Privacy and cookie policy

1. Controller and contact

Capsora’s publisher is the controller for the processing needed to operate the service. Its identity and contact details appear in the legal notice above. This policy concerns creators, recipients, visitors and partners.

To exercise your rights, use the personal-data contact listed there. A creator provides recipient details and videos; if you receive an invitation or appear in content, your data may therefore come from that person. You may ask for information about this source.

2. Data we process

Required fields are identified in forms. Without data needed for authentication, video processing or payment, the relevant feature cannot be provided. Optional customization and cookie choices remain optional.

• Account: email, identity and profile information, avatar, technical identifiers and login data. Supabase handles authentication; Google sign-in transmits the profile information you authorize.
• Capsules: videos, previews, title, messages, settings, recipients, dates, processing status and download permissions. Comments are processed when enabled.
• Orders and support: Stripe references, amount, currency, payment status, refunds, acceptance records, support requests and reports. Capsora does not store full card numbers; Stripe processes payment data under its own obligations.
• Security and use: IP address or technical fingerprint depending on the mechanism, error logs, timestamps and anti-abuse counters. With consent, pseudonymous navigation, playback and conversion events are used for analytics or advertising.
• Partners: professional identity, registration, contact details, tax residence, VAT, accepted contracts, commissions, invoices, payouts and, where required, compliance certificates and verification evidence.

3. Purposes and legal bases

• Contract or pre-contract measures: account and draft creation, capsule hosting and reveal, order and payment management, support and partner relationship.
• Legitimate interests: security, fraud prevention, abuse prevention, reports and notifications necessary for recipients chosen by a creator. You may object for reasons relating to your situation.
• Legal obligation: accounting, tax and social duties, legally binding requests and required records.
• Consent: optional analytics and advertising. Choices are separate and can be withdrawn at any time. Refusal does not block capsule creation or viewing.

4. Capsule access and security

Viewing pages are available by link. Anyone who obtains the link may see the capsule information displayed and, after its conditions are met, the video. A hard-to-guess link is not named authentication.

The service checks playback conditions server-side and uses temporary permissions for protected videos. Pre-reveal previews may be displayed and the creator can access drafts. This is not end-to-end encryption: providers process files to deliver the service, and authorized people may intervene for support, security or legal obligations.

Public-site exchanges use HTTPS and technical access is role-limited. No measure removes all risk. Do not share credentials and keep a personal copy of your videos. Deleting data from Capsora does not delete copies saved by others.

5. Recipients and providers

Data is available to authorized Capsora staff and providers for their assigned tasks. Capsule recipients see the content shared with them. A partner receives commission information and aggregated statistics, without access to the customer’s video or identity through that mechanism. Authorities may receive data where law requires it.

The main integrations are Supabase (accounts, database and private temporary storage), Mux (video processing and delivery), Stripe (payments), Resend (service email), Google sign-in where selected, and Google Analytics / configured advertising tags where consented. The anti-abuse service may use Upstash when configured. The application host is identified in the legal notice.

Payment and authentication data may also be processed by those providers for their own obligations. User videos are not, merely by being uploaded, authorized for Capsora’s commercial communications.

6. International transfers

Some providers are international groups; processing, support or delivery may involve access from outside the European Economic Area. A provider’s name alone does not prove that all data stays in France or the EU.

A transfer must rely on an applicable mechanism: an adequacy decision or appropriate safeguards, including standard contractual clauses and supplementary measures where needed. You may ask the controller for the countries, recipients and safeguards applicable to your data.

7. Retention periods

Deletion follows capsule deadlines and technical cleanup. Records required by law or needed to defend a right may be stored separately with restricted access; this does not justify systematic retention of video content.

• Basic video: 7 days after unlock. Premium video: no automatic deadline by default, until deletion, a selected expiry or the end of supply under the contract.
• Anonymous draft and recovery right: 7 days. Expired temporary files are cleaned up; transfer copies are deleted after processing according to transfer status.
• Account and capsules: for the relationship needed to manage them; at closure, data no longer needed is deleted or anonymized subject to legal duties. Backup and log periods depend on providers and must be documented in the publisher’s retention record.
• Accounting records and invoices: 10 years where accounting duties apply. Other contractual, dispute and partner records are archived for their purpose and applicable limitation periods.
• Consent choices: 180 days. Pseudonymous capsule attribution: at most 180 days and removed on withdrawal or expiry. Server event queue: sent events cleaned after 7 days and permanent errors after 30 days.
• Partner click: attribution valid for no more than 24 hours; this is not the retention period for commission records.

8. Cookies and device storage

Technical cookies or storage support sessions, security, language, draft recovery and consent preferences. They must not be reused for advertising without consent.

The anonymous recovery cookie capsora_capsule_claim expires after 7 days. Consent is stored in capsora_consent and capsora_cookie_consent for 180 days. The browser also stores draft data for recovery. Local storage can be cleared from your browser.

Analytics and advertising are denied by default. The cookie manager available on site pages lets you refuse, accept or customize these categories, and change or withdraw consent just as easily. Closing the browser is not consent. Withdrawal blocks new optional sends; it does not undo lawful prior processing.

Analytics events are pseudonymous and not necessarily anonymous. Code excludes titles, messages and email addresses from events. Effective Google cookie durations, active advertising tags and Analytics retention depend on published configuration and must be documented by the publisher.

The partner attribution journey uses no affiliation cookie or local storage: a temporary click identifier is passed to creation and removed from the displayed address.

9. Your rights

Depending on the situation and legal basis, you have rights of access, rectification, erasure, restriction, objection and portability. You may withdraw consent at any time and set post-mortem instructions under applicable French law. Deleting data may prevent delivery of a scheduled capsule; consequences will be explained when processing the request.

Send a request to the publisher’s data contact, identifying the right and the information needed to locate it. Additional identity evidence may be requested only where reasonably necessary. A response is generally due within one month; a two-month extension may be needed for complex or numerous requests, with reasons provided within the first month.

You may complain to the French data protection authority CNIL at www.cnil.fr or 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07. This is available independently of a request to Capsora.

10. Third-party and children’s data

A video may contain relatives or children. The creator must have the required permissions and avoid unnecessary sensitive data. A person concerned or their representative may request information, exercise rights or report a privacy issue to the publisher.

11. Automation and changes

Capsule unlocks and technical checks follow service settings automatically. A contested restriction may be reviewed by the publisher. Optional advertising choices are managed separately in the consent module.

This policy may change. A material change to purposes, recipients or rights must be brought to your attention, and renewed consent is requested where required.