← Legal hub

Legal · Effective September 26, 2026

Privacy Policy

CaptivaHQ (“CaptivaHQ”, “we”, “us”) is an Enterprise Operating System operated by United Technology Services Inc. (“UTS”). This policy describes how we handle information while CaptivaHQ is in beta. Because the product is still evolving, this policy will evolve with it; we will post changes here and update the effective date above.

1. Beta status

CaptivaHQ is offered as a beta service. Features, data models, and the information we collect may change without notice. Do not use the beta to store data you cannot afford to lose, re-create, or expose to occasional bugs.

2. Information we collect

• Account information. Name, work email address, organization name, and any authentication identifiers you provide when requesting or accepting beta access.
• Content you put into the product. Records you create or import — contacts, accounts, opportunities, projects, invoices, documents, and the like.
• Usage telemetry. Pages visited inside the product, feature use, performance metrics, and error reports. We use this to fix bugs and decide what to build next.
• Device and log data. IP address, browser, operating system, and standard server logs.
• Billing information. If you subscribe or start a trial, the billing contact, company name, address and tax details you give us, and a record of your plan, invoices and payments. Card details are collected and stored by our payment processor, Stripe; we receive only a token, the card brand, the last four digits and the expiry date.
• AI usage records. The number of AI units (tokens) each workspace and feature consumes, when, and through which feature, so we can meter usage, show your balance and enforce fair use. Short, redacted previews of model calls are kept for troubleshooting and abuse monitoring (see Section 5).
• Beta registration requests. If you submit the registration form on one of our industry pages (such as /skilled-trades or /manufacturing), we collect the name, email address, company name, and optionally the phone number and website you enter, along with the answers you give about your business — your trade, area or line of business, approximate headcount, the type of work you take on, and the systems you use today. We also record the campaign parameters in the link you arrived on, the referring page, your browser timezone, and two anti-spam signals (whether a hidden field was filled and how long the form took). Submitting the form requires completing a Cloudflare Turnstile challenge; Cloudflare processes your IP address and browser characteristics to decide whether you are a person, and returns only a pass/fail token to us. We record your agreement to these terms: the exact sentence shown to you, its version, and the time you accepted it.

The registration form is the only form on this website. It is submitted only when you press “Request access”, and we do not ask for payment details anywhere on this site.

3. Google Workspace integration — how we handle Google user data

If you choose to connect your Google account to CaptivaHQ (for example, to bring your Gmail conversations and Google Calendar into the CRM), we request access to specific Google API scopes on your behalf. CaptivaHQ's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements that apply to Gmail and Calendar data.

What we request from Google, and why:

How we protect Google user data. Gmail messages, calendar events, and the OAuth refresh tokens that let us reach the Google APIs are transmitted over TLS and encrypted at rest using AES‑256. Tokens and message bodies are accessible only to the CaptivaHQ services that need them to render your CRM. Access by CaptivaHQ personnel is least‑privilege, audit‑logged, and limited to (a) responding to a support request you have filed, (b) investigating a suspected security incident, or (c) satisfying a legal obligation.

How we share Google user data. We do not sell or rent Gmail or Calendar data. We share it only with the infrastructure sub-processors that host and operate CaptivaHQ on our behalf (our cloud database provider, our hosting provider, and the LLM provider that powers AI features inside the product) under written agreements that require equivalent protection and that forbid those providers from using your data for their own purposes. We never transfer Google user data to data brokers, advertising networks, or any third party for that third party's own use.

How we retain and delete Google user data. We retain copies of the Gmail messages and calendar events we sync only while your Google integration is connected and your CaptivaHQ account is active. You can disconnect the Google integration from Settings → Integrations inside the product at any time; doing so revokes our access immediately and deletes the synced Gmail and Calendar data from your CaptivaHQ tenant within 30 days. You can also request deletion at any time by emailing [email protected], and you can revoke CaptivaHQ's access directly from your Google Account permissions page. Retention beyond 30 days only occurs where required by law or to resolve an active security incident; backup copies expire on our standard backup-retention cycle.

Limited Use — what we will never do with Gmail, Calendar, or other Google user data. We do not:

• Sell or rent Google user data to anyone.
• Use Google user data for targeted advertising or to serve ads.
• Use Google user data to train, fine‑tune, or evaluate any generative AI or machine‑learning model, ours or a third party's, including the LLM provider that powers AI features inside CaptivaHQ.
• Allow humans to read Gmail or Calendar data, except (i) with your explicit consent for a specific message or event, (ii) where necessary for security purposes such as investigating abuse, (iii) to comply with applicable law, or (iv) for internal operations where the data has been aggregated and anonymized.
• Use Google user data for credit scoring, employment decisions, or any other purpose unrelated to delivering the CaptivaHQ features you signed up for.

4. How we use information

• Provide, operate, secure, and improve the beta service.
• Authenticate you and prevent abuse of the platform.
• Respond to your support requests and beta feedback.
• Send service-related and beta-program communications. We do not sell your data.

5. AI features

CaptivaHQ is AI-first. Content you provide may be sent to large-language-model providers we contract with to power features such as drafting, summarization, search, and extraction. We do not use your business content, and we do not use Google user data, to train third-party foundation models. We configure our providers to retain prompts and outputs only for the period required to deliver the response and provide abuse monitoring. Inside CaptivaHQ, AI transaction records expire after 7 days and the model-call log, which keeps only a redacted preview of each call, after 90 days. Metering totals are kept as billing records.

6. Where data is stored

Customer data is stored within a regional “cell” selected for your account. EU customers' data is hosted in the European Union. US customers' data is hosted in the region indicated for the US cell at sign-up. We never copy customer records between regional cells. To let you sign in from anywhere, a small platform directory — tenant and user identities, sign-in tokens and the authentication audit trail, but no customer records — is held in France for every region. The current providers and their locations are listed on our sub-processors page.

Beta registration requests submitted through this website are handled separately from product data. The form is sent to a processing function operated by United Technology Services in the United States, which emails the submission to our team and stores it in no database. The resulting email, and any reply to it, is held in United Technology Services' business mailboxes. Registration requests are not written into a regional product cell unless and until an account is created for you.

7. Sharing

We share information only with vendors who help us run the service (hosting, email delivery, LLM inference, error tracking) under written agreements that require them to protect it. The current list, with each provider's purpose and location, is on our sub-processors page. We may disclose information if required by law or to protect the safety or rights of users.

When a business customer puts personal data about its own staff, clients or contacts into CaptivaHQ, the customer is the controller of that data and we process it on the customer's behalf under our Data Processing Agreement. Requests about that data should go to the customer first; we will help them respond.

8. Cookies and analytics on this website

This marketing website (captivahq.com) uses two Google tags — Google Analytics 4, to measure how visitors find and move through the page, and Google Ads, to attribute enquiries to the advertising that produced them. They are the only third-party tags on the site, and both are off by default:

• Nothing loads until you accept. Google Consent Mode v2 is initialised with every storage type denied, including advertising storage, ad personalisation and ad user data. Neither tag is downloaded — and no cookie is set — until you choose Accept on the cookie banner. Choosing Decline loads nothing.
• Do Not Track is honoured. If your browser sends a Do Not Track signal, no banner is shown and no tag is loaded at all.
• What is measured. Page views, referrer, approximate location derived from IP by Google, device and browser type, and clicks on calls to action such as “Book a demo”. IP addresses are anonymised by Google Analytics 4 and are not stored by us.
• Advertising. The Google Ads tag records that a visit or an enquiry followed one of our adverts, so we can measure which campaigns work. Enhanced conversions are switched off — we do not send Google your email address, phone number or any other identifier you type on this site. We do not sell or share personal information for advertising, and we do not run remarketing audiences off this site.
• Changing your mind. Clear this site's data in your browser to be asked again; you can also decline at any time by clearing the stored choice.

Google acts as our processor for the analytics data and, for advertising measurement, as an independent controller under its own terms. The Cookie Policy lists every cookie and storage key by name. Nothing described in this section applies to the CaptivaHQ product itself — the application sets no advertising or analytics cookies of this kind.

Separately, the registration form is protected by Cloudflare Turnstile. It is not an analytics or advertising tag: it measures nothing about your visit, builds no profile, and is used only to tell a person from an automated script at the moment you submit the form. Because the form cannot work without it, it is treated as strictly necessary and loads whether or not you accept the cookie banner. Cloudflare acts as our processor for it.

9. Retention & deletion

You can request deletion of your beta account and associated tenant data at any time by emailing [email protected]. We will delete tenant data within a reasonable period, subject to backup-retention windows and any legal hold obligations. For deletion of Google-provided account data specifically, see Section 3 above.

Beta registration requests are kept only as the email described in Section 6, for as long as we are considering or acting on the request, and are deleted on request. To have yours removed, email [email protected] from the address you registered with, or tell us which company you registered.

10. Security

We use industry-standard administrative, technical, and physical safeguards, including encryption in transit, encryption at rest, audit logging, and least-privilege access controls. No system is perfectly secure, especially in beta — please report suspected vulnerabilities to [email protected].

11. Children

CaptivaHQ is a business tool not directed to children under 16. We do not knowingly collect personal information from children.

12. Your rights

Depending on where you live, you may have rights to access, correct, port, or delete your personal information. Contact [email protected] and we will respond within the period required by applicable law.

13. Contact

Published for CaptivaHQ by United Technology Services Inc. · All documents: captivahq.com/legal. Questions: [email protected].