Privacy Policy
Last updated: August 19, 2026.
1. Data controller
The controller of personal data processed through the Caply website and dashboard is the operator of the Caply service available at trycaply.com. Contact: privacy@trycaply.com.
2. What we collect
Account data: email address, name and avatar if you sign in with Google, authentication identifiers, billing email via Stripe. Workspace metadata: name, domain, plan. Event data you send through the SDK, script, or API — which may include hashed or unhashed identifiers (email, phone, name, location), cookies _fbp/_fbc, IP address, user agent, and conversion values. Scan URLs you submit while signed in.
3. Why we process it (GDPR/RODO)
Account and billing data: performance of a contract (Art. 6(1)(b)). Security, fraud prevention, and service improvement: legitimate interest (Art. 6(1)(f)). Event data: we act as a processor on your instructions (Art. 28). You are the controller of your customers' data and must have a lawful basis (typically consent or legitimate interest) before sending identifiers to Caply and Meta.
4. Recipients and subprocessors
Supabase (database and auth), Google (optional sign-in), Vercel (hosting), Stripe (payments), Upstash (rate limiting), Browserless (optional deep scans), and Meta Platforms (Conversions API / Pixel) when you connect a Pixel. Event payloads are hashed before they are sent to Meta.
5. Retention
Account data is kept while the account is active and deleted on request where legally possible. Event logs are retained to operate delivery, retries, and usage metering, then deleted or aggregated. Billing records follow Stripe and tax retention rules.
6. Your rights
You may request access, rectification, erasure, restriction, portability, and objection. Contact privacy@trycaply.com. You may lodge a complaint with your supervisory authority (in Poland: UODO).
7. Transfers
Some subprocessors are in the United States. Transfers rely on Standard Contractual Clauses and the subprocessors' published transfer mechanisms.