Privacy Policy

CapEngage Technology Solutions Pvt. Ltd. ('CapEngage', 'we', 'our', or 'us') respects your privacy. This Privacy Policy applies to personal data collected through our website (capengage.com), SaaS application, APIs, AI autonomous agents, customer data platform (CDP), and omnichannel messaging services.

We act as a 'Data Controller' for information related to our direct business clients, website visitors, and account administrators. We act as a 'Data Processor' (or Service Provider) for Customer End-User data uploaded or synced by our business clients into our platform.

We collect information in three ways: directly from you, automatically through system usage, and through customer integration syncing.

We process personal data for the following legitimate business purposes:

• To deliver, operate, and maintain the CapEngage platform. • To orchestrate omnichannel campaign dispatches across Email, WhatsApp API, SMS, RCS, and Push notifications. • To execute autonomous AI workflows, lead scoring, and content generation configured by Customer. • To monitor infrastructure security, prevent fraudulent activity, and enforce our Acceptable Use Policy. • To process payments, manage subscriptions, and issue invoices. • To provide 24/7 technical customer support.

CapEngage incorporates advanced artificial intelligence and LLM capabilities.

• Zero Model Training Guarantee: Customer Data, PII, and campaign copy processed through our AI features are NEVER used to train, tune, or improve public or foundation AI models (such as OpenAI or Anthropic models). • Tenant Sandbox Isolation: Customer data is processed within isolated tenant execution sandboxes. Data sent to third-party LLM APIs is transmitted over encrypted enterprise connections subject to zero data-retention agreements.

Under applicable privacy laws, our processing of personal data is justified by one of the following legal bases:

1. Performance of a Contract: Necessary to deliver contracted SaaS services. 2. Legitimate Interests: Operating a secure platform, fraud prevention, and product analytics. 3. Compliance with Legal Obligations: Tax reporting, law enforcement requests, and regulatory compliance. 4. Consent: Where explicit consent has been provided (e.g. newsletter subscriptions or direct marketing).

We do not sell personal data. We share personal data only with trusted sub-processors necessary to operate our infrastructure, under strict confidentiality and data protection agreements.

Key Sub-processors include: • Cloud Infrastructure: Amazon Web Services (AWS), Google Cloud Platform (GCP). • Messaging Gateways: Meta Platforms (WhatsApp Business API), Twilio, AWS SES. • Payment Processors: Stripe, Razorpay. • Advertising & Analytics: Google LLC (Google AdSense, Google Analytics). • AI LLM Infrastructure: OpenAI API Enterprise, Anthropic API (with zero retention agreements).

We partner with Google AdSense to serve advertisements exclusively on selected content, educational, and resource pages of our website (e.g., our blog, customer case studies, playbooks, and free growth tools). We do not serve advertisements on core commercial, product, pricing, or conversion pages.

In accordance with Google AdSense Publisher Policies, please note: • Third-party vendors, including Google, use cookies and web beacons to serve ads based on a user's prior visits to our website or other websites on the Internet. • Google's use of advertising cookies enables it and its partners to serve ads to our users based on their visits to our site and/or other sites across the Internet. • Users may opt out of personalized advertising by visiting Google Ads Settings at https://www.google.com/settings/ads or by visiting the Digital Advertising Alliance Consumer Choice page at https://www.aboutads.info. • For more information on how Google collects and processes data when you use partner sites, visit Google's Privacy & Terms at https://policies.google.com/technologies/partner-sites.

Data may be processed in servers located in the United States, European Union, or India. For international data transfers from the EEA, UK, or Switzerland, CapEngage relies on Standard Contractual Clauses (SCCs) and UK Transfer Addendums to ensure adequate data protection safeguards.

We maintain strict technical and organizational security measures, including TLS 1.3 encryption in transit, AES-256 encryption at rest, role-based access control (RBAC), multi-factor authentication, and continuous security monitoring.

Personal data is retained only as long as necessary to fulfill the purposes outlined in this policy or as required by law. Customer account data is retained for the active subscription term plus 30 days, after which it is permanently purged per our Data Retention Policy.

Depending on your jurisdiction (e.g. GDPR, CCPA/CPRA, India DPDP Act), you possess specific data protection rights:

• Right to Access: Request a copy of the personal data held about you. • Right to Rectification: Request correction of inaccurate personal data. • Right to Erasure ('Right to be Forgotten'): Request deletion of your personal records. • Right to Restrict & Object: Object to specific processing activities or withdraw consent. • Data Portability: Receive your personal data in a structured, machine-readable format.

To exercise these rights, submit a request to dpo@capengage.com or privacy@capengage.com.

For privacy inquiries, Data Protection Officer (DPO) communications, or legal notices, contact privacy@capengage.com or write to our Registered Office.