Privacy Policy

1. Information We Collect

2. Use of Your Data

We use your data to:

• Provide expense categorisation and syncing
• Send invoices, receipts, and updates
• Comply with legal obligations

We do not sell or rent your data to third parties.

3. Legal Basis

Our legal basis for processing is:

• Contractual necessity (service provision)
• Legal obligation (e.g., tax compliance)
• Legitimate interest (running our service and understanding how it is used)

We rely on legitimate interest for a small set of facts about your account. We record these for our analytics whether or not you accept analytics cookies:

• that a trial started and that onboarding was completed
• billing events, such as a subscription starting or a payment failing
• your account being frozen or unfrozen
• bookkeeping steps our system carries out automatically for your business
• system operations that have no user attached, such as our servers starting or a bank statement layout we could not read

These facts are recorded against your company, not against you as a person. They carry no name, email address, IP address or device details, and we never build a personal profile from them. For a sole trader the company can be you, which is why we keep these records to the facts above. Everything else we measure about how you use Capisso is recorded only if you accept analytics cookies.

4. Data Sharing

We share data with these service providers, only for the purpose shown:

• Anthropic: AI that reads your documents and suggests categories and tax treatment.
• OpenAI: AI that reads your documents and helps match suppliers and search.
• Supabase: Our database, sign-in and document storage.
• Amazon Web Services: Sending our emails and receiving documents you email to us, in the EU (Ireland).
• TrueLayer: Connecting your bank account and reading its transactions, if you choose to.
• Twilio: Receiving documents you send by WhatsApp and verifying your phone number.
• Stripe: Subscription payments and billing.
• PostHog: Product analytics, hosted in the EU.
• Cloudflare Turnstile: Checking that sign-ups and sign-ins come from a person, not a bot.
• Google and Apple: Signing you in, if you choose to sign in with them.
• Railway: Hosting our website and servers.

Each third party is GDPR-compliant and contractually obligated to safeguard your data.

5. Mobile Apps

The Capisso iOS and Android apps use the same account as the website. This section covers what the apps do on your device.

• You can sign in with your email and password, with Google, or with Apple on iOS.
• To add a document, you can take a photo, choose photos or files, or share a file into the app from another app.
• The app uses the camera only when you choose to take a photo. It does not ask for access to your whole photo library. You pick each photo or file yourself.
• While a document uploads, the app keeps a copy on your device. If you are offline, it waits there and sends when you are back online. On iOS, the copy is removed right after it is sent. On Android, it is removed after about 7 days. Signing out removes all of them.
• We store your sign-in tokens in your device's secure storage.
• We use a hashed identifier for your device to make sure a two-factor sign-in is finished on the same device that started it.
• The apps send usage analytics and error reports only if you opt in. You can change this at any time in Settings.
• The apps do not collect your location, your contacts or advertising identifiers. They show no ads.

6. Data Security

Capisso implements encryption, access control, and secure hosting with Railway app and Supabase. We regularly audit our security practices.

7. Data Retention

We retain your data for as long as your account is active or as required by law. You can delete your account yourself at any time, as explained in Delete Your Account. You may also request deletion at any time by emailing support@capisso.ai.

8. Your Rights

Under GDPR, you have the right to:

• Access your data
• Rectify inaccuracies
• Request erasure
• Object to processing
• Withdraw consent
• Data portability

You can exercise these rights by contacting us at: support@capisso.ai

9. Cookies and Analytics

We use essential cookies to sign you in, keep you signed in, remember which business you are working in, and record your cookie choice. Capisso cannot work without them, so they are always on.

Every other cookie is off until you choose. Our cookie banner lets you accept or reject all of them, and cookie preferences let you choose by category:

• Functional: remembers your preferences, such as the businesses you opened recently.
• Analytics: helps us understand how you use Capisso (PostHog, hosted in the EU).

We do not use marketing cookies. Analytics runs only after you accept it. You can change or withdraw your choice at any time from Cookie settings, in the website footer or in your account menu in the app. Withdrawing analytics stops it straight away and removes its cookies and stored data from your browser. The account facts listed under Legal Basis are recorded whatever you choose.

10. International Transfers

Our main services run in the EU. Supabase stores our database and documents in Ireland. Our servers run on Railway in the Netherlands. Amazon Web Services processes our email in Ireland. PostHog stores our analytics data in the EU. Some of our other service providers are based in the United States, including OpenAI, Anthropic, Twilio and Stripe, so your data may be processed outside the EEA. We protect these transfers with Standard Contractual Clauses or similar legal safeguards.

11. Contact Us