed to our payment service provider so that it appears on the invoice; the other identifiers stay with us. Whoever enters these details confirms that the workspace is a business, and we record who did so and when. Payment. We further process the invoice email address (the owner's, if none is given), the plan and the number of speakers, and the invoices. We pass the registered name, the billing address, the invoice email address, the workspace's language and the workspace's name to our payment service provider in Ireland and keep them current there, so that it can issue invoices and receipts in that language and calculate the tax. It also handles card and SEPA direct debit payments; the card number and the bank details never reach us. It processes payment data as its own controller for the purposes of processing the payment and preventing fraud, and may transfer data to its parent company in the United States under the EU-US Data Privacy Framework and standard contractual clauses. Bank transfers go to an account it keeps for us (a virtual IBAN shown on the invoice) and reach it with the usual remittance data. If a bank or card issuer takes a payment back, we keep a record of it (amount, reason and status) to settle it with the customer. Legal basis: performance of the contract (Art. 6(1)(b) GDPR) and our legal obligations to keep accounts and tax records (Art. 6(1)(c) GDPR). Business details and the evidence of the VAT check are kept for as long as the contract lasts, and afterwards for as long as commercial and tax law require us to keep the invoices and the records behind them (§147 AO, §257 HGB). For a business in another EU member state invoiced under the reverse charge, we copy its name and legal form, billing address, VAT ID with VIES's answer, and who confirmed the billing details and that it is a business (email address and time) to a separate archive. The archive outlives the workspace. Each entry is deleted at the end of the tenth calendar year after the year in which the VAT ID was replaced or the workspace was deleted.

Transactional email. Sign-in codes, meeting invitations, reminders, playlist notifications, workspace invitations, role changes, and billing notices to the owner and the invoice address (for a payment taken back, also to the workspace's admins) are sent through an email service that stores and delivers them in the EU, without open or click tracking. A meeting email carries the meeting's title, description and agenda with the speakers' addresses. Newsletter. If you sign up for our newsletter, we ask for your email address and, if you give them, your name and your company. We first send you an email with a confirmation link. Only when you confirm do we add you to our list, with when you signed up and confirmed, which is our record of your consent. The newsletter goes out through our email provider (section 10), which keeps the mailing list for us. Legal basis: your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time through the unsubscribe link in every newsletter or by writing to hello@capme.app. We then stop writing to you and mark your entry as unsubscribed. Within a month we remove your name and company from it and keep only your address and the record that and when you consented, for as long as a claim about it is possible and at most three years (Art. 6(1)(f) GDPR). Your address also stays on our email provider's block list, so that no further mail reaches you. Support and the contact form. What you write to hello@capme.app or through https://capme.app/contact, with your name and address if you give them, reaches our support mailbox, hosted by a provider in Ireland with transfers to its parent company in the United States under the EU-US Data Privacy Framework. We use it to answer you and keep it for as long as the conversation and any follow-up need, at most three years. Legal basis: our legitimate interest in answering (Art. 6(1)(f) GDPR) or the contract, where there is one. Trust Center access requests. Requesting a gated document asks for your name, work email, job title, company and the reason. We use it to decide on the request, send the access link and know who received the document. It is kept for two years. Legal basis: our legitimate interest in giving confidential material only to people evaluating the product (Art. 6(1)(f) GDPR).

We share personal data only with the providers that run the service for us, each bound by a data processing agreement, with our payment service provider, and with authorities where the law requires it. The providers host the application, the database, sign-in and the database backups in the EU; store hosted video in the EU and deliver it through a network with nodes worldwide; send our email from the EU; and host the support mailbox in Ireland, with transfers to the provider's parent company in the United States. The payment service provider sits in Ireland, is a controller in its own right for payment processing and fraud prevention, and may transfer data to its parent company in the United States. Analytics and scheduled jobs run on our own servers in the EU. Each provider's name, role, location and transfer mechanism is listed in Annex IV of the Data Processing Agreement at https://capme.app/dpa and in the Subprocessors tab of https://capme.app/trustcenter, which also shows the payment service provider. On request we tell you which of them received your data. Where a transfer to a country outside the European Economic Area takes place, it rests on an adequacy decision (the EU-US Data Privacy Framework for certified companies) or on the European Commission's standard contractual clauses with supplementary measures. Copies of the safeguards are available on request.

- Recordings in your browser: until you delete them or clear the site's data; the recorder keeps the last five takes unless you set it to 3, 10 or 20. - Hosted recordings: the workspace's retention window (section 7), or until deleted; after a plan or trial ends without a plan following, 30 days. - Account, profile and workspace settings: until the account or workspace is deleted. - Watch progress, audience lists, notifications: until the meeting or workspace is deleted. - Audit log: 365 days. - Legal-acceptance records: the life of the account or workspace. - Server logs: a short period, for security and fault finding. - Analytics events: without a persistent identifier, for as long as they help us understand how the product is used. - Recording statistics: kept; the link to your account or workspace is removed when that is deleted. - Support conversations: at most three years. Trust Center access requests: two years. - Newsletter: until you unsubscribe; the record of your consent at most three years after that; the address on the block list for as long as we send newsletters. - Business details and the evidence of the VAT check: the life of the contract, then with the accounting records; for reverse-charge invoices, in a separate archive until the end of the tenth year after the VAT ID is replaced or the workspace deleted. - Payments taken back by a bank or card issuer: until the workspace is deleted; the payment service provider keeps its own record. - Invoices and accounting records: as commercial and tax law require (§147 AO, §257 HGB), at present eight years for invoices and other accounting vouchers and ten years for books and annual accounts. - Snapshots of the database server taken by its operator: a limited period, then overwritten. - Daily backups of the database server, kept with a separate storage provider in the EU: 30 days, locked against change and deletion, then deleted.

You have the right to access the personal data we hold about you (Art. 15 GDPR), to have it corrected (Art. 16), deleted (Art. 17) or its processing restricted (Art. 18), to receive the data you gave us in a portable format (Art. 20), and to withdraw a consent at any time with effect for the future (Art. 7(3)). You have the right to object at any time, for reasons arising from your particular situation, to processing we base on a legitimate interest (Art. 21 GDPR). That covers the analytics, the recording statistics, the server logs and the audit log described above. Write to hello@capme.app; we will stop unless we can show compelling legitimate grounds. We answer within one month. We do not make automated decisions with legal effect about you. You are not obliged to give us personal data. Without the data a form marks as required, we cannot create an account, sell a plan or answer a request. You may complain to a supervisory authority, in particular the one responsible for us: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2-4, 40213 Düsseldorf, https://www.ldi.nrw.de.

Connections are encrypted in transit and hosted recordings at rest. Bucket credentials a workspace gives us are encrypted with a key held only on our servers. Access to production systems is limited to the people who operate the service and requires multi-factor authentication. The full list of technical and organisational measures is Annex III of the Data Processing Agreement and the TOMs tab of the Trust Center. Report a vulnerability to hello@capme.app or per https://capme.app/.well-known/security.txt.

We update this notice when the processing changes, before the change goes live. Every version carries a version number and a date, the current one is always at https://capme.app/privacy, and we point out a change inside the product. Superseded versions are available on request.