Legal
Privacy notice
Pre-launch notice. Kapel.ai is an auto-entreprise operating from Paris, France. The complete legal identity and postal address will be published before commercial activation.
1. Who controls your data
Kapel.ai is the controller for the account, dashboard, usage, support, and billing information described here. For confidential privacy requests, contact [email protected].
2. Data we process
- Identity: the identity provider, its immutable account identifier, display name, and email address supplied by Google or GitHub.
- Account and organization: memberships, roles, API-key metadata, security events, and account status.
- Service usage: request identifiers, model, token/usage measurements, timestamps, outcome, credits, and operational diagnostics.
- Payments: Stripe customer, subscription, invoice, payment, refund, and dispute references. Kapel does not store full payment-card details.
- Technical data: IP address, browser and protocol metadata, security logs, and strictly necessary session identifiers.
- Inference content: supported prompts are processed in memory to provide the service and are not intentionally persisted in application logs or databases.
3. Why we process it
We process data to authenticate users, operate organizations and API access, provide and secure inference services, account for usage, administer payments, prevent abuse, respond to requests, satisfy legal obligations, and establish or defend legal claims. Depending on the activity, the legal basis is performance of a contract or pre-contractual steps, legitimate interests in operating and securing the service, compliance with law, or consent where specifically requested.
4. Social sign-in
Customer authentication uses Google or GitHub. Kapel binds an account to the provider's immutable issuer and subject identifiers, not merely to an email address, and does not automatically merge accounts because their email addresses match. Kapel requests basic profile and email information only; it does not request access to repositories, Gmail, Drive, or similar content.
5. Recipients and infrastructure
Data may be processed by service providers used for hosting, identity, edge security, payments, and GPU execution, including Google or GitHub when you choose that identity provider, Cloudflare, Stripe, the VPS provider, and selected GPU infrastructure providers. Inference content may be processed transiently on hosted GPU infrastructure. Access is restricted to what is needed to provide and protect the service.
6. Retention
- Prompt and inference response: memory only, with no intentional persistence.
- Request metadata and usage records: up to 24 months.
- Security and authentication audit records: up to 12 months.
- Operational logs: normally up to 30 days.
- Aggregated content-free metrics: up to 13 months.
- Active identity data: for the account lifetime.
- Disabled or deleted identity contact data: deleted or anonymized within 30 days unless longer retention is legally required.
- Payment and accounting records: retained for the period required by French law, which may be up to 10 years.
7. International processing
Some providers may process data outside France or the European Economic Area. Where required, Kapel relies on an adequacy decision, standard contractual clauses, or another lawful transfer mechanism.
8. Your rights
Subject to applicable law, you may request access, correction, deletion, restriction, portability, or objection, and may withdraw consent without affecting earlier lawful processing. Contact [email protected]. We may need to verify your identity. You may also complain to the CNIL.
9. Cookies and local storage
Kapel uses only storage necessary for authentication, security, and maintaining a dashboard session at this stage. No advertising cookies are used. This notice will be updated before introducing optional analytics or other non-essential tracking.
10. Changes
We may update this notice as the service develops. Material changes will be identified by a revised date and, where appropriate, communicated in the dashboard.