Privacy Policy

This Privacy Policy explains how Social Intents, LLC ("Social Intents", "we", "us") collects, uses, and shares personal data in connection with CapyScout (the "Service"). It covers both people who use the Service (customers) and individuals whose business contact data may be processed through the Service.

1. Data we collect

• Account data: name, work email, password hash, and billing details when you register or subscribe.
• Usage data: log data, device and browser information, API call metadata, and product interactions.
• Input data: email addresses and optional context (domain, source, message) you submit for enrichment.
• Enrichment data: business information we compile from public sources, third-party providers, and automated models about companies and professional contacts.

2. How we use data

• To provide, operate, secure, and improve the Service.
• To generate enrichment results, scores, and recommended actions.
• To bill you, provide support, and communicate about your account.
• To detect abuse, enforce our Terms, and comply with legal obligations.

3. Third-party enrichment sources

To build company and professional-contact enrichment, we obtain data from third-party providers and public sources (see our sub-processors page). The categories of personal data we may process about a professional contact include name, job title, seniority, professional social profiles (such as LinkedIn), business location, employer/company, and - where enabled - a business phone number. Because this data is not always collected directly from the individual, we provide this notice in line with Article 14 of the GDPR. You can ask us to access, correct, delete, or stop processing this data at any time using our data request form.

4. Google user data and Limited Use

Connecting a Google account is optional. If you connect Google Calendar, CapyScout requests read-only scopes only (calendar.events.readonly and calendar.calendarlist.readonly, plus openid and email to label the connection). CapyScout never creates, edits, or deletes anything on your calendar.

• What we access: for upcoming events on the calendars you select, the event title, start time, organizer, and attendee email addresses and display names. Events with no attendees from outside your own company are ignored, as are personal mailbox domains such as gmail.com.
• What we use it for: a single purpose, which is producing the pre-meeting brief you asked for. We derive the outside company's domain from attendee addresses, research that company from public and third-party business sources, and assemble the brief.
• What we store: the event id, title, start time, attendee list, and the generated brief, so you can re-read it in the app. OAuth tokens are encrypted at rest.
• What we share: we do not sell Google user data or share it for advertising. Limited meeting context is sent to our AI sub-processor as described below.
• Deletion: disconnecting the calendar in Settings revokes and deletes the stored tokens. You can delete stored briefs, or request full deletion through our data request form.

CapyScout's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.

5. Outlook and Microsoft 365 calendar data

Connecting a Microsoft account is optional and works the same way. CapyScout requests the read-only Microsoft Graph permission Calendars.ReadBasic, which excludes event bodies and attachments, plus openid, email and profile to label the connection and offline_access to keep the connection alive. CapyScout never creates, edits, or deletes anything on your calendar, and never requests access to your mail, files, or contacts.

The data we access, what we use it for, what we store, and how deletion works are identical to the Google Calendar section above, and the same AI restrictions in the next section apply.

6. Slack app

Installing the CapyScout app in a Slack workspace is optional. This section explains what the app stores, what it reads, and how deletion works. It applies to the workspace that installs the app and to the people in it who use the app.

• What we store: the workspace ID and name; the bot token Slack issues for the workspace, encrypted at rest; the Slack user IDs and email addresses of people who use the app, so we can match each of them to their CapyScout login; the IDs of the channels you choose for CapyScout posts; and references (channel and message IDs) to messages the app posted, so it can update them and keep one thread per company. We do not store the text of your Slack conversations.
• What we read: only messages you send to CapyScout in its direct message or the Ask CapyScout pane, a message you run a CapyScout shortcut on, and links to capyscout.com shared in your workspace. The app does not request permission to read channel history and never reads your channels or other conversations. It reads the names and email addresses of people in your workspace only to match them to their CapyScout logins.
• How we use it: to run the actions you ask for in Slack, to send each person their own tasks and replies, and to post the updates you set up to the channels you choose. Actions in Slack use the same credits as the Service.
• Signup: when you install the app without a CapyScout account, we use the email address of the person installing it, as provided by Slack, to fill in the CapyScout signup form. You can change it before you create the account.
• AI: when you ask CapyScout a question in Slack, the question is sent to our AI sub-processor solely to answer it, under the same restrictions as in section 8. We do not use Slack data, including message text, to train or improve any AI or machine learning model, ours or anyone else's.
• Sharing: we do not sell Slack data or share it for advertising.
• Retention and deletion: when the app is uninstalled, the tokens are revoked, or you click Disconnect in CapyScout, we delete the Slack tokens immediately. Slack-linked people (the match between Slack users and CapyScout logins) and references to messages the app posted are removed within 30 days. You can request earlier or full deletion through our data request form. Help with the app is at Slack app support.

7. CapyScout for Chrome

The CapyScout Chrome extension is optional. It shows what CapyScout knows about the company or person on the page you are viewing, and lets you add them to your CapyScout campaigns, lists and watched companies. This section explains what it reads, what it sends, and what it stores.

• When it reads a page: only when you click the CapyScout icon, use its keyboard shortcut, or choose "Look up with CapyScout" from the right-click menu, and only on that one tab. It has no content scripts and does not read pages in the background. If you turn on the optional "Follow my tabs" setting, it looks up the website address (domain) of each tab you switch to, and never the page contents; you can turn this off at any time.
• What it reads and sends to CapyScout: on a company website, the website's domain and the site's own name; on a LinkedIn profile or company page, the page address and the name, headline and current company shown at the top of the page; in Gmail, the sender's email address and name of the email you have open. The subject and the first 2,000 characters of the latest message in that email are sent only when you click "Analyze this email". Text you type into the extension's search box is sent to look it up.
• What it does not collect: your browsing history, the pages you visit without clicking the icon, your Gmail inbox or other emails, your contacts, or anything from other tabs. It does not use the Gmail API and never sends email on your behalf; "Insert into reply" only places text in a reply box you have open.
• What we store: lookups are handled like any other request to the Service and recorded in your account's normal activity and API call logs. Companies and people are saved to your account only when you choose an action such as "Add to campaign", "Watch", or "Save to a list". The extension stores its sign-in tokens and your settings in your browser; sign-in tokens are kept on our servers only as one-way hashes.
• How we use it: solely to provide the extension's single purpose: looking up companies and people in CapyScout and acting on them. When you click "Analyze this email", the sender's address and the message excerpt are sent to our AI sub-processor to write the analysis and suggested reply, under the same restrictions as in section 8.
• Sharing and sale: we do not sell data from the extension, use it for advertising, or use it to determine creditworthiness or for lending. The use of information received from the extension adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.
• Signing out and deletion: signing out in the extension, or choosing "Sign out everywhere" under Settings, ends its sessions immediately. Removing the extension deletes everything it stored in your browser. You can request deletion of account data through our data request form.

8. AI and machine learning

CapyScout uses third-party large language models to write briefs and summaries. When you request a pre-meeting brief, we send the model a limited prompt containing the meeting title, the outside attendees, and the business facts we compiled about their company. When you analyze an email with the Chrome extension, we send the sender's address and the message excerpt described in section 7.

We do not use, transfer, or sell calendar or mailbox user data from Google or Microsoft, whether raw, aggregated, or derived, to develop, train, test, or improve foundational or generalized artificial intelligence or machine learning models. Data from Google Workspace APIs and Microsoft Graph is transferred to our AI sub-processor solely to provide the user-facing feature you requested, under contractual terms that prohibit the sub-processor from using it to train or improve its models. We do not use this data to train any model of our own, and we do not retain it for any purpose beyond the ones described in this Policy.

9. Cookies

We use strictly necessary cookies to operate the Service (for example, to keep you signed in). With your consent, we may use optional cookies to understand product usage. You can accept or reject optional cookies via the banner shown on your first visit, and change your mind by clearing your browser storage for this site.

10. Legal bases

Where required, we process personal data based on your consent, our contract with you, our legitimate interests in operating and improving a business-to-business service, and compliance with legal obligations. Enrichment of professional contact data relies on legitimate interests balanced against the rights of the individuals concerned.

11. Sharing

We share data with service providers (for example, hosting, data enrichment, payment processing, and analytics) under contract, and with authorities where legally required. We do not sell personal data. Enrichment providers are used to compile business information and are bound by their own terms.

12. Retention

We retain account data for as long as your account is active and as needed to comply with legal obligations. Enrichment results are cached to avoid duplicate processing and refreshed or deleted according to internal retention windows. You may request deletion as described below.

13. Security

We use administrative, technical, and organizational measures to protect data, including hashing of secrets and API keys, encryption in transit, and access controls. No method of transmission or storage is fully secure, and we cannot guarantee absolute security.

14. Your rights

Depending on your location, you may have rights to access, correct, delete, or restrict processing of your personal data, and to object to certain processing or request portability. Individuals in the EU, UK, and similar jurisdictions can find more detail on our GDPR page. To exercise any of these rights - including opting out of enrichment processing - use our data request form. We may need to verify your identity before completing certain requests, and we aim to respond within 30 days.

15. International transfers

We may process data in the United States and other countries. Where required, we use appropriate safeguards such as standard contractual clauses (and, where applicable, the EU-US Data Privacy Framework) for cross-border transfers.

16. Children

The Service is intended for business use and is not directed to children under 16. We do not knowingly collect data from children.

17. Changes and contact

We may update this Policy from time to time; the "last updated" date reflects the latest revision. For privacy questions or requests, use our data request form or contact Social Intents, LLC via socialintents.com.