capslane

Privacy Policy

This policy explains which personal data Capslane processes, for which purposes, for how long and how you can exercise your rights.

Last updated September 9, 2026

1. Data controller

Capslane is operated by Luca Deguin, an individual entrepreneur trading as Webba Creative Technologies, SIREN 905 048 922, SIRET 905 048 922 00041, with a registered office at 13 rue Paul Bert, 94130 Nogent-sur-Marne, France.

Privacy requests can be sent to luca.deguin@webba-creative.fr.

2. Data we process

  • Account data: your Webba ID identifier, name and email address.
  • Workspace data: workspace name, preferences, plan, membership and API key metadata. API key secrets are stored as one-way fingerprints.
  • API activity: request identifiers, YouTube video identifiers, selected options, response status, source, latency, cache status and usage units.
  • Transcript data: captions and generated transcript segments needed to return results and operate the shared cache. Full transcript text is not written to technical request logs.
  • Billing data: Stripe customer, subscription and invoice identifiers. Capslane does not store payment card details.
  • Security data: session identifiers, timestamps, IP-related server logs and events needed to protect accounts and the API.
  • Acquisition data: the first public Capslane page in a navigation, the page used to start authentication, an observable referring domain and limited campaign parameters. A short-lived navigation parameter carries this context between public pages and is removed from the address bar when each page loads. It contains no visitor identifier and uses neither local storage nor session storage. This context is linked to a workspace only when authentication creates that workspace. Hidden or unavailable sources remain unknown.
  • Site analytics: pages visited, clicks, scrolling, browser and device information, approximate location and masked session recordings used to understand how the public website and dashboard are used.

If you use the documentation chat on a public page, your messages and the conversation history needed to answer are sent to Context7. Loading the widget also connects your browser to Context7. Do not submit API keys, transcripts or other private information in this chat.

3. Purposes and legal bases

  • Provide the account, API, transcripts, support and paid plan: performance of the contract or steps requested before entering into it.
  • Process payments and maintain invoices: performance of the contract and compliance with accounting and tax obligations.
  • Secure accounts, prevent abuse, enforce quotas and diagnose incidents: our legitimate interests in operating a safe and reliable service.
  • Measure and improve Capslane: our legitimate interest in understanding navigation problems and improving the service. Clarity is configured without analytics cookies.
  • Respond to rights requests and lawful authority requests: compliance with legal obligations.

Account identity and submitted video information are required to create a workspace and process an authenticated request. Without them, Capslane cannot provide those services. Billing information is required only for a paid plan. Language and output preferences are optional and only change the requested result.

4. Roles and recipients

Webba Creative Technologies is the controller for account administration, security, usage and billing data. When a customer submits personal data contained in a video or transcript for its own purposes, that customer is responsible for its lawful use and Capslane processes the submitted content on the customer's instructions.

Access is limited to authorised Webba personnel and the providers needed to run Capslane:

  • Webba ID: identity and sign-in;
  • Stripe: checkout, subscription management, invoices and payments;
  • OVH SAS: infrastructure hosting in France;
  • YouTube and Google services: access to the public video resources requested by the customer.
  • Microsoft Clarity: privacy-preserving site analytics, heatmaps and masked session recordings.
  • Context7, operated by Upstash: the documentation chat on public pages. See the Upstash privacy policy for its data practices.

We do not sell personal data and do not use it for third-party advertising.

5. Hosting and international transfers

The service is hosted by OVH SAS, a simplified joint-stock company with capital of EUR 50,000,000, registered with the Lille Metropole Trade and Companies Register under number 424 761 419 00045, at 2 rue Kellermann, 59100 Roubaix, France.

OVH hosts the core service in France. Some providers, including Stripe, Google or Microsoft, may process data outside the European Economic Area. Where required, those transfers rely on an adequacy decision, the European Commission's standard contractual clauses or another safeguard recognised by applicable data protection law.

6. Retention

  • Account and workspace data is retained while the workspace is active and then for the time needed to close the account, resolve disputes and meet legal obligations.
  • Dashboard sessions expire after seven days and are deleted when you sign out.
  • When you continue from an inspection, a signed essential cookie keeps only the video ID and selected language for up to thirty minutes, including during sign-in. It is cleared after an accepted Playground request or sign-out. It contains no transcript text or API key.
  • Public acquisition context expires after thirty minutes. Its authentication cookie expires after ten minutes and is cleared after a successful callback. Workspace acquisition events support aggregate activation and retention reports.
  • Native transcript cache entries expire after 30 days. Generated transcripts are retained while needed to return or deduplicate requested results, or until they are deleted or superseded.
  • Request logs and usage records are retained for service operation, quota verification, security and dispute handling. Their retention is reviewed according to the workspace's activity and those operational needs.
  • Invoices and accounting records are retained for ten years where French law requires it.

7. Your rights

You may request access, correction, deletion, restriction or portability of your personal data. You may object to processing based on legitimate interests. When processing relies on consent, you may withdraw it at any time without affecting earlier processing.

Send requests to luca.deguin@webba-creative.fr. We may request information needed to verify your identity. You may also lodge a complaint with the CNIL, the French data protection authority.

8. Cookies, security and automated decisions

Capslane uses essential cookies for authentication, session continuity, OAuth security and short-lived attribution across the authentication redirect. Microsoft Clarity is configured without analytics cookies. It collects pseudonymous interaction data to produce aggregate usage statistics, heatmaps and masked session recordings. Capslane does not use advertising cookies or cross-site tracking.

Connections are encrypted, API keys are protected at rest and administrative access is restricted. Sensitive form fields are excluded or masked in analytics recordings.

Capslane does not make decisions based solely on automated processing that produce legal or similarly significant effects for users.

9. Changes

We may update this policy when the service or its data processing changes. The date at the top of this page identifies the current version.