Privacy Policy

1. Who We Are

Capci is operated by Techtrapture Private Limited, a company incorporated under the Companies Act, 2013 and registered in India. This Privacy Policy explains what personal information we collect, why we collect it, and how you can control it when you use the Capci platform, website, and APIs (the "Service").

Techtrapture Private Limited is responsible for the personal data processed through the Service and is committed to handling it in accordance with applicable privacy laws. If you do not agree to this policy, do not use the Service.

2. Information We Collect

We collect information in three ways:

• You provide it: Email, name, and profile photo via Google sign-in; the ideas, prompts, and text you submit; the brand assets you upload (such as your logo, colours, and fonts); the content you generate and save; and any messages you send to our support team.
• Automatically: IP address, browser type, device info, approximate location (derived from IP, not GPS), pages visited, features used, generation activity, session duration, and server logs.
• Third parties: Google provides your verified email and display name upon sign-in. Razorpay provides payment and subscription status; we never receive or store card numbers or bank details.

We use secure identity tokens for session management. We do not use analytics cookies, advertising pixels, or cross-site tracking.

3. How We Use Your Information

We use your information solely to operate and improve the Service: signing you in, generating and storing your content, managing your plan and usage limits, processing billing, and sending transactional emails such as billing notices. We do not send marketing emails without your opt-in.

We do not sell, rent, or trade your personal information. We do not use it for advertising. Like any cloud-hosted SaaS product, operating the Service requires us to work with a small set of trusted infrastructure, AI, and payment providers. These are not data-sharing partners; they act only on our instructions to deliver the Service:

• Google Cloud Platform: our cloud infrastructure provider for hosting and storage of your account data and generated content
• Google: sign-in (you authenticate directly with Google; we receive only your verified email and display name)
• Third-party AI model providers: when you generate content, your prompts and the brand inputs needed to fulfil the request are sent to AI providers for image and text generation. We send only what is necessary to produce your content; these providers process it under their own terms and do not use it to train their models on a basis we have not agreed to
• Razorpay: payment processing; we never see your card or bank details. Governed by Razorpay's Privacy Policy

4. How We Protect Information

We use administrative and technical safeguards including:

• Encryption in transit: all data is encrypted using TLS 1.2+ between your browser and our servers
• Encryption at rest: all stored data is encrypted using AES-256
• Account isolation: your content and brand assets are scoped to your account and are not accessible to other users
• Authentication: every request is verified against a secure identity token; credentials are never stored on our servers
• Access control: permissions ensure users only access data they are authorised to see
• Audit logging: administrative and data-modifying actions are logged with user, timestamp, and IP address
• Sensitive data protection: sensitive operational information such as API keys is protected using a combination of managed secrets vaults and envelope key encryption, ensuring it is never stored or accessible in plain text

Physical infrastructure security is managed by Google Cloud Platform (ISO 27001, SOC 2 certified). Security is a shared responsibility between you and us. No system is 100% secure, and we cannot guarantee absolute security. In the event of a data breach affecting your personal data, we will notify you without undue delay and as soon as reasonably practicable after becoming aware, in accordance with applicable law.

5. Data Storage & Cross-Border Transfer

Techtrapture Private Limited is incorporated in India. To deliver the Service globally, your data may be stored and processed outside India, including in the United States, using reputable cloud infrastructure and AI providers. By using the Service, you consent to this transfer.

We ensure that any such transfer is subject to appropriate safeguards consistent with applicable law.

6. Data Retention & Deletion

We retain personal data only as long as necessary to provide the Service or as required by applicable law. Your account data, brand assets, and saved content are retained while your account is active and deleted when your account is removed. Billing and financial records are retained as required by law. Logs and operational data are purged periodically.

When you delete your account, we immediately remove your content, brand assets, and profile from the live Service so they can no longer be accessed or generated from. As part of this process, a copy of your content is moved to an isolated archive that is not connected to any part of the live Service and cannot be surfaced back to you or anyone else. This archive is retained for up to 90 days as a safeguard against accidental or fraudulent deletion, and is then permanently and automatically purged. Billing and financial records are retained separately as required by law.

Activity log retention: User data is deleted from the app as described above. Separately, we retain internal activity/audit logs (e.g. generation timestamps and system metadata) for security and audit purposes.

Audit metadata retention: To prevent abuse of our free plan and for internal security auditing, we retain a minimal set of metadata (specifically your registered email address) even after an account is deleted. This metadata is used solely for free-plan eligibility verification and fraud prevention. It is never shared with third parties, never used for marketing purposes, and is accessible only to authorised platform administrators.

To request deletion of your personal data, email legal@techtrapture.com.

7. Third-Party Service Providers

We work with a limited set of trusted third-party providers to operate the Service. Google provides our cloud infrastructure, storage, and authentication. Third-party AI model providers power content and image generation. Razorpay handles payment processing. These providers are bound by their own privacy policies and process data only as necessary to deliver their services.

8. Your Rights

You have the following rights in respect of your personal data:

• Access: request a summary of the personal data we hold about you and how it is being processed
• Correction: request correction of inaccurate or incomplete personal data
• Deletion: request erasure of your personal data, subject to our legal retention obligations
• Portability: request a copy of your personal data in a structured, machine-readable format
• Withdrawal of consent: withdraw consent at any time, without affecting the lawfulness of prior processing
• Grievance redressal: raise a complaint with our contact below if you believe your data rights have been violated

To exercise any of the above rights, email legal@techtrapture.com. We will respond within a reasonable time and in accordance with applicable law.

The Service is not directed at individuals under 18 years of age. We do not knowingly collect personal data from minors. If you believe a minor's data has been submitted, contact us immediately for deletion.

9. Changes to This Policy

We may update this policy from time to time. When we make material changes, we will notify you within the Service or by email. The date at the top indicates the last revision. Continued use after changes constitutes acceptance.

10. Grievance Officer & Contact

For any concerns or complaints regarding the handling of your personal data, you may contact our designated point of contact:

If you are not satisfied with our resolution, you may approach the Data Protection Board of India once constituted under the DPDPA, 2023.