Skip to content

Draft — for counsel review

This document is a draft. It has not been reviewed or approved by counsel, it is not in effect, and nothing here is legal advice or an offer capable of acceptance. It is published so you can see exactly what we intend to put in front of counsel — the banner comes off only when they clear it.

Vocapable Privacy Policy

Version: v1.0 · Effective: August 2, 2026

Capstra Labs, LLC, a California limited liability company, d/b/a Vocapable (“Vocapable,” “we”) provides a business platform on which our customers operate AI voice agents. This policy explains how we handle personal information. It covers our website and the accounts of our customers. For the people our customers call: our customer decides whom to call and why; we process call data on that customer’s behalf as a service provider. Requests about a specific call are best directed to the business that called you — we will route any request we receive to the responsible customer, and we honor do-not-call requests immediately and permanently on our platform.

What we collect

In the last 12 months we have collected, or will collect once the Service launches, the following categories of personal information (California Civil Code § 1798.140):

  • Identifiers and professional information (from customers and prospective customers): name, work email, job title, company, business phone, website, and the answers given during signup, including the compliance questionnaire, which we retain as a signed attestation.
  • Commercial information: subscription, order, and payment records. Payment cards are handled by Stripe; we never store card numbers.
  • Internet activity: server logs, usage metering, approximate location from IP address, and the minimal analytics described below.
  • Audio and derived records (on customers’ behalf, as a service provider): contact records our customers import, call audio and transcripts where recording is enabled and lawful, call outcomes, and the consent and compliance evidence connected to calls.
  • Website data: demo requests and contact forms (forwarded, not stored on the website itself).

How we use it

To provide, secure, meter, and bill the Service; to enforce our Acceptable Use Policy and meet carrier and legal obligations (including do-not-call suppression and call evidence retention); to support customers; to send transactional and account email; and to improve the Service. We do not use customer content or call recordings to train foundation models. We do not sell or share personal information as those terms are defined by the CCPA/CPRA, we have not done so in the preceding 12 months, and we do not use advertising trackers on the platform. We do not knowingly collect information from minors under 16 and have no actual knowledge of selling or sharing their information.

Retention

Account data for the life of the account plus 2 years; service data per customer configuration and the Data Processing Addendum — including its compliance carve-outs: consent, scrub, disclosure, and opt-out evidence is retained at least five years, and do-not-call suppression records are retained indefinitely, because deleting a do-not-call record would cause the contact it exists to prevent. Signup applications that never become accounts are retained up to 2 years for follow-up and legal-defense purposes, then deleted.

Sharing

Service providers listed in our DPA subprocessor list (hosting, telephony, payments, model inference, transactional email); authorities where required by law; a successor in a corporate transaction. Never data brokers.

Your California privacy rights

If you are a California resident, you may request that we: disclose the categories and specific pieces of personal information we have collected about you, the categories of sources, our purposes, and the categories of third parties to whom we disclose it; delete personal information we collected from you (subject to the legal-obligation and legal-claims exceptions above, which cover our compliance evidence and do-not-call records); and correct inaccurate personal information. We do not sell or share personal information, so there is no opt-out to exercise, and we do not use or disclose sensitive personal information for purposes requiring a right to limit.

To exercise these rights, email support@capstralabs.com with the subject “Privacy request.” We verify requests by confirming control of the email address associated with the information and, where needed, asking for information that matches our records. You may use an authorized agent with signed permission. We respond within 45 days (extendable once by 45 days with notice) and will not discriminate against you for exercising any right. If we deny a request, you may appeal by replying to our response; we will answer the appeal within 45 days.

Where the information belongs to one of our customers’ call recipients, the CCPA directs the request to the business that decided to collect it; we forward such requests to the responsible customer and assist them as their service provider.

Do Not Track

Our website does not respond to browser Do Not Track signals; we do not track visitors across third-party websites. Because we do not sell or share personal information, we do not process opt-out preference signals for those purposes.

Analytics

Our website uses privacy-respecting analytics without cross-site tracking, and shows a consent banner where required.

Changes; contact

We will post any changes here with a new version and effective date. Questions and requests: support@capstralabs.com.