Vocapable Privacy Policy

Version: v1.2 · Effective: October 14, 2026 (v1.0: August 2, 2026)

Capstra Labs, LLC, a California limited liability company, d/b/a Vocapable (“Vocapable,” “we”) provides a business platform on which our customers operate AI voice agents. This policy explains how we handle personal information. It covers our website and the accounts of our customers. For the people our customers call: our customer decides whom to call and why; we process call data on that customer’s behalf as a service provider. Requests about a specific call are best directed to the business that called you — we will route any request we receive to the responsible customer, and we honor do-not-call requests immediately and permanently on our platform.

What we collect

In the last 12 months we have collected, or will collect once the Service launches, the following categories of personal information (California Civil Code § 1798.140):

Identifiers and professional information (from customers and prospective customers): name, work email, job title, company, business phone, website, and the answers given during signup, including the compliance questionnaire, which we retain as a signed attestation.
Commercial information: subscription, order, and payment records. Payment cards are handled by Stripe; we never store card numbers.
Internet activity: server logs, usage metering, approximate location from IP address, and the minimal analytics described below.
Audio and derived records (on customers’ behalf, as a service provider): contact records our customers import, call audio and transcripts where recording is enabled and lawful, call outcomes, and the consent and compliance evidence connected to calls.
Website data: demo requests and contact forms (forwarded, not stored on the website itself).

How we use it

To provide, secure, meter, and bill the Service; to enforce our Acceptable Use Policy and meet carrier and legal obligations (including do-not-call suppression and call evidence retention); to support customers; to send transactional and account email; and to improve the Service. We do not use customer content or call recordings to train foundation models. We do not sell or share personal information as those terms are defined by the CCPA/CPRA, we have not done so in the preceding 12 months, and we do not use advertising trackers on the platform. We do not knowingly collect information from minors under 16 and have no actual knowledge of selling or sharing their information.

Retention

Account data for the life of the account plus 2 years; service data per customer configuration and the Data Processing Addendum — including its compliance carve-outs: consent, scrub, disclosure, and opt-out evidence is retained at least five years, and do-not-call suppression records are retained indefinitely, because deleting a do-not-call record would cause the contact it exists to prevent. Signup applications that never become accounts are retained up to 2 years for follow-up and legal-defense purposes, then deleted.

Service providers listed in our DPA subprocessor list (hosting, telephony, payments, model inference, transactional email); authorities where required by law; a successor in a corporate transaction. Never data brokers.

Advertising measurement (website visitors only). When we advertise on a platform such as ChatGPT (OpenAI), that platform may append a click identifier to the link you follow to our website. We store that identifier with the campaign that brought you, and if you later submit a form or create an account, we may tell that platform — and only that platform — that its click led to a lead, an account, a checkout or a subscription, together with a one-way hash (SHA-256) of your email address so the platform can match the click. We do this only for visitors whose own visit carried that platform’s identifier or campaign parameters; we never send the platform information about anyone else. Under California law this may count as “sharing” for cross-context behavioral advertising, which is why you can opt out below. We do not sell personal information, and we do not share information about the people our customers call.

Your California privacy rights

If you are a California resident, you may request that we: disclose the categories and specific pieces of personal information we have collected about you, the categories of sources, our purposes, and the categories of third parties to whom we disclose it; delete personal information we collected from you (subject to the legal-obligation and legal-claims exceptions above, which cover our compliance evidence and do-not-call records); and correct inaccurate personal information; and opt out of sharing for cross-context behavioral advertising (the advertising measurement described under Sharing). To opt out, use the Do Not Sell or Share My Personal Information link in our website footer (/privacy-choices); it takes effect immediately in that browser, stops the advertising pixel and our visit beacon, and removes the anonymous visitor identifier. We also honor the Global Privacy Control browser signal as an opt-out for that browser. We do not sell personal information, and we do not use or disclose sensitive personal information for purposes requiring a right to limit.

To exercise these rights, email support@capstralabs.com with the subject “Privacy request.” We verify requests by confirming control of the email address associated with the information and, where needed, asking for information that matches our records. You may use an authorized agent with signed permission. We respond within 45 days (extendable once by 45 days with notice) and will not discriminate against you for exercising any right. If we deny a request, you may appeal by replying to our response; we will answer the appeal within 45 days.

Where the information belongs to one of our customers’ call recipients, the CCPA directs the request to the business that decided to collect it; we forward such requests to the responsible customer and assist them as their service provider.

Do Not Track and Global Privacy Control

Our website does not respond to the older Do Not Track header. It does honor the Global Privacy Control (GPC) signal: a browser sending GPC is treated as having opted out of the advertising measurement described under Sharing, and no advertising pixel or visit beacon runs for it. We do not track visitors across third-party websites.

Analytics and website measurement

Our website uses privacy-respecting analytics without cross-site tracking, plus our own first-party measurement across our website, signup and initial setup pages. We record an anonymous browser identifier (not a cookie), session identifier, page path, referring host, campaign parameters and interactions such as opening signup or completing a setup step. We derive broad browser, operating system and device categories from the request’s user agent, then discard the raw user agent; the measurement records do not store IP addresses, passwords, form answers or page query strings. Raw events are kept for up to 400 days.

When you create a new account or begin an application, we may retain its signup source and anonymous browser identifier with the account/application record. This lets us connect recorded visits to actual registration, email verification, applications, confirmed payments and activation. This source link follows the account/application retention periods above. It is first-party service measurement, not tracking across other companies’ websites. Older or unlinked records remain unknown; we do not reconstruct missing journeys.

Your choice at /privacy-choices and the Global Privacy Control signal suppress browser measurement and new signup-source capture in that browser and remove its stored tracking identifiers. These choices do not remove account or payment records required to provide the Service. The advertising pixel described under Sharing sets one first-party cookie (__oppref, 30 days) for the platform’s click identifier. You can stop both at /privacy-choices.

Changes; contact

We will post any changes here with a new version and effective date. Questions and requests: support@capstralabs.com.