Privacy Policy

1. Information We Collect

Website forms: If you subscribe, we store your email and consent record to receive news and launch announcements. If you request information, we store your name, company (optional), email, message and acceptance to respond to your request. Sending an inquiry does not subscribe you to news. Forms are processed through Vercel and their data is stored in Supabase, without public access to the records. You can request to unsubscribe or delete this data at [email protected].

Account information:

• Name, email address, and password (for email registration)
• Name and email provided by Google or Apple when signing in with those services

Inventory content:

• Photos of objects you capture or upload
• Names, descriptions, notes, dimensions, barcodes, and operational categories of your items
• Names and descriptions of your spaces and inventories
• Voice recordings you initiate for dictation, processed temporarily to transcribe and extract inventory data

Usage information:

• Activity logs within the app (inventory creation, scans, etc.)
• Technical device and session information such as model, operating system, notification token, and error diagnostics
• IP address and connectivity data through our infrastructure and monitoring providers

Location data:

• Approximate or precise location when you enable it to record a space address or use nearby features inside Agenda. We do not collect background location.

2. How We Use Your Information

• Provide and maintain the inventory service
• Process images with AI to identify and describe objects (OpenAI service)
• Transcribe and process voice notes to add items to the inventory
• Authenticate your identity and keep your session secure
• Send notifications you authorize (reminders, inventory alerts)
• Process subscription payments via RevenueCat, Apple, or Google
• Monitor technical errors and improve application stability
• Resolve addresses, maps, and nearby place searches when you request them
• Comply with applicable legal obligations

3. Permissions We Request

• Camera: To photograph inventory items and scan barcodes
• Microphone: To record your voice when using inventory dictation
• Photos / Gallery: To select existing images from your device
• Location: To record a space's address (only when you request it)
• Notifications: To send alerts and reminders you configure
• Vibration: For haptic confirmation when scanning

Each permission is requested at the moment you need it. You can revoke them at any time from your device settings.

4. Third-Party Services

Captory uses the following external services. By using the app, you are also subject to their policies:

• Supabase — Database and authentication. Privacy Policy
• OpenAI — AI image, text, and audio processing. Content sent to the API is not used for training by default unless the provider account explicitly opts in. Data Policy
• Google Sign-In — Authentication with Google accounts. Google Privacy Policy
• Apple Sign-In — Authentication on iOS devices. Apple Privacy Policy
• RevenueCat — Subscription and payment management. Privacy Policy
• Google Maps Platform — Maps, routes, and nearby place search in specific Agenda features. Google Privacy Policy
• Expo Notifications — Push notification registration and delivery. Privacy Policy
• Sentry — Error and stability monitoring. Privacy Policy

International data transfers: To operate Captory, your data is stored and processed on servers of technology infrastructure providers located outside your country of residence, mainly in the United States. We require these providers to maintain contractual, technical, and organizational protection measures equivalent to those described in this Policy and to those required by the data protection law applicable to you.

5. Data Sharing

We do not sell, rent, or share your personal information with third parties for marketing purposes. We may share your information only in the following cases:

• With the service providers listed above, strictly to operate the app
• If required by law, court order, or competent authority
• To protect the safety of users or others in case of threat
• To report illegal content to the competent authorities where required by law; in particular, any child sexual abuse or exploitation material (CSAM) is reported to the National Center for Missing & Exploited Children (NCMEC) and/or authorities, preserving records as required by law
• In the event of a merger or acquisition, with prior notice to users

6. Data Retention

We retain your account and inventory information while your account is active or as long as it is needed to provide the service. If you delete content inside the app or request deletion of your account, we will remove or anonymize the relevant information unless legal, tax, contractual, fraud-prevention, or security obligations require longer retention of certain records.

Technical evidence, error logs, operational metadata, and backups may remain for a limited additional period before secure deletion or overwrite. Billing and transaction records may be retained for the period required by applicable law.

You can currently request account deletion from Settings > Delete account inside the app or by emailing [email protected]. We typically acknowledge requests within 10 business days and aim to complete verified deletion requests within 30 days, subject to identity verification and applicable legal exceptions.

7. Your Rights

You may request to access your personal data, rectify it (correct or complete it), delete it, object to certain processing, and request a portable copy of your data by contacting us at [email protected]. To protect your account, we may request reasonable identity verification before carrying out sensitive requests, and we will respond within the time frames required by applicable law.

If you are in Chile (Law 19.628 / Law 21.719): Your data is processed under Law No. 19.628 and, from December 1, 2026, under Law No. 21.719. You have the rights of access, rectification, deletion (cancellation), objection, blocking, and portability. If you believe your rights have not been respected, you may file a claim with the Personal Data Protection Agency (Agencia de Protección de Datos Personales).

If you are in Mexico (LFPDPPP): You have the right of Access, Rectification, Cancellation, and Opposition (ARCO rights) over your personal data. We will respond within 20 business days.

If you are in California, United States (CCPA): You have the right to know what personal data we collect, to request its deletion, and not to be discriminated against for exercising these rights. We do not sell personal data.

If you are in Brazil (LGPD): Processing is governed by the General Data Protection Law. You may exercise confirmation of processing, access, correction, portability, and deletion and, where applicable, file a claim with the National Data Protection Authority (ANPD).

8. Security

We implement technical and organizational measures to protect your information: encryption in transit (TLS), secure authentication with encrypted session tokens, and per-user data access control. However, no system is 100% secure. We recommend using a strong password and not sharing your credentials.

9. Children

Captory is not directed to children under 13 years of age. We do not intentionally collect information from minors. If you are a parent or guardian and believe your child provided us with data, contact us to have it deleted.

10. Changes to This Policy

We may update this policy periodically. We will notify you within the app or by email of significant changes. The "last updated" date at the top of the document indicates the current version. Continued use of the app after changes implies acceptance of the new policy.

11. Contact

For questions, ARCO rights requests, or any privacy inquiries:

• Service operator / data controller: Captory App
• Email: [email protected]
• Website: captoryapp.com