Privacy policy
What we do with your data
In short
- We collect only what the map needs: account, space, avatar, and each person’s presence.
- Call audio is encrypted in transit, and only someone who is signed in and near the desk can join the call.
- We do not sell personal data, and we do not use conversation content to train models or to advertise.
- Each map is an isolated space: one team cannot see, hear, or enter another team’s map.
- You can ask to access, correct, or delete your data at any time.
This summary does not replace the full Policy below.
Who we are and who this Policy applies to
This Privacy Policy explains how Capitown collects, uses, shares, and protects personal data when you visit our site (capitown.com), create an account, or use the app (app.capitown.com). It was written in accordance with Brazil’s General Data Protection Law (LGPD, Law No. 13,709/2018) and the Brazilian Civil Rights Framework for the Internet (Law No. 12,965/2014).
Capitown is operated by LUIZ PAULO PILEGI DE ALMEIDA LTDA, enrolled with the CNPJ under No. 47.692.790/0001-87, with its principal office in Curitiba/PR, Brazil.
To make this easier to read, we use these terms:
- Space: the virtual office (the live map) created by a team or company.
- Administrator: the person who creates the Space, subscribes to a plan, and invites everyone else.
- Member: the person invited to join the Space.
- Data subject: the person the personal data refers to (you).
Our roles in processing data
As controller. Capitown decides how to process the Administrator’s account data, billing data, site and app usage data, and the messages we receive through our support channels.
As processor. For Member data inside a Space (name, avatar, role, and presence on the map), the company or team that created the Space decides who joins and what the map is used for. In that context, Capitown processes the data on their behalf, following the Administrator’s instructions and this Policy.
If you are a Member of a Space, your company may have its own rules about using Capitown at work. For questions about those rules, talk to your Space Administrator first.
What data we collect
We process only what the map needs in order to work. The data we collect is:
Account data
ExamplesName, email, and password (stored in protected form).
When it is collectedWhen you create an account or accept an invite.
Space data
ExamplesSpace name, invites sent, and each Member’s role.
When it is collectedWhen you create and administer the Space.
Map profile
ExamplesShort name and avatar color.
When it is collectedWhen you customize your character.
Live presence
ExamplesPosition on the map and call state (for example, who is at the desk).
When it is collectedWhile you are connected to the map.
Call audio
ExamplesVoice transmitted in real time during conversations on the map.
When it is collectedWhen you take part in a call.
Billing data
ExamplesSubscribed plan, the Administrator’s billing details, and payment status. Payment is processed by Stripe, and Capitown does not store the full card number.
When it is collectedWhen you subscribe to or change a paid plan.
Technical data
ExamplesIP address, browser and device type, date and time of access, and security logs.
When it is collectedAutomatically, when you use the site and the app.
Communications
ExamplesMessages and information you send us by email, WhatsApp, or social networks.
When it is collectedWhen you contact us.
| Category | Examples | When it is collected |
|---|---|---|
| Account data | Name, email, and password (stored in protected form). | When you create an account or accept an invite. |
| Space data | Space name, invites sent, and each Member’s role. | When you create and administer the Space. |
| Map profile | Short name and avatar color. | When you customize your character. |
| Live presence | Position on the map and call state (for example, who is at the desk). | While you are connected to the map. |
| Call audio | Voice transmitted in real time during conversations on the map. | When you take part in a call. |
| Billing data | Subscribed plan, the Administrator’s billing details, and payment status. Payment is processed by Stripe, and Capitown does not store the full card number. | When you subscribe to or change a paid plan. |
| Technical data | IP address, browser and device type, date and time of access, and security logs. | Automatically, when you use the site and the app. |
| Communications | Messages and information you send us by email, WhatsApp, or social networks. | When you contact us. |
What we do not do. We do not ask for sensitive personal data (such as health, religion, or political opinion), we do not sell personal data, and we do not use conversation content to train models or to advertise.
Why we use the data and the legal bases
Each use of your data has a purpose and a legal basis under article 7 of the LGPD:
Create and maintain the account and the Space, show the avatar and presence on the map, and enable voice calls.
Legal basisPerformance of a contract
ReferenceArt. 7, V
Authenticate users, manage invites, and protect the service against unauthorized access and fraud.
Legal basisPerformance of a contract and legitimate interest
ReferenceArt. 7, V and IX
Charge for plans, issue tax documents, and meet legal and regulatory duties.
Legal basisPerformance of a contract and compliance with a legal obligation
ReferenceArt. 7, II and V
Provide support and answer your requests.
Legal basisPerformance of a contract and legitimate interest
ReferenceArt. 7, V and IX
Keep the service stable, fix errors, and improve the product with usage metrics.
Legal basisLegitimate interest
ReferenceArt. 7, IX
Send service messages (security notices, changes to this Policy, billing).
Legal basisPerformance of a contract
ReferenceArt. 7, V
Send news and marketing. With consent or legitimate interest, and always with a way to opt out.
Legal basisLegitimate interest
ReferenceArt. 7, I or IX
Comply with orders from authorities and defend Capitown’s rights in judicial, administrative, or arbitration proceedings.
Legal basisCompliance with a legal obligation and the regular exercise of rights
ReferenceArt. 7, II and VI
| Purpose | Legal basis | Reference |
|---|---|---|
| Create and maintain the account and the Space, show the avatar and presence on the map, and enable voice calls. | Performance of a contract | Art. 7, V |
| Authenticate users, manage invites, and protect the service against unauthorized access and fraud. | Performance of a contract and legitimate interest | Art. 7, V and IX |
| Charge for plans, issue tax documents, and meet legal and regulatory duties. | Performance of a contract and compliance with a legal obligation | Art. 7, II and V |
| Provide support and answer your requests. | Performance of a contract and legitimate interest | Art. 7, V and IX |
| Keep the service stable, fix errors, and improve the product with usage metrics. | Legitimate interest | Art. 7, IX |
| Send service messages (security notices, changes to this Policy, billing). | Performance of a contract | Art. 7, V |
| Send news and marketing. With consent or legitimate interest, and always with a way to opt out. | Legitimate interest | Art. 7, I or IX |
| Comply with orders from authorities and defend Capitown’s rights in judicial, administrative, or arbitration proceedings. | Compliance with a legal obligation and the regular exercise of rights | Art. 7, II and VI |
When legitimate interest is the basis, we assess whether the use matches the data subject’s expectations and rights. If you have questions about that assessment, contact us.
Voice calls and presence on the map
Capitown is built so conversation can happen naturally, which is why some data is shared inside the Space:
- Presence: other Members of the same Space see your short name, avatar color, position on the map, and whether you are in a call.
- Audio: audio is transmitted encrypted in transit. Only someone who is signed in and close enough to the desk joins the call, and the audio is not open across the whole map.
- No training or ads: we do not use conversation content to train models or for advertising.
- Recording: Capitown does not record or store call audio.
- Isolation: each Space is a separate environment. People on one map cannot see, hear, or enter another map.
People on a call may, on their own, record or write down the conversation outside Capitown. Agree on the rules of use with your team.
Who we share data with
We do not sell personal data. We share data only in the situations below, and only as far as needed:
- With Members of your Space: name, avatar, presence, and role, as described in section 5.
- With service providers (processors): companies that help us operate Capitown, under contract and with a duty to protect the data. Today, the categories are: cloud hosting and infrastructure on Render; real-time audio and video infrastructure on LiveKit; payment processing by Stripe; transactional email through Resend; and usage metrics through Google Analytics.
- With authorities: when there is a legal obligation, a court order, or a request from a competent authority.
- In corporate transactions: in a merger, acquisition, or sale of assets, data may be transferred, with the safeguards in this Policy kept in place, and we will tell you about any relevant change.
International data transfers
Some of our providers may store or process data outside Brazil. In those cases, the transfer follows article 33 of the LGPD, with contractual clauses and security measures suited to the level of protection required by Brazilian law.
How long we keep the data
We keep data for as long as needed to fulfill the purposes of this Policy:
- Account and Space: while the account is active. After cancellation or deletion, we delete or anonymize the data within 30 days, unless the law requires us to keep it.
- Live presence: map position and call state are used while you are connected.
- Access logs: kept for at least 6 months, under article 15 of the Brazilian Civil Rights Framework for the Internet.
- Tax and billing data: for the period required by tax and accounting law (in general, 5 years).
- Data needed to defend claims: until the end of the applicable limitation period.
How we protect the data
We use technical and organizational measures to protect data against unauthorized access, loss, alteration, and improper disclosure, including:
- encryption of call audio in transit;
- authenticated access: each Space requires an account and a valid session;
- invites that expire and can be cancelled by the Administrator;
- isolation between maps of different teams;
- internal access control, limited to people who need the data to do their work.
No system is completely immune to failure. If a security incident occurs that could cause relevant risk or harm, we will notify the Brazilian National Data Protection Authority (ANPD) and the affected data subjects within a reasonable time, under article 48 of the LGPD.
You can help too: use a strong password that you do not reuse, do not share your account, and tell us if you suspect unauthorized access.
Your rights as a data subject
Under the LGPD (article 18), you may request, at any time:
- confirmation that we process your data, and access to it;
- correction of incomplete, inaccurate, or outdated data;
- anonymization, blocking, or deletion of data that is unnecessary, excessive, or processed in breach of the law;
- portability of the data to another provider, as regulated by the ANPD;
- deletion of data processed on the basis of your consent, where that applies;
- information about the entities we share the data with;
- information about the right not to give consent and about the consequences of refusing;
- withdrawal of consent, when that is the legal basis;
- objection to processing based on other legal grounds, if the law is not being followed;
- review of decisions made solely by automated means that affect your interests. Capitown does not make that kind of decision today.
How to exercise your rights: email contato@capitown.com from the address registered on your account, so we can confirm your identity. We reply within 15 days, under article 19 of the LGPD.
If you are a Member of a Space, some requests (such as removing your access) may depend on the Administrator. In that case, we help forward the request. You also have the right to petition the ANPD (gov.br/anpd).
Children and teenagers
Capitown is a work tool, intended for people 18 and older. We do not knowingly collect data from children and teenagers. If we learn that this has happened, we will delete the data as soon as we can.
Changes to this Policy
We may update this Policy to reflect changes in the product or in the law. The date of the latest update is at the top of this page. If a change is significant, we will tell you by email or inside the app, with reasonable notice. If you do not agree with the new version, you can close your account.
Contact
Questions, requests, or complaints about privacy:
- Email: contato@capitown.com
- Capitown, CNPJ 47.692.790/0001-87, Curitiba/PR, Brazil
- Site: capitown.com
This Policy should be read together with our Terms of Use, available at capitown.com/en/terms.