Privacy Policy
Last updated: August 15, 2026
1. Who We Are
Capti is operated by Lab 37 ("we", "us", "our"). We provide AI-assisted tools to generate multilingual captions for Final Cut Pro.
2. What We Collect
- Account data: Provided via Clerk (e.g., email, name, and identifiers managed by Clerk).
- Billing data: Processed by Polar (Merchant of Record). Polar handles payments, invoicing, and tax collection on our behalf. We do not store full payment card details.
- Job data: For each captioning job, we store job metadata, audio files, transcription files (list of words with timestamps), grouping files (list of words within groups), SRT files, and FCPXML files.
- User data: Presets, subscription information, and credit amounts.
- Usage and attribution data: We use Vercel Analytics, PostHog, and Google Ads (Google tag). In your browser, PostHog (including session replay, which records the app screen and therefore your transcript text), Vercel Analytics and Google Ads run only after you accept cookies. Vercel Speed Insights runs without consent and is anonymous.
- Server-side analytics: separately from the cookie banner, our backend sends PostHog a small set of pipeline events (whether a transcription finished, how long it took, why it failed). These carry your account identifier but no audio, no transcript text, no email and no name. We rely on legitimate interest for this; you can switch it off in Settings → Data & privacy.
3. How We Use Data
- Provide, operate, and improve Capti.
- Process audio transcription using Deepgram or AssemblyAI, and caption grouping using the Google Gemini API.
- Manage authentication via Clerk and billing via Polar.
- Communicate account notifications via Clerk and billing notifications via Polar.
- Maintain security and prevent abuse.
- Measure usage and ad attribution with Vercel Analytics, PostHog, and Google Ads, in your browser only after you accept cookies.
- Monitor whether the transcription pipeline is working, using server-side PostHog events, on the basis of legitimate interest.
4. Legal Basis
We have to have a lawful reason for each thing we do with your data. Here is the reason for each one.
| What we do | Why we are allowed to |
|---|---|
| Run your account, transcribe your audio, generate captions and exports | Performance of our contract with you (art. 6(1)(b)) |
| Take payment and issue invoices | Contract, and legal obligation for the invoices themselves (art. 6(1)(b) and (c)) |
| Keep the service secure and prevent abuse | Our legitimate interest in a working, non-abused service (art. 6(1)(f)) |
| Server-side monitoring of whether the pipeline worked | Our legitimate interest in knowing the product functions (art. 6(1)(f)). You can object at any time in Settings → Data & privacy. |
| Analytics cookies, session replay and ad measurement | Your consent (art. 6(1)(a)), which you can withdraw at any time |
| Keeping invoices for 10 years | Legal obligation under French accounting law (art. 6(1)(c)) |
5. Content You Upload
The files you upload are recordings of people speaking, and often those people are not you — an interviewee, a client, a colleague. For that content you are the controller and we act as your processor: we process it only to produce the captions you asked for, on your instructions, and for no purpose of our own. We do not use it to train anything, and neither do our transcription providers.
That also means it is your responsibility to have a lawful reason to record and transcribe the people in your files, and to tell them you are doing it.
If you are using Capti for an organisation and need a data processing agreement, email contact@usecapti.com and we will provide one.
6. Data Sharing
We share data with the following third-party providers to deliver our service. See our Data Processing & Providers documentation for complete details and links to each provider's privacy policy:
- Convex: Storage of all job files and user data (Privacy Policy)
- Deepgram: Audio transcription processing (default provider) (Privacy Policy)
- AssemblyAI: Audio transcription processing (Privacy Policy)
- Google Gemini API: AI-powered caption grouping (Privacy Policy)
- Clerk: User authentication and account management (Privacy Policy)
- Polar: Payment processing and Merchant of Record (Privacy Policy)
- Vercel: Web hosting and analytics (Privacy Policy)
- PostHog: Product analytics and user behavior tracking (Privacy Policy)
- Google Ads (Google tag): Ad attribution and conversion tracking (Privacy Policy)
- Svix: delivers Clerk’s account webhooks to us, and therefore sees your account identifier, email address and name (Privacy Policy)
We do not sell your data, and we do not share it with anyone not listed here or in the documentation linked above.
7. Data Retention
| Data | Kept for |
|---|---|
| Uploaded audio | 30 days from upload, then deleted automatically — whether or not the transcription succeeded |
| Transcripts, caption groups, SRT and FCPXML | Until you delete the job or your account |
| Account, presets and credit balance | Until you delete your account |
| Analytics events and session recordings | Recordings 30 days; events until you delete your account, at which point your PostHog profile is deleted with it |
| Transcripts held by AssemblyAI | Deleted as soon as we have fetched the words |
| Invoices | 10 years, as French accounting law requires. We cannot delete these on request. |
You can delete individual jobs from the job page at any time, and delete your entire account from Settings → Data & privacy. Deleting your account immediately removes your jobs, their files, your presets, your credit balance, any connected social accounts and your analytics profile.
A full list of what is not yet deleted on request is published in our Data Processing & Providers documentation.
8. Your Rights
- Access, correct, or delete your data.
- Restrict or object to processing, including our server-side analytics.
- Receive your data in a portable format — Settings → Data & privacy → Download my data.
- Withdraw consent where processing is based on consent.
- Give directives about what happens to your data after your death (art. 85, Loi Informatique et Libertés).
- Lodge a complaint with the CNIL, the French supervisory authority, at cnil.fr.
To exercise rights, contact us at contact@usecapti.com. You can also manage your account directly in Clerk. We respond within one month, as the GDPR requires.
9. Security
Data is encrypted in transit and at rest. Every job, preset and file is checked against the account that owns it before it is returned, and file downloads require a signed-in session. Sessions are handled by Clerk; we never see or store your password.
We publish the security work we know is still outstanding in our Data Processing & Providers documentation, rather than only describing what is already done.
If a breach occurs that is likely to result in a risk to your rights, we will notify the CNIL within 72 hours of becoming aware of it, and tell you directly where the risk to you is high.
10. International Transfers
We are established in France, but most of the services that make Capti work are American. Your audio goes to Deepgram or AssemblyAI in the United States, your transcript goes to Google, and everything is stored by Convex on AWS in the United States. PostHog is the exception: our analytics project is hosted in the EU.
Those transfers rely on the safeguards permitted by Chapter V of the GDPR — Standard Contractual Clauses in each provider’s data processing agreement, and, where the provider is certified, the EU–US Data Privacy Framework. We link every provider’s agreement in our Data Processing & Providers documentation, and we are working through documenting the exact mechanism relied on for each one. Ask us at contact@usecapti.com and we will tell you which applies to a given provider and send you a copy of the relevant clauses.
11. Children
Capti is not intended for children under 16. We do not knowingly collect personal data from children.
12. Changes
We may update this Privacy Policy from time to time. We will update the "Last updated" date when changes are made.
Contact
Lab 37 — 87 Rte de Marcieux, 73470 Novalaise, France — contact@usecapti.com