Table of contents
This sheet answers the questions a buyer or their compliance team asks before doing business with a company that uses Capturia: where the data lives, who processes it and who can read it. The privacy policy remains the text that prevails.
Where the data lives
The database and uploaded files are hosted in Montréal (Québec); backup copies are encrypted and kept in Calgary (Alberta).
- The application runs on Vercel, in the United States.
- The application's error log is kept by Sentry, in the United States. Personal links, proposal links included, are reduced before sending: their token does not appear there.
- A page whose address grants access to a document is neither replayed in that log nor indexed by search engines.
Who can read what
Each account is isolated from the others by rules applied in the database itself.
- Within an account, a meeting, its recap and its quotes can only be read by its salesperson and the account's management, and by colleagues only if the account has opened it. The Capturia team or the parent agency can also read them when it opens the account to operate it. The prospect only sees the recording and excerpts that their page presents to them.
- A credit card dictated, or a password dictated while saying it is one, is masked in the transcript and made inaudible in the recording Capturia keeps. Out of reach: a password said without naming it, a card shown to the camera, and a copy left in a Zoom account.
- A proposal link given to an associate gives access to neither the recording nor the meeting recap: neither the page nor the chat tells them more than what the page shows.
Artificial intelligence providers
Agents, meeting analysis and proposal pages go through the commercial APIs of these providers, each under its own terms.
- Anthropic, in the United States: by default, its models do not train on API data, and it is deleted within 30 days. This period can be longer in case of a legal obligation or a violation of its policies.
- OpenAI, in the United States: its models do not train on API data unless you opt in, and it stays in its logs for up to 30 days.
- Google, in the United States: Gemini models, subject to its API terms.
- AssemblyAI, in the United States: transcription of calls and meetings. Audio files are deleted there after transcription, and the transcript no later than 30 days after it is created.
Providers that process personal information
The same list appears in the annex to our contracts.
- Supabase (on Amazon Web Services): database, authentication, uploaded files and server functions (Canada (Montréal, Québec))
- Amazon Web Services: encrypted backup copies, locked for 90 days (Canada (Calgary, Alberta))
- Amazon Web Services: encrypted archive of the audit log of sensitive actions (Canada (Montréal, Québec))
- Vercel: hosting of the application and its scheduled tasks (United States)
- Cloudflare: published pages, network protection, temporary storage of meeting recordings (global network)
- Anthropic: artificial intelligence models for agents, analysis and the assistant (United States)
- OpenAI: artificial intelligence models, including the voice of live calls (United States)
- Google: artificial intelligence models (Gemini) and address search (United States)
- AssemblyAI: transcription of calls and meetings (United States)
- Twilio: phone service, texts and call recording (United States)
- Meta (WhatsApp Business): WhatsApp messages exchanged with leads (United States)
- Resend: sending and receiving email (United States)
- LiveKit: meeting and webinar rooms, and their recording (United States)
- Railway: relay of the AI's voice calls (United States)
- Upstash: temporary memory of request limits, texts being sent, and texts received while they are processed during an outage (United States)
- Stripe: Capturia's payments and the payments the Client collects in its own account (United States)
- Sentry: the application's error log (United States)
- BytePlus: generation of advertising videos from the Client's advertising content (Southeast Asia)
- Slack: internal notices of the Capturia team (United States)
Québec's Law 25
Capturia applies Québec's Act respecting the protection of personal information in the private sector.
- The person in charge of the protection of personal information can be reached at [email protected].
- A deleted record or an erasure request also removes the texts drawn from its meetings and calls, and the page that used them. At the end of a recording's retention, the page keeps none of its text and the chat loses the recap and prepared answers it drew from it. Messages already exchanged in the chat follow the conversation retention period set out in the privacy policy.
- Rights of access, correction and deletion are exercised with that person; the privacy policy details them.
A compliance question?
Write to us at [email protected].