Privacy Policy

This Privacy Policy describes how Slickup LLC, doing business as Kapiway (“Kapiway”, “we”, “us”, or “our”) collects, uses, and shares information when you use our online visibility tool at kapiway.com (the “Service”). We process personal data on the legal bases set out in this policy (the table is in Section 6): to perform our Terms of Service with you, our legitimate interests in operating, securing and growing the Service, your consent where required (for example, cookies and advertising pixels), and to comply with our legal obligations. If you are in California or another US state with a privacy law, our notice at collection is in Section 12.

For your account and your use of the Service, Kapiway is the controller. For personal data we process on your behalf (for example your outreach prospects, your team members, and the reviewers and commenters on your business profiles), you are the controller and we are your processor under our Data Processing Addendum.

1. Before you sign up

Some of our public pages work before you have an account. Here is what they collect.

• Website read on /start. When you type a website on kapiway.com/start, we store the address and its domain, your IP address and your browser’s user agent, and, if you then sign up, which account and project it became. We read about 30 pages of the site, all as KapiwayAudit: its robots.txt, its sitemaps and homepage, up to 14 pages found through the sitemaps and homepage links, up to 7 usual pages (/about, /about-us, /services, /what-we-do, /products, /pricing, /contact), up to 5 pages that may hold its addresses, and the homepage once more. To find your locations it may read the robots.txt and sitemaps a second time, and the homepage can be read a few times. We send their text to Anthropic so an AI model can work out what the business does and where its customers are. We never ask for a picture of a page that refused our reader. When a page can’t be read and didn’t refuse us, we may ask DataForSEO for a picture of the public page, which its own browser loads, and send that to Anthropic too. We do not ask for your email on this page.
• AI readiness report. When you request a report on kapiway.com/ai-readiness, we store the website address, your work email, whether you agreed to receive tips, your IP address, your browser’s user agent, and, if you allowed advertising, the campaign details in the link you arrived from (such as UTM tags and ad-click ids). As KapiwayAudit we read the site’s robots.txt and sitemaps, its homepage, up to 6 more pages and up to 7 usual pages (such as /about and /contact); as KapiwayBot we read its robots.txt and llms.txt files, which the report checks; and we run Google PageSpeed on up to 3 of its pages. The report is emailed to you and is also public to anyone who has its link (kapiway.com/report/ followed by the site’s name). The public report shows the website and its scores, never your email, and is marked so search engines do not index it. We send your email, the website, its score and your campaign details (where the check came from, such as its UTM tags) to Customer.io, and to our own marketing workflow (n8n), which may look up your work details through Apollo and, if you agreed to tips, add you to an email sequence. Your email, the website and its score are sent whatever your cookie choices, because they come from the form you sent. The campaign details are kept and sent only if you allowed advertising (in the United States, after you clicked OK on our notice) and your browser sends no Global Privacy Control signal. You can unsubscribe from any of these emails.
• Waitlist. If your business has no website of its own yet and you join our waitlist, we store your email, the address you typed, the business name we found, where you joined, your IP address and, if you are signed in, your account and project. We also send your email, the address and the business name to Customer.io so we can email you when we are ready.
• The Kapiway Digest. If you subscribe to our monthly digest, we collect your email address, when you subscribed, the page you subscribed on and, if you allowed advertising cookies, the campaign tags in the link you followed. We send them to Customer.io, our email provider, to send you the digest. We use your email only for the digest: subscribing does not sign you up for any other marketing email. Every issue has a link to unsubscribe, and we keep that choice so we never send you the digest again.
• Subprocessor changes. If you ask to hear about subprocessor changes (Section 9), we store your email, your IP address and when you asked, and use them only to send those notices. Each email has a link that stops them.
• reCAPTCHA. These forms are protected by Google reCAPTCHA v3 to stop abuse. The reCAPTCHA script loads only when you start using a protected form. It collects hardware and software information, such as device and application data, and sends it to Google. Google processes this data for us as our processor, only to check that a person, not a bot, is using the form. The Google Privacy Policy and Terms of Service also apply. We send Google the token and your IP address to check it.

We keep these records for 3 years from the last time you contacted us (a form you sent, a sign in, a reply or a booking; opening or clicking our emails does not count), then delete them, or sooner if you ask (see Section 10). A report older than 30 days is marked expired, and a new report for the same site replaces the old one.

2. Information we collect

Account information

When you create an account we collect your email address. We sign you in either by emailing you a 6-digit one-time code or, if you choose to continue with Google, by verifying a Google ID token (which gives us your Google account email, profile name, profile picture URL, and a stable Google user identifier we use to recognize the account on subsequent sign-ins). We do not use passwords for sign-in. The Google Sign-In script loads from accounts.google.com on our sign in and sign up pages. We check each sign-up email against a list of throwaway email domains and refuse an address from one of them. We also store your name, the country we work out from your IP address, your time zone (from your browser, so your daily list arrives at 8am your time), your notification choices (daily list email, email when an AI answer quotes you, browser notifications), and a record of each version of our Terms and this policy you accepted, with the time and the IP address and browser it was accepted from. You need to give us an email address to have an account, because we sign you in and reach you with it; everything else you give us is optional, though some features do not work without it. If you turn on browser notifications, we store the push subscription your browser gives us (an endpoint address and keys) and your browser’s user agent, and delete it when you turn notifications off or the push service says it no longer works.

Codes. If you use a code, we keep it with your account to give you its plan. We don’t use it for ads.

Project and SEO data

When you add a project we store the website URL, business profile, target keywords, audit results, generated content, competitor data, backlink data, and any notes or files you upload. For each location or place you add, we store its name, street address, town, postal code, country, map coordinates, phone number, opening hours, the towns it serves and its Google Business Profile link. If your business goes to its customers, the address you give may be your home address; it is used to work out the area you serve and to compare your listings. We also store the rules and feedback you give us (for example “never mention prices”), the replies you write or save, your approvals and skips, and, if you turn it on, the share link for your monthly report. This data is scoped to your organization and accessible only to members you invite, according to their role.

Report share links. When you turn on a share link, anyone with the link can read that project’s whole monthly report without signing in. The link has no expiry; you can turn it off or replace it at any time, and it stops working if the project is archived. Search engines are asked not to index it.

Outreach activity

When you use our outreach features we store the prospect lists you build (URLs, domain authority signals, and the contact names and emails that the sites publish on their own pages), the email drafts and templates you create, the messages Kapiway sent on your behalf (subject, body, recipient, send timestamp), and email engagement signals (delivery, opens). To measure opens we embed a 1×1 tracking pixel in outgoing HTML emails. See Section 6 below for details.

Billing information

Subscription payments are processed by our payment provider, Dodo Payments, who is the merchant of record. Dodo holds your card details directly under their own privacy practices; we never receive or store your card number, CVV, expiry, or billing address. From Dodo we receive and store only the customer and subscription identifiers (and the resulting plan and status) needed to grant access and manage renewals on your account. Dodo processes the payment-related personal data it collects directly from you (card details, billing address, fraud-screening signals, tax data) as an independent controller under its own privacy notice and data processing terms; that processing is governed by Dodo’s terms, not ours, and is not covered by our subprocessor list in Section 9.

Activity, device, and log data

We collect web server access logs (IP address, user agent, the page or API route asked for, request timestamps), kept for 6 months, an application activity log of significant actions you take in your account (e.g. project created, content approved, email sent) for audit and support, and error and performance telemetry from Sentry (see Section 8 for what it leaves out). We also keep a security log of each change you make through our API (who, which organization and project, which route, the result, how long it took, and your IP address), never the request body, headers or cookies; it is kept for 6 months, and sign in and other security events for 12 months. For each call we make to an outside provider (AI models, search data, and similar), we log the provider, the feature, the organization and project it was for, and its cost; this ledger has no names or emails in it. We also log your cookie consent choices with your IP address, your browser and the page you made them on.

When you start or change a subscription, we store your browser’s IP address and user agent, the Meta _fbp cookie if it is set, and the country we work out from your IP address. When you sign up we store the campaign details of the link you first arrived from (UTM tags, the page and referrer, and ad-click ids such as gclid, fbclid and li_fat_id), but only if you allowed advertising: your browser keeps them for up to 90 days, and only once advertising is allowed. The part on advertising and conversion measurement below says when these are sent anywhere.

When you book a call with us from our booking page, the calendar is Calendly’s (a subprocessor, see section 9) shown inside our page: the name, email, website and answers you type go to Calendly, and we read the booking back to prepare the call and to record it on your profile. With Advertising consent we also send Meta one “booked a call” event from our servers, with the details listed in the advertising and conversion measurement part below.

On our public website and in the signed-in app, we run Google Analytics, Microsoft Clarity (session recordings and heatmaps; signed-in pages are fully masked, and every form field is masked on public pages), advertising pixels loaded through Google Tag Manager (the Meta Pixel, the LinkedIn Insight Tag and the Paved pixel), Google Ads conversion cookies (_gcl_au, _gcl_aw, only with advertising consent) and business visitor identification (RB2B, Snitcher, and Apollo’s website tracker, which Google Tag Manager also loads). The Google Analytics script and its measurements pass through our own domain (the /gtag/js and /ga paths on kapiway.com forward to Google), so Google still receives them. What runs depends on where you are:

• EEA, Switzerland and Canada, and wherever we cannot tell where you are: a banner with Accept all, Reject all and Customize. Nothing beyond necessary cookies runs until you accept it. Before you choose, Google may receive pings without cookies (Google’s Consent Mode), and no cookies are set. The banner says we use Snitcher and Apollo to find out which company a visitor works for, so we can follow up; both run only if you accept Advertising. RB2B never runs.
• United Kingdom: the same three buttons and the same words about Snitcher and Apollo. Site statistics (Google Analytics only, with no advertising use) run unless you switch them off; session recordings, advertising, Snitcher and Apollo wait until you accept them. RB2B never runs.
• Everywhere else, for example the United States: a notice bar. Before you click OK, only necessary cookies and Google Analytics statistics run. The ad and identification tags (the Meta Pixel, the LinkedIn Insight Tag, the Paved pixel and Apollo’s website tracker through Google Tag Manager, Snitcher, RB2B) and Microsoft Clarity start only after you click OK, and stop if you turn off the matching category.

Google Analytics reports. If you allow advertising, Google Analytics may link your visits to your Google account (Google signals), so we see visits across your devices and broad age and interest groups in our reports, never who you are. Without advertising consent this stays off. Google Analytics also records your approximate city and the kind of device you use, except for visitors in the EEA, the UK and Switzerland, where we turn this off.

After you choose Reject all (in the EEA, the UK, Switzerland and Canada), or turn Analytics off (elsewhere), Google Analytics no longer loads at all on the pages you open next. We also keep your country in a preference cookie (kw_country) so we show the right banner and prices. In setup, a YouTube video shows only its poster image until you click play; then the youtube-nocookie player loads from YouTube. If you turn on browser notifications, a small service worker from our site stays in your browser to show them.

The live list of tools and the cookies they set is in our Cookie Policy.

Your Privacy Choices. Every page of our website, including /start, sign up, sign in, shared reports, invitations and the welcome pages, and Settings in the app, has a “Your Privacy Choices” link. It opens your cookie choices, where you can opt out of the sale or sharing of your personal information and of targeted advertising (turn off Sharing for ads, called Advertising in the EEA, the UK, Switzerland and Canada, or choose Reject all), as US state privacy laws such as California’s, Colorado’s, Connecticut’s and Virginia’s provide. When you are signed in, your choice is saved to your account and also stops the server-side conversion data described below for your account. A Global Privacy Control signal from your browser counts as the same opt-out, and your preferences then show “Opt-out preference signal honored”. Requests to opt out of sale, sharing or targeted advertising need no verification; you can also email support@kapiway.com with the subject Opt out.

Marketing site visitor identification

On our website and in the signed-in app we use three business-to-business visitor identification services so we can follow up with relevant prospects who visit but don’t sign up directly. RB2B never runs in the EEA, the UK, Switzerland or Canada; elsewhere it runs only after you click OK on our notice, unless you turn off Sharing for ads. Snitcher runs in the EEA, the UK, Switzerland and Canada (and wherever we cannot tell where you are) only after you accept Advertising; elsewhere only after you click OK, unless you turn off Sharing for ads. Apollo’s website tracker runs the same way as Snitcher, because Google Tag Manager, which loads it, runs only when advertising is allowed. All three stop when your browser sends a Global Privacy Control signal. The business contacts they find go to our own marketing workflow (n8n, which we host ourselves) and to Apollo, which we use to email prospects.

RB2B (identifies US visitors only). When you visit or log in to our website, cookies and similar technologies may be used by our online data partners or vendors to associate these activities with other personal information they or others have about you, including by association with your email. We (or service providers on our behalf) may then send communications and marketing to these email addresses. You may opt out of receiving this advertising by visiting https://app.retention.com/optout. You also have the option to opt out of the collection of your personal data in compliance with GDPR by visiting https://www.rb2b.com/rb2b-gdpr-opt-out.

Snitcher (global, company-level). We use Snitcher to measure the business usage of our website. This service shows us the company names and addresses based on the IP addresses of our visitors. For Snitcher to distinguish between different visitors on our website, it sets a cookie named ‘snitcher_device_id’ (older versions of its script set ‘SNID’) and keeps a visitor id in your browser’s local and session storage; the Cookie Policy lists how long. Snitcher does not identify individual people; it identifies the company an IP address belongs to. You can turn this cookie off from the “Your Privacy Choices” link, and you can read more about how Snitcher complies with GDPR at help.snitcher.com.

Apollo (company-level; people in the US). Apollo’s website tracker, loaded through Google Tag Manager, sends Apollo the address of each page you view, the site you came from and the campaign tags in the link, with a random visitor id it keeps in your browser’s local storage (‘apolloAnonId’). Apollo uses this to tell us which company a visitor works for and, for visitors in the US, it may match the visit to a person in its business contact database (name, job title and work email). For that match the tracker may load a script from LiveIntent, Apollo’s partner, which can return a scrambled (hashed) form of an email address linked to your browser; Apollo keeps that hashed form in local storage for a day. It also keeps the page views still waiting to be sent and a one-day note of whether it may track the visit; the Cookie Policy lists them. Apollo’s own script sets no cookies; LiveIntent’s script, when it loads, may set its own cookies and storage on our domain. You can turn both off from the “Your Privacy Choices” link, opt out of LiveIntent’s advertising at https://d.liadm.com/opt-out, and ask Apollo to remove your details from its database at https://www.apollo.io/privacy-policy/remove.

Advertising and conversion measurement

We run paid campaigns to find new customers and need to know which ads lead to a sign-up or subscription. Because browser-based tracking misses many events, we also use server-side conversion measurement: we send a small set of conversion events from our servers to the advertising and analytics platforms where we run or measure campaigns. Meta and Google Analytics 4 receive only these events: sign up, trial start, subscription, and each payment or renewal with its plan, amount and a hashed payment reference (a one-way code made from the payment id, not the id itself); Meta alone also receives a call booked from our booking page. LinkedIn receives only trial start and each payment or renewal. None of them gets cancellations or other account events. The identifiers each one gets:

• Google Analytics 4: its visitor id from the _ga cookie (or, without one, “server.” followed by your Kapiway user id), your Kapiway user id, how you signed up (email code or Google), the UTM tags of the link you arrived from, the gclid and fbclid ad-click ids, and an event id so the same event is not counted twice. Never your email. Sent only with Analytics consent (site statistics in the UK); without Advertising consent the event is marked as not for ads.
• Meta (Conversions API): your email, first and last name and country, each hashed (SHA-256), and a hashed version of your Kapiway user id (for a booked call, the name and email you typed into the booking, hashed, and no user id); your IP address, browser user agent and the Meta cookies (_fbp, _fbc) as they are; how you signed up and the UTM source and campaign of the link you arrived from; and the address of the page the event came from. Sent only with Advertising consent; outside the EEA, the UK, Switzerland and Canada, only after you clicked OK on our notice and while Sharing for ads is on.
• LinkedIn (Conversions API): your email, hashed (SHA-256); LinkedIn’s ad-click id (li_fat_id); your IP address (or the last one we saw for your account); your first and last name and country, in plain text; and, for a payment, its amount and currency. Sent only with Advertising consent; outside the EEA, the UK, Switzerland and Canada, only after you clicked OK on our notice and while Sharing for ads is on.
• Customer.io: the campaign details of the link you arrived from (UTM tags, ad-click ids, the landing page and referrer) are added to your profile at sign up only with Advertising consent. The same rule applies to the campaign details of an AI readiness check (see Section 1).

Where available we also read the Meta Pixel cookies (_fbp, _fbc) and the LinkedIn li_fat_id cookie set on our website, or the copies we stored at sign up or checkout, to match the conversion to the originating ad. These platforms use this data to attribute the conversion to a prior ad interaction. In your browser, the Meta Pixel, the LinkedIn Insight Tag and the Paved pixel (for our newsletter ads on the Paved network) do the same job when advertising is allowed. We apply your choice according to your location and local law, the same way as the banner: in the EEA, Switzerland and Canada (and wherever we cannot tell where you are) we send this data only if you affirmatively accept the relevant category (Advertising for the ad platforms, Analytics for Google Analytics); in the UK, Google Analytics site statistics are sent unless you switch them off, and the ad platforms only if you accept Advertising; elsewhere, such as in the United States, Google Analytics statistics are sent unless you turn off Analytics, and the ad platforms only after you clicked OK on our notice and unless you turn off Sharing for ads. If you declined a category, nothing in it is sent. A Global Privacy Control signal stops the advertising sends (Meta, LinkedIn and ad use of Google Analytics). Your sign up still reaches Customer.io and our own marketing workflow, so we can run your account and stop sales emails to you. Turning off a category stops the matching data, from our servers and in your browser. The cookies involved are listed in our Cookie Policy.

Product analytics and lifecycle email

To understand how the product is used and to send onboarding, lifecycle, and occasional product or marketing emails (for example a welcome series, or a reminder that your trial is ending), we sync your account profile to Customer.io: your email, name, and a set of usage attributes about your account, which may be sent through Customer.io: articles drafted and published, keywords tracked, total projects, whether Search Console is connected, whether a website is connected, your AI readiness score and your latest site address. Your plan and trial details go as event data. Only if you allow advertising do we add the details of the link you first arrived from (UTM tags, the gclid, fbclid and li_fat_id ad-click ids, and the referring page). Some product emails, such as your daily list and the email when an AI answer quotes you, are also sent through Customer.io. Lifecycle emails are separate from the other transactional emails we send via Resend, and every marketing email includes an unsubscribe link; unsubscribing stops the marketing and lifecycle stream while still allowing essential account and security messages.

Stopping sales emails to customers. When you create an account, we send your email address and your Kapiway account id to our own marketing workflow (n8n, which we host ourselves) and to Apollo, the tool we use for sales email, so that you are marked as a customer and any sales emails to you stop.

AI-referral beacon (optional)

Our AI-traffic feature can show you when visitors reach your site from an AI assistant (ChatGPT, Perplexity, Gemini, and similar). To enable it you install a small JavaScript snippet on your own site. When a page loads, the snippet sends our collector only three things: a project token, the page path, and the referring site (its host name only, never the full address), and we record a hit only when the referring site is a known AI source. The beacon does not set cookies, and we do not store your visitors’ IP addresses, user agents, or any personal identifiers. As with email open-tracking, if you install the beacon you are responsible for any disclosure your own visitors are owed under your local law.

Feedback and testimonials

If you rate Kapiway on our feedback page (kapiway.com/rate), we collect your star rating, what you write, your name, your business name and your email address, and the campaign tags in the link you followed. The page uses Google reCAPTCHA to stop spam, as described in Section 1. We use your feedback to understand how Kapiway is working for you and to reply to you. It is emailed to our founder and recorded on your profile in Customer.io, our email provider.

We may show your words on our website without your name, described only by your kind of business and region (for example “a roofer in Vermont”). We show your name and business with your words only if you tick the box that allows it. We choose which quotes to show, and we never show an average rating, a count of ratings, or a selection presented as all the feedback we received.

If you delete your account, we delete your name, business name and email address from your feedback, and keep only the rating and your words, with nothing that identifies you. A quote you allowed us to show with your name stays on our website until you ask us to take it down: email support@kapiway.com and we remove it.

3. Connected accounts and OAuth scopes

Several Kapiway features depend on connecting third-party accounts you control. You initiate every connection from inside the Service, you see the standard consent screen of the relevant provider (Google, Microsoft, LinkedIn, Meta), and you can revoke any connection at any time from the relevant Connections or Integrations page inside the project where it was added, or directly from the third-party provider’s account-permissions page. The list below covers every connection we currently support and exactly which permissions we request and why:

Google APIs

• Gmail (send-only): https://www.googleapis.com/auth/gmail.send: used solely to send outreach emails on your behalf when you click “Send” on a draft inside Kapiway. We do not read, list, search, modify, or delete any messages in your Gmail inbox. We store the OAuth refresh token (encrypted at rest) and the metadata of each email Kapiway sent on your behalf.
• Google Search Console (read-only): .../auth/webmasters.readonly: used to fetch keyword rankings, click/impression data, indexing status, and crawl errors for properties you have verified in Search Console. Read-only.
• Google Analytics (read-only): .../auth/analytics.readonly: used to read traffic, engagement, and conversion metrics from the GA4 properties you select, so we can show how visitors, including those arriving from AI search engines, reach and behave on your site. We also call the Analytics Admin API once (read-only) to list your GA4 properties so you can choose which one to connect. We never write to your Analytics account.
• Profile email: .../auth/userinfo.email: used only to identify which Google account a connection belongs to inside the Kapiway UI.

You can revoke any Google connection from inside Kapiway or from your Google Account permissions page. Disconnecting inside Kapiway deletes the stored refresh token; revoking at Google makes it stop working at once.

Microsoft (Outlook)

• Mail.Send: send outreach emails through your Outlook/Microsoft 365 mailbox when you click “Send” in Kapiway. Send-only; we never read inbox contents.
• User.Read: identify which Microsoft account is connected.
• offline_access: receive a refresh token so the connection keeps working without re-prompting you to sign in.

Revoke from account.microsoft.com/privacy/app-access or from inside Kapiway.

Microsoft Bing (Webmaster Tools)

When you connect Bing Webmaster Tools, using an API key you generate in your own Bing Webmaster account, we read index-coverage and search-performance data for the sites you have verified there, so we can show Bing / Copilot indexing status alongside Google in your reports. Only while Bing Webmaster Tools is connected, we also call Bing’s URL-submission API to ask Bing to crawl each article we publish to your site and any page you submit yourself. We do not read anything else from your Bing account. Remove the key from inside Kapiway, or revoke it in your Bing Webmaster account, to stop all access.

LinkedIn (Content Syndication)

Kapiway can post to your personal LinkedIn profile. The consent screen LinkedIn shows you when you click “Connect with LinkedIn” lists exactly what will be granted before you approve.

• Personal profile: uses the openid, profile, email, and w_member_social scopes (UGC Posts API). Kapiway can publish a post (a short summary plus a link back to your article) to your LinkedIn feed and read your basic profile (name, headshot, member URN) so we can label the connection in our UI.

We publish content only when you explicitly schedule a post or click “Publish” inside Kapiway. We do not read your LinkedIn feed, your messages, your 1st-degree connections, or any analytics that aren’t about content you published through Kapiway. You can revoke the connection at linkedin.com/psettings/permitted-services or from inside the Kapiway project where it was added.

Content publishing destinations

Kapiway publishes content for two distinct purposes, and we treat the credentials for each separately. In both cases we publish only at your explicit direction (you click “Publish” or schedule a specific item):

(a) Primary publication: your own website / CMS

When you connect the CMS or storefront that powers your own site, we store the credentials needed to create, update, and (where applicable) configure metadata for the articles or pages you direct us to publish. This includes editing existing published pages when you approve a specific fix (for example adding an internal link or setting a canonical tag from the “Fix it for me” indexing tools), which we apply only after you review and approve the proposed change. The destination is your property under your control:

• WordPress (REST API + Application Password): create/update posts and pages, set Yoast / RankMath SEO metadata if those plugins are installed, manage redirects via the Redirection plugin if installed.
• Webflow CMS (API token + site / collection IDs): create and update collection items in the blog collection you select.
• Shopify (Admin API access token + shop domain): create blog articles and pages in the store you connect, scoped to write_content, write_blogs, write_pages, read_locales, read_translations and write_translations (the last three so an article can be published in each language your store sells in).
• Wix (API key + site / account IDs): create and update blog posts on the site you connect.
• Ghost (Admin API key + site URL): create and update posts via the Ghost Admin API.
• Framer (CMS API key): create and update CMS collection items.
• Notion, Feather (API tokens): create and update entries in the workspace / publication you connect.
• Generic webhook (URL + optional signing secret): if you operate a custom CMS, we can POST the rendered article to an endpoint you provide. We send only the article payload itself; we do not call any other endpoint on your domain.

(b) Content syndication: copies on third-party platforms

Separately, you may choose to syndicate articles to third-party platforms with a canonical link back to the original on your site. This is a publicity feature, not your primary publication channel. When you syndicate, a copy of the article (and optionally a summary, tags, and featured image) is transmitted to the destination platform, where it becomes subject to that platform’s own terms of service, content policies, and privacy practices:

• Dev.to, Hashnode (API tokens): full automated publication of the syndicated copy with a canonical URL pointing back to the original.
• Medium, Substack (integration tokens or post-by-email): publish a draft or post (Medium) or queue a draft (Substack) using the credentials you provide. You confirm the final publication on the destination platform.
• LinkedIn: described in the LinkedIn section above. Posted to your personal profile.
• Reddit, HackerNews, IndieHackers, Quora: assisted or manual flow only. Kapiway prepares the post and the schedule but does not auto-submit; you click through to the platform to finish the post in your own browser session. We do not store passwords for these platforms.

Facebook Page and Instagram (Meta)

When this connection is available in your account and you connect it, you sign in with Facebook and choose the Pages to share. We request these permissions:

• pages_show_list: list the Pages you manage so you can pick them;
• pages_read_engagement and pages_read_user_content: read your Pages’ recent posts and the comments people leave on them;
• instagram_basic and instagram_manage_comments: read the Instagram business account linked to the Page, its recent posts and their comments.

We use these only to read. We never post, reply, hide or delete anything, and we never read messages. We store the Page names and ids, the linked Instagram account id and username, and the Page access tokens Meta gives us, so we can read new comments each day. For each recent comment we store the commenter’s name or username, the comment text, the post it was left on and a link to it, and we send the comment to Anthropic to draft a reply you can post yourself (see Section 5).

To disconnect, use the Meta connection on your project’s Integrations page, which deletes the stored tokens and Page list. You can also remove Kapiway in Facebook under Settings, Business integrations, which stops our access at Meta’s side.

Deleting your Meta data. To have us delete the comments and other data we read from Meta, email support@kapiway.com from the email address on your Kapiway account with the subject “Meta data deletion” and the name of the Page. We delete the tokens, the Page list and every comment and draft we stored from that Page, and confirm by email within 30 days. A person who commented on a Page can ask the same way, giving the Page name and a link to the comment.

AI assistants you connect (Claude, ChatGPT and others)

You can connect an AI assistant such as Claude or ChatGPT to your Kapiway account through our MCP server. Anyone with access to a project on your Kapiway account can connect one, and the assistant can only see and do what that person can see and do in Kapiway. You sign in to Kapiway and approve the connection on our consent screen, where you choose what the assistant may do:

• See your lists and results (always included)
• Work through your list: mark tasks done, snooze or skip them, save replies you wrote, run a check for new items
• Approve work: approve topics, articles and Google profile items, and publish an article or a site fix after you confirm in the chat

When the assistant calls Kapiway, we send it the data it asked for from your project, such as your daily list, AI answer results, rankings, listings, articles and business details. That data is then processed by the assistant’s provider under its own terms and privacy policy, not ours. We store the connection (the app’s name, the permissions you granted, and hashed tokens), and we log each action an assistant takes so it shows in your project’s activity feed. When the assistant connects through its own sign-in, its access token lasts an hour and its refresh token 30 days. A token you create yourself in Settings has no expiry: it works until you revoke it. When you connect an AI assistant, data from your Google Search Console and Google Analytics that you ask it for is sent to that assistant at your direction. We do not receive your conversations with the assistant beyond the requests it sends to Kapiway. You can disconnect an assistant at any time under Settings, Connect Claude or ChatGPT, which revokes its access immediately.

OAuth refresh tokens, Meta Page tokens, publishing credentials and mailbox credentials are encrypted in our database. Removing a connection from inside the project where it was added deletes the stored credentials and stops future automated actions. Revoking it from the third-party provider’s own account-permissions page stops our access at once.

4. Site crawler

Several Kapiway features read publicly available web pages on your behalf. Every request names Kapiway in its user agent, as one of two names. The exact strings:

• KapiwayBot: Mozilla/5.0 (compatible; KapiwayBot/1.0; +https://kapiway.com/bot)
• KapiwayAudit: Mozilla/5.0 (compatible; KapiwayAudit/1.0; +https://kapiway.com/bot)

Our own requests never use a browser’s user agent. We never read Google search pages ourselves: Google results come from DataForSEO. For a Google Maps short link, we only read the address it redirects to, never the Maps page. What each reader reads, and how often:

• Site check of your own website. We read up to 400 pages of the site you added, to find broken links, missing metadata, schema issues, page-speed signals and similar issues. It runs when you set up, when you ask for a re-check, and about once a month. Because the site is yours and you connected it, this check does not follow robots.txt rules (it reads the file only to find your sitemap). User agent: Mozilla/5.0 (compatible; KapiwayAudit/1.0; +https://kapiway.com/bot). Other reads of your own site, to learn what you offer and where your locations are, use the same KapiwayAudit user agent.
• Website read on /start. About 30 pages, all as KapiwayAudit: the site’s robots.txt, its sitemaps and homepage, up to 14 pages found through the sitemaps and homepage links, up to 7 usual pages (/about, /about-us, /services, /what-we-do, /products, /pricing, /contact), up to 5 pages that may hold its addresses, and the homepage once more. To find the locations it may read the robots.txt and sitemaps a second time, and the homepage can be read a few times. It reads the site the visitor says is their own, so it does not follow robots.txt rules.
• AI readiness check. As KapiwayAudit: the site’s robots.txt and sitemaps, up to 6 pages, the homepage and up to 7 usual pages. As KapiwayBot: its robots.txt and llms.txt files, which the report checks. Google PageSpeed also loads up to 3 of its pages.
• Competitor discovery. When we look for your competitors, we read each one’s homepage only, as KapiwayBot, after reading robots.txt.
• Contact finder. Only when you ask us to find a link-building prospect’s contact details: the site’s homepage (it may be read twice), 15 contact-style paths (such as /contact and /about) and 1 page an AI model picks from the links it found, as KapiwayBot, after reading robots.txt.
• Broken-link checker. To check whether a link still works, we send a HEAD request, and a GET only when the server doesn’t accept HEAD, as KapiwayBot, without reading robots.txt.
• Competitor watch. Once a week we read the pricing page of each competitor you name (up to 25) to spot price changes. User agent: Mozilla/5.0 (compatible; KapiwayBot/1.0; +https://kapiway.com/bot). It reads robots.txt first and skips a page that disallows KapiwayBot or KapiwayRadar; the competitor page then says we can’t check it.
• Community threads cited by AI. When an AI answer cites a community thread, we read that one page’s title and description (see Section 5), with the same KapiwayBot user agent, after reading robots.txt the same way. When the site asks bots not to read the page, we show the thread by its address instead.
• Publishers in your field. Up to 24 guide and publisher pages a week, the ones AI answers cite or that rank above you for your searches, to see whether they name you or your competitors. A page we read is read again at most once a month, and a page we couldn’t read is tried again after a week. User agent: KapiwayBot. These reads do not read robots.txt.
• Directory listings. We review each directory by hand before we compare a listing of your business there with your Google profile.

How these crawlers behave:

• They do not execute JavaScript. We fetch raw HTML, response headers, structured data (JSON-LD, OpenGraph, meta tags), and link structure.
• Pictures of pages. We never ask for a picture of a page that refused our reader. When a page can’t be read and didn’t refuse us, we may ask DataForSEO for a picture of the public page, which its own browser loads, and have an AI model read it.
• They do not bypass protections. We do not log in, fill in forms, or try to get past paywalls, CAPTCHAs, or anti-scraping rules. If a page returns 401, 403, 429, or a challenge response, we record the status code and move on.
• They store what they see. Fetched content, response headers, and the findings derived from them are stored against your project. See Section 10 for retention.

Not every reader follows robots.txt: the ones that do are named above. When a site’s robots.txt can’t be read because the site answers with a server error (5xx), those readers treat it as allowing them. A site owner who wants us to stop reading their site can write to support@kapiway.com, and we stop reading it by hand. Site owners can read more, and stop KapiwayBot, at kapiway.com/bot. By adding your own site you represent that you own it or are otherwise authorized to have it crawled. By naming competitors or prospects you represent that the URLs are publicly accessible and that automated retrieval of public web content is permitted under your local law (see Terms § 12).

5. People who are not our users

To do its job for a business, Kapiway reads some public information about people who have never used Kapiway. We did not get this from you, so this section tells you what it is, where it comes from, and how to object.

• Google reviews and questions. For a business’s Google Business Profile we read its newest reviews and questions through DataForSEO, a provider of public Google data. The task we make for the owner shows the reviewer’s or asker’s display name, the star rating, the text, its date and link, and any owner reply. The record we keep as evidence for our findings holds the reviewer’s or asker’s first name only. We send the name and text to Anthropic to draft a reply that the business owner can post.
• Yelp reviews. Where a business is on Yelp and the check is on, we read up to 3 of its reviews through Yelp’s official API (Yelp Fusion): the reviewer’s first name (we keep the first name only), an excerpt of the review, its date and link. We send the excerpt to Anthropic to draft a reply. The excerpt is deleted 24 hours after we first fetch it, wherever we copied it; after that the task shows the reviewer’s first name and a link to the review on Yelp.
• Community threads. We find public threads where people ask for recommendations (Reddit, Quora, Nextdoor, Tripadvisor, public Facebook groups and similar) through Google search results from DataForSEO, Hacker News through its public search API (by Algolia), and pages AI answers cite. We store the thread’s title, a short snippet, the community, its date and link, not the author’s name. We send the title and snippet to Anthropic to judge whether the thread fits the business and to draft a reply the owner posts.
• Comments on a business’s Facebook Page and Instagram. Only when the business connects Meta (see Section 3): the commenter’s name or username and the comment text, as described above.
• Link-building prospects. When a customer uses Link Building, we find contact names and email addresses that sites publish on their own pages, and the customer may email them.

Business contacts we may email about Kapiway. For our own sales, we get work contact details (name, job title, company, work email and LinkedIn profile) from Apollo, a business contact database, from RB2B (people visiting our website from the US), from Snitcher (only the company a visitor works for) and from Apollo’s website tracker (the company a visitor works for and, in the US, sometimes the person), as described in Section 2. Here Kapiway is the controller, on the basis of our legitimate interest in offering Kapiway to businesses it may help. You can object at any time, and every sales email has a way to stop them.

The business using Kapiway decides what to do with this information and is the controller of it; we process it for them under our Data Processing Addendum, on the basis of their legitimate interest in answering reviews and questions about their business. Kapiway never posts anything on these sites; the owner posts any reply from their own account. We keep this information while the business keeps its Kapiway project, with these limits: Yelp excerpts are deleted 24 hours after we first fetch them; community thread text, including quotes kept as evidence for a finding and copies in a task, 12 months, and the thread’s link, title and details 25 months. We delete it when the project or account is deleted.

To object or ask for deletion, email support@kapiway.com with a link to your review, comment or thread. We will remove it from our systems, tell the business it came from, and stop reading it again where we can. This does not remove anything from Google, Yelp, Meta or the community itself; ask that site directly for that.

6. How we use information

We use the information described in Sections 1 and 2 for the purposes below. Most of what Kapiway does on your behalf is automation work, so the first group is intentionally specific.

To run the automation features you ask for

• Generate audit summaries, content drafts, review and community reply drafts, Google profile posts, and outreach copy by sending the relevant project context to Anthropic for AI inference (see Sections 7 and 8).
• Crawl your site to produce the site audit, broken-link list, schema check, and similar findings (see Section 4).
• Crawl competitor and link-building prospect websites you ask us to research, to extract titles, metadata, contact emails, and outreach opportunities (see Section 4).
• Run keyword research, Google ranking checks, backlink lookups, prospect discovery, and Google Business Profile, review and question lookups via DataForSEO.
• Check your business listings: find your Google Business Profile, compare it with your Yelp listing (Yelp Fusion API) and check for a Bing Places listing (Azure Maps), and turn each mismatch into a task.
• Find community threads where people ask for a recommendation (see Section 5), and read comments on your Facebook Page and Instagram when you connect Meta (see Section 3).
• Work out where your customers are: turn town names into map points with OpenStreetMap’s Nominatim service.
• Send your daily list by email and, if you turn them on, browser notifications through your browser’s push service (for example Google, Mozilla or Apple).
• Publish articles, posts, and metadata to the CMS or storefront you connect (your own site) when you click Publish or schedule a publish date.
• Syndicate articles to the third-party platforms you connect (Medium, Dev.to, Hashnode, Substack, LinkedIn, etc.) when you select syndication.
• Send outreach emails through your connected Gmail, Outlook, or SMTP account when you click Send, and record send timestamps and the first open of each email so you can see open rates (see “Email open tracking” below).
• Read your Google Search Console and Google Analytics data, when you connect them, to power keyword-ranking, traffic, and indexing reports inside Kapiway.
• Read Bing Webmaster Tools index and search data, and ask Bing to crawl each article we publish and any page you submit, when you connect it (see Section 3).
• Run AI answer checks: send the questions you track to the AI assistants we check through their own APIs (which may include OpenAI’s ChatGPT, Google Gemini, Anthropic’s Claude and Perplexity, depending on which we have switched on) and read Google’s AI Overviews and AI Mode through DataForSEO, and record who each answer names.

To operate the Service itself

• Authenticate you via one-time email codes or Google Sign-In, and keep your account secure.
• Process subscription payments and manage your billing through Dodo Payments (the merchant of record).
• Send transactional emails (sign-in codes, invitations, billing receipts, your daily list, your reports, notices of changes to our Terms and this policy, and the email the day before your trial ends) and onboarding, lifecycle, and product or marketing emails via Customer.io (each marketing email with an unsubscribe link; see Section 2).
• Monitor performance, debug errors (see Sentry disclosure in Section 8), detect and prevent abuse, and improve the product.
• Reply to feedback you send from our feedback page and, as described in Section 2, show quotes on our website.

To meet legal and policy obligations

• Comply with applicable laws, valid legal process, and regulatory requirements.
• Enforce our Terms of Service, including investigating reports of misuse and protecting the rights and safety of Kapiway, our users, and the public.

Email open tracking

Outreach emails sent through Kapiway include a 1×1 transparent tracking pixel in their HTML body. When the recipient’s email client loads images, our server stamps the email record with the time of the first open and marks the email’s status as “Opened”. We do not store the recipient’s IP address or user-agent, and we do not count or store subsequent opens beyond the first. The first-open timestamp is shown against the email in your outreach inbox so you can see open rates. Recipients can prevent open tracking by disabling automatic image loading in their email client (a built-in option in Gmail, Outlook, Apple Mail, and most other clients). As the sender, you are responsible for any disclosure or consent obligations open tracking creates in your jurisdiction (see Terms § 11).

Our legal basis for each use

Where the GDPR or the UK GDPR applies, this is the legal basis for each use of your personal data. For cookies we treat Canada like the EEA: you opt in.

Where we rely on legitimate interests, we have weighed them against your rights, and you can ask us for that assessment at support@kapiway.com. Where we rely on consent, you can withdraw it at any time: cookies and pixels from the “Your Privacy Choices” link, marketing email from the unsubscribe link in each email, and a connected account by disconnecting it. We do not make decisions about you based only on automated processing that have legal or similarly significant effects on you.

7. Google API Services: Limited Use disclosure

Kapiway’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In particular, we commit that Google user data is:

• Used only to provide or improve user-facing features that are prominent in the Kapiway interface.
• Never sold, never used for advertising, and never shared with data brokers or for any credit-worthiness purpose.
• Never used to train, develop, or improve generalized machine-learning or AI models. Per-user features that use AI (e.g. drafting outreach copy from a prospect’s website) operate on data that user explicitly provided and are not used to train models that serve other users.
• Transferred to a third party only to provide the features you use or at your direction. When you connect an AI assistant, data from your Google Search Console and Google Analytics that you ask it for is sent to that assistant at your direction (see Section 3).
• Read by humans only with your explicit consent for specific support requests, for security investigations, or where required by law.

8. How we share information

We do not sell personal information for money. We share identifiers and internet activity with Meta, LinkedIn, Google and Paved for advertising, and with RB2B, Snitcher and Apollo to identify business visitors. California law may treat this as selling or sharing. You can opt out under Your Privacy Choices or with a Global Privacy Control signal. (See Section 2.) Otherwise we share personal information with the subprocessors listed in Section 9, only as far as needed to operate the Service, and with these recipients:

• With recipients of emails you send. When you send outreach emails through Kapiway, the recipient receives the message body, attachments, and any addressees you specify.
• With your own website / CMS. When you direct Kapiway to publish to your own site (WordPress, Webflow, Shopify, Wix, Ghost, Framer, Notion, Feather, or a custom webhook), the rendered article and its metadata (title, slug, tags, SEO fields) are transmitted to that destination using the credentials you supplied.
• With syndication platforms you connect. When you choose to syndicate an article to a third-party publishing platform (Medium, Dev.to, Hashnode, Substack, LinkedIn, and the assisted or manual platforms above), a copy of the article and its metadata is transmitted to that platform under your account, where it becomes subject to that platform’s own terms.
• With AI providers when you trigger generation. When Kapiway drafts an article, a reply, a profile post or outreach copy, summarizes an audit, or runs any other AI feature, the project context needed for that feature (your URL, business profile, target keywords, relevant snippets of your content or crawled pages, the review, comment or thread being answered, your rules, and any prompt you supplied) is sent to Anthropic for inference. Anthropic processes the request and returns a response; the constraints in Section 7 apply to any Google API data included in that context.
• With AI assistants, to check their answers. Our AI answer checks see whether your business is named in answers from AI assistants. To do this we send the questions you track, not your private account data, to the assistants we have switched on among OpenAI (ChatGPT), Google (Gemini), Anthropic (Claude) and Perplexity, and to DataForSEO for Google’s AI Overviews and AI Mode, and read each answer to record whether your business was named or linked. We store the prompt, the engines queried, and the citation result; these prompts are about your market, not your customers’ personal data.
• With SEO data providers. For keyword research, ranking checks, backlink lookups, prospect discovery, competitor research, community search, and Google Business Profile, review and question lookups, the queries needed (including your site URL, target keywords, competitor domains, your business name and address, map coordinates and categories, and Google place ids) are sent to DataForSEO. DataForSEO also takes screenshots of public pages for us when a page has little readable text.
• With stock imagery providers. When generated content needs imagery, we send short search queries derived from the article’s title, keywords, or section headings (e.g. “modern kitchen”, “cybersecurity dashboard”) to Pexels and Unsplash to retrieve royalty-free images. We do not send your full article body or any account credentials to these providers.
• With other members of your organization. Anyone you invite to your Kapiway organization or a project can see project data, audit results, prospect lists, draft and sent emails, reports, and connection settings according to the role you assign them, and, on a project with locations, only the locations their scope covers. You can revoke access at any time from the team / members area of your account.
• With our error-monitoring provider. Errors and stack traces are forwarded to Sentry to help us debug. Error reports carry no user identifier, no request bodies, headers, cookies, query strings or local variables, and email and IP addresses are masked. What reaches Sentry is the request method and path, the stack trace, the masked error message, and runtime metadata (such as the software version and environment).
• With analytics and lifecycle-email providers. We sync your account profile (email, name, and non-sensitive usage attributes) to Customer.io to power product analytics, the onboarding and lifecycle emails, and some product emails such as your daily list, with the details of the link you first arrived from, as described in Section 2. Leads from our public pages and waitlist go there too (see Section 1).
• With our sales tools. When you create an account, your email address and account id go to our own marketing workflow (n8n) and to Apollo so that you are marked as a customer and sales emails to you stop. When you delete your account, n8n receives an account-deleted event (your email and account id) so we can remove you from Apollo. Leads from the AI readiness report and business visitors found by RB2B, Snitcher and Apollo’s website tracker go there too (see Sections 1, 2 and 5).
• With advertising and measurement platforms. To measure our own ad campaigns, limited conversion events (sign-up and subscription) and the identifiers listed for each platform in Section 2 are sent to Meta, LinkedIn and Google Analytics 4 from our servers, and the Meta Pixel, LinkedIn Insight Tag and Paved pixel collect page visits in your browser, all according to your choices under “Your Privacy Choices”. Meta and LinkedIn are not our subprocessors for this data: each is a joint controller with us for collecting it on our pages (under the Meta Controller Addendum, and LinkedIn’s joint-controller terms for the Insight Tag) and an independent controller for what it does with it afterwards (see Section 9).
• With listing and map services. To check your listings we send your business name and town to Yelp (Yelp Fusion) and Microsoft (Azure Maps, to look for a Bing Places listing), when those checks are on. To place towns on a map we send town, region and country names to OpenStreetMap’s Nominatim service. When you type an address in the app, the text you type goes to Google Maps and Places to suggest matching places.
• With services your browser calls for display. To show a website’s small icon next to its name, your browser asks Google’s favicon service for it. Google sees your IP address, as any website you load does, and the domain whose icon is shown.
• With IP country lookup services. To show the right cookie banner and to record your country at sign up and checkout, we send your IP address to ipapi.co, and to ipwho.is if the first does not answer.
• With your browser’s push service. If you turn on browser notifications, the notification text goes to the push service your browser uses (for example Google, Mozilla or Apple) to reach your device.
• With Google reCAPTCHA. On our public forms, where Google processes the data for us as our processor (see Section 1).
• For legal reasons. Where required by valid legal process, to protect rights and safety, or in connection with a corporate transaction (merger, acquisition, asset sale).

9. Subprocessors

Subprocessor list last updated: October 9, 2026

We engage the following subprocessors to operate the Service. Each accesses only the data needed for its role and is bound by its terms of service or a data processing agreement. Rows marked “when on” are used only when that feature is switched on for the Service or connected by you.

Not subprocessors: ad platforms that are controllers

Meta and LinkedIn get data from the pixels on our pages and from our servers to measure our own ads. For that data they are not our subprocessors. Each is a joint controller with us for collecting it on our pages, and an independent controller for what it does with it afterwards: Meta under the Meta Business Tools Terms and its Controller Addendum, and LinkedIn under its joint-controller terms for the Insight Tag. What each one receives is in Section 2.

This page is the canonical list of our subprocessors. At least 14 days before a new subprocessor starts processing personal data we hold for customers, we add it here marked “Coming on” with its start date, and email everyone who asked to be told. To be told, use the form below, or, if you have an account, turn on “New services that handle your data” in Settings. You can also email support@kapiway.com. If we must replace a subprocessor at once to keep the Service secure or running, we update this list and notify right after. How to object, and what happens if we cannot avoid using a subprocessor for you, is in our Data Processing Addendum.

Note on Dodo Payments. Dodo plays two roles. For the analytics, reporting, and support-action work we direct, Dodo acts as our processor and is listed in the table above. For payment processing itself (taking your card, screening for fraud, calculating and remitting tax, handling chargebacks), Dodo acts as an independent controller under its own data processing terms. The subprocessors Dodo engages for that controller-side processing are listed in Annex 2 of Dodo’s DPA; they sit under Dodo’s controllership, not ours, so we do not list them here.

10. Data retention

We keep your data while your account is open, and for the periods below. When a period ends we delete the data or remove what identifies you. You can ask us to delete it sooner.

Deleting your account. Ask from Settings (the deletion request) or email support@kapiway.com from the email address on the account. If you have a paid plan, we cancel it first. We then delete your account, your projects and everything in them (for an organization you share with someone else, we only remove you), your website reads from /start, AI readiness report requests and waitlist entries, and pending invitations sent to you; an invitation you already answered is kept with your email address replaced by a one-way code. We delete your Customer.io profile; if you had unsubscribed we keep only that choice, so you are never emailed again. We remove you from Apollo through our marketing workflow. We remove what identifies you from your cookie consent records. We keep, as proof for compliance, the record of which version of our Terms and this policy you accepted and when, and of the notices we emailed you, with your email address replaced by a one-way code (a SHA-256 hash); we keep these 6 years after the deletion. The provider cost ledger keeps its numbers with the link to your account replaced. The security log keeps your user id and IP address for its normal period (below), and the deleted data leaves our backups within 30 days. We confirm by email when it is done. To delete a single project (one website), email us the same way.

You can remove integrations, team members, locations, competitors and tracked questions yourself; for prospects and drafts, email us.

• After your plan ends (you cancel, a free trial ends without payment, or a payment is still unpaid 5 days after it failed). You can no longer use the service, but you can still sign in, subscribe again, update your payment details, ask for a copy of your data, and ask us to delete your account. We keep your data for 90 days after your plan ends; if you subscribe again within those 90 days everything is still there. After 90 days we delete your projects and their data. We keep a small record: your sign in email, your billing ids, your acceptance of our Terms and this policy, and your email choices, until the account is deleted.
• Accounts no one uses. If you do not sign in for 24 months and there is no paid plan, we email you a month ahead and then delete the account. Signing in keeps it.
• Before sign up. Website reads from /start, AI readiness report requests and their report pages, and waitlist entries are kept for 3 years from the last time you contacted us (a form you sent, a sign in, a reply or a booking; opening or clicking our emails does not count), then deleted, with your Customer.io record.
• Feedback from our feedback page. As described in Section 2 under Feedback and testimonials.
• Customer.io. Customer records are kept while the account is open and up to 90 days after it ends; records of people who have not signed up, 3 years. If you unsubscribe, we keep that choice so you are not emailed again.
• Sales contacts (Apollo). If you never replied, we delete you 12 months after our last email to you; if you replied, 3 years after your last reply. If you ask us not to contact you, we keep your address on a do not contact list for good.
• Cookie consent records. Each record is kept for 3 years.
• Terms acceptance and notice records. When we email you about a change to our Terms, this policy or our subprocessors, we keep your email address, which notice it was and when, so we never send the same notice twice. These records, and your record of accepting our Terms and this policy, are kept while the account is open and for 6 years after it is deleted.
• Security log. The log of changes made through our API, with IP addresses, is kept for 6 months; sign in and other security events for 12 months.
• Web server access logs. Deleted after 6 months (182 days).
• Provider cost ledger. It holds no names or emails. Each entry is kept for 25 months, then only monthly totals per account remain.
• Billing and tax records. 7 years, as tax law requires. We hold little: Dodo Payments, our merchant of record, keeps the invoices and payment records.
• Yelp review excerpts. Deleted 24 hours after we first fetch them. We keep a reviewer’s first name only (see Section 5).
• Community threads. The short text we show from a public thread, including quotes kept as evidence for a finding and copies in a task, is removed after 12 months; the link, title and details after 25 months.
• Analytics. Google Analytics keeps data for 14 months. Microsoft Clarity keeps recordings for the periods Microsoft sets.
• OAuth tokens and connection credentials. Deleted when you disconnect the integration inside Kapiway. Revoking our app at the provider stops the token working at once.
• Browser push subscriptions. Deleted when you turn notifications off or the push service says the subscription no longer works.
• Error tracking data. Sent to Sentry and kept under Sentry’s plan defaults (typically 30 to 90 days).
• Backups. We take a database backup every day and before each update of the Service, and delete each backup within 30 days. Data you delete can stay in a backup until then, but it is beyond use: we never read backups except to recover from a failure, and after any restore we delete again what was deleted since the backup.

Your other rights, including access and a copy of your data, are described in Section 12.

11. Security

We use industry-standard safeguards: TLS 1.2 or later between your browser and our servers, encryption at rest for OAuth tokens, integration credentials, and other secrets (Fernet/AES with keys derived from a master secret), role-based access controls (Owner, Can approve, Can do and edit, Can view, plus location scopes for head office, regional managers and location operators), sign-in cookies that page scripts cannot read, AI assistant tokens stored only as hashes, a security log kept 6 months (security events 12 months), HMAC-signed state parameters on OAuth flows, a separate off switch for each outside source of listing, review, community and answer data, and error reports to Sentry. Error reports carry no user identifier, no request bodies, headers, cookies, query strings or local variables, and email and IP addresses are masked. We do not use passwords for sign-in: we use either a one-time email code or Google Sign-In. No system is perfectly secure, so we encourage you to enable two-factor authentication on every connected provider account (Google, Microsoft, etc.).

12. Your rights

Depending on where you live (e.g. EEA/UK under GDPR, California under CCPA/CPRA), you may have the right to:

• Access the personal data we hold about you, and know who we have shared it with.
• Correct inaccurate or incomplete data.
• Delete your account and associated personal data (see Section 10).
• Export your data in a portable, machine-readable format.
• Restrict our use of your data while a question about it is settled.
• Object to our use of your data where we rely on legitimate interests.
• Withdraw consent at any time: cookies from the “Your Privacy Choices” link, marketing email from the unsubscribe link, and a connected account by disconnecting it.
• Lodge a complaint with your local data protection authority.

You can object at any time to our use of your data for direct marketing, and we will stop.

Most of these rights are fulfilled on request: email support@kapiway.com and we will respond to verified requests to know, delete or correct within 45 days, and to requests to opt out within 15 business days. Requests to opt out of sale, sharing or targeted advertising need no verification; email support@kapiway.com with the subject Opt out. To protect your data, we check that the request comes from you: it must come from the email address on the account (or the one we hold about you), and we may email a one-time code to that address to confirm. Someone you authorize (an authorized agent) can make a request for you; we then ask for your signed permission and still confirm the request with you by email.

You can withdraw OAuth consent yourself at any time: disconnect the integration from inside Kapiway (Integrations or Outreach, Connections), or revoke our app from your Google / Microsoft / LinkedIn / Facebook account-permissions page. You can revoke an AI assistant’s access under Settings. If you are not a Kapiway user but your review, comment or post appears in Kapiway, see Section 5.

We do not sell personal information for money. We share identifiers and internet activity with Meta, LinkedIn, Google and Paved for advertising, and with RB2B, Snitcher and Apollo to identify business visitors. California law may treat this as selling or sharing. You can opt out under Your Privacy Choices or with a Global Privacy Control signal. We will not retaliate or discriminate against you for exercising any of these rights.

Notice for California and other US states

This is our notice at collection under the California Consumer Privacy Act and similar US state laws. In the last 12 months we collected these categories of personal information:

• How long we keep it: see Section 10.
• Sensitive personal information: we use it only for the purposes the law permits (for example, the sign-in details that secure your account), never to infer things about you.
• Sale and sharing: We do not sell personal information for money. We share identifiers and internet activity with Meta, LinkedIn, Google and Paved for advertising, and with RB2B, Snitcher and Apollo to identify business visitors. California law may treat this as selling or sharing. You can opt out under Your Privacy Choices or with a Global Privacy Control signal. We do not knowingly sell or share the personal information of anyone under 16.
• Your rights: to know what we collect, use and share about you and get a copy, to correct it, to delete it, to opt out of sale, sharing and targeted advertising, and not to be discriminated against for using these rights. Ask as described above.

13. International data transfers

Kapiway operates from the United States. If you access the Service from outside the U.S., your data will be transferred to and processed in the U.S. Our servers are on Amazon Web Services in the United States (N. Virginia region). Where required, we rely on Standard Contractual Clauses or other lawful transfer mechanisms with our subprocessors. For personal data we process on a customer’s behalf, our Data Processing Addendum includes the EU Standard Contractual Clauses and the UK International Data Transfer Addendum. You can ask for a copy of the safeguards we use at support@kapiway.com.

14. Children’s privacy

Kapiway is for businesses. Users must be at least 18. The Service is not directed to children under 16, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

15. Changes to this policy

We may update this policy from time to time. The “Last updated” date at the top of this page reflects the most recent revision. For material changes (including new OAuth scopes) we will make the update visible on this page before relying on the change for new processing, and we email account holders when a new version is published. New subprocessors follow the 14-day notice in Section 9. If you object to a change, you may stop using the Service and request deletion of your data.

16. Contact us

If you have questions or concerns about this policy or our data practices, contact us at:

Representative in the EU and the UK. We have not appointed a representative in the European Union or the United Kingdom yet. Until we do, please contact us directly at the address above.

17. Change history

What changed in each version of our Terms of Service, Privacy Policy, Data Processing Addendum and Cookie Policy. We email account holders when a new version is published.