Privacy Policy

1. Introduction

This Privacy Policy describes how Captivix, Inc. ("Captivix", "we", "us") collects, uses, stores, and shares information in connection with ATLAS, our multi-tenant, AI-powered revenue and go-to-market platform (the "Service"), available at atlas-app.captivix.ai and related Captivix domains.

This policy applies to:

• Users — people with an ATLAS account, acting on behalf of a customer organization;
• Visitors — people who interact with public parts of the Service, such as a scheduling page (/book/…) or a supplier portal link, without an account; and
• Data subjects in Customer Data — people (for example, sales leads and business contacts) whose information our customers store and process in ATLAS.

2. Our Role: Controller and Processor

ATLAS is a business-to-business product organized around customer organizations. Our role depends on the data:

• Customer Data — we act as a processor. Leads, contacts, accounts, deals, uploaded documents, email content, call recordings, website-visitor analytics, and similar records are controlled by the customer organization that put them into ATLAS. That organization decides why and how this data is processed; we process it on their instructions to provide the Service. If you believe an ATLAS customer holds your personal information, please direct requests to that organization; we will assist them in responding.
• Account, billing, and usage data — we act as a controller. This covers your ATLAS account profile, authentication data, activity logs, and subscription records.

3. Information We Collect

Account information

Name, email address, username, hashed password (we store bcrypt hashes, never plain-text passwords), profile image, role, timezone, and organization membership.

Customer Data you or your organization put into ATLAS

• CRM records: leads, contacts, and accounts — names, job titles, companies, email addresses, phone numbers, postal addresses, social profile URLs (LinkedIn, Facebook, X/Twitter), notes, tags, scoring data, and optional personal dates your organization records.
• Communications content: outbound emails and sequences your organization sends through ATLAS; inbound emails received into the ATLAS inbox (full content, headers, and attachments); in-app notes and comments; and, where your organization uses AI calling, call recordings, transcripts, and call analyses.
• Meetings and calendar data: events you create, attendee names and email addresses, meeting descriptions, join links, and RSVP responses; and, if you connect an external calendar, data described in the Google section below.
• Files and documents: files you upload (project documents, knowledge base sources, proposals, brand assets), stored in cloud object storage, plus text and vector embeddings extracted from them to power search and AI features.
• Enrichment and research data: publicly available information about leads and companies gathered at your organization's request through data providers and web research, such as job postings, news, and firmographics, plus AI-generated summaries and scores based on it.

Information collected from visitors (non-account holders)

• Public scheduling pages: when you book a meeting through an ATLAS scheduling link, we collect the name, email address, company, timezone, optional guest emails, and answers you submit.
• Supplier portal: suppliers responding to a quote request via a secure tokenized link submit contact and quote details that are stored for the requesting organization.
• Website visitor analytics ("Signal"): ATLAS customers can embed our first-party tracking script on their own websites. When they do, we process, on that customer's behalf: a generated visitor identifier, IP address, browser and device information, approximate location derived from the IP address, referrer, and page-view and interaction events.

Usage, log, and security data

• Activity and audit logs: actions taken in the Service (logins, record creation and deletion, emails sent, files uploaded, role changes, and administrator impersonation events) together with the acting user, timestamps, and in some cases IP address and browser user-agent.
• Session data: server-side login sessions and a session cookie (see "Cookies" below).
• AI usage metering: per-request records of AI feature usage (model, token counts, cost, requesting user and organization) used for quotas and billing.
• System logs: technical logs for reliability and security, stored in our hosting provider's logging service.

Billing information

Subscription plan, billing email, and invoices. Payment card details are collected directly by our payment processor, Stripe, through its own secure elements — full card numbers never touch our servers. We store Stripe customer and subscription identifiers.

Cookies

We use cookies and similar tracking technologies to enhance your experience on our website. When you first visit our site, a cookie consent banner allows you to choose which categories of cookies to accept: Necessary (always on), Analytics, and Marketing. You can accept all, reject non-essential cookies, or choose by category. You can update your preferences at any time by clicking "Cookie Settings" in the footer.

We remember your choice in a first-party cookie named captivix_consent for about 6 months, after which we ask you again. We load our analytics and advertising tools through Google Tag Manager, and we pass your choice to Google using Google Consent Mode (see "Google Tag Manager and Google Consent Mode" below).

Necessary Cookies

These cookies are essential for the website to function properly. They include session management, security features, and your cookie consent preferences. These cannot be disabled.

Analytics Cookies

These cookies help us understand how visitors interact with our website by collecting and reporting information anonymously. They are only set when you consent to analytics tracking.

• Google Analytics (GA4) — Measures website traffic, user behavior, and content performance. It sets cookies such as _ga and _ga_ followed by our measurement ID, and collects page views, interactions, approximate location, and device and browser information, with IP address anonymization. Data is processed by Google LLC. Google Privacy Policy · Google Analytics opt-out add-on
• Apollo.io — Identifies company-level website visitors for B2B sales intelligence. Apollo.io Privacy Policy

Marketing Cookies

These cookies are used to deliver advertisements relevant to you and your interests. They are also used to limit the number of times you see an ad and to measure the effectiveness of advertising campaigns.

• LinkedIn Insight Tag — Enables LinkedIn ad retargeting, conversion tracking, and website audience building. It sets cookies such as bcookie, lidc, and UserMatchHistory and sends LinkedIn your page visits, IP address, device and browser information, and, if you are signed in to LinkedIn, links the visit to your LinkedIn member profile. Data is processed by LinkedIn Corporation. LinkedIn Privacy Policy · LinkedIn ad settings and opt-out
• Google advertising and conversion measurement — Measures how our advertising performs on Google, including whether a visit led to a form submission, and supports remarketing audiences. Data is processed by Google LLC. Google Ads settings

Google Tag Manager and Google Consent Mode

We use Google Tag Manager to load the tools above. Google Tag Manager itself does not set cookies for advertising; it starts the tags we have configured, and only as your choices allow.

We use Google Consent Mode v2. Your choices are passed to Google as follows: Analytics controls analytics storage; Marketing controls advertising storage, the sharing of user data with Google for advertising, and ad personalization. Necessary cookies (website functionality and security) are always on.

• If you visit from the European Economic Area, the United Kingdom, or Switzerland, all Analytics and Marketing storage is denied until you choose, and stays denied if you reject.
• If you visit from elsewhere, those settings start as allowed until you choose. If you then reject, they are switched off and we stop using them from that point on.

Sharing hashed contact details with Google

On this website we use Google's "user-provided data" feature (known as enhanced conversions) to measure advertising results more accurately. When you submit a form on our site, such as the contact form, a webinar registration, or a calculator, details you enter (for example your email address, phone number, name, and address) are converted in your browser into a one-way hashed form (SHA-256) and sent to Google. Google compares the hashed values with signed-in Google accounts to match a conversion to an ad interaction, and uses the result for measurement. We do not send Google the plain-text values from this feature.

This sharing is tied to your Marketing choice: it is not used when you reject Marketing cookies (in the regions above it does not start until you accept). Google uses hashed data under its own terms and privacy policy; it does not give us your Google account details. You can withdraw at any time through "Cookie Settings" in the footer or through your Google Ads settings.

You can manage your cookie preferences at any time by clicking the "Cookie Settings" link in the website footer. You can also control cookies through your browser settings. Please note that disabling certain cookies may affect your experience on our website.

4. How We Use Information

• To provide, operate, secure, and support the Service;
• To carry out the features your organization uses — sending its emails and sequences, syncing its calendars, running its AI research and content generation, publishing its social posts, tracking engagement on its outreach, and scheduling its meetings;
• To authenticate users and maintain sessions;
• To meter usage, enforce plan quotas, and bill subscriptions;
• To maintain security and integrity — audit logging, rate limiting on public endpoints, abuse and spam prevention (including suppression lists for unsubscribes, bounces, and complaints);
• To communicate with you about the Service (transactional emails such as invites, meeting confirmations, and reminders); and
• To comply with legal obligations.

We do not sell personal information for money, and we do not use Customer Data for advertising. Some privacy laws, such as those in several US states, treat sharing website data with advertising partners (as described under "Cookies") as "sharing" for targeted advertising. You can turn that off at any time by rejecting Marketing cookies in "Cookie Settings".

5. AI Features

ATLAS includes AI-assisted features such as lead research and scoring, email and content drafting, knowledge-base question answering, website generation, AI phone calls, and an AI assistant. When you use these features, the relevant content is sent to our AI gateway provider, OpenRouter, which routes the request to the configured large-language-model provider to generate the response.

• AI processing happens only to provide the requested feature. We meter usage per organization for quotas and billing.
• We do not use your data to train our own AI models. OpenRouter and its downstream model providers process API requests solely to return the response and do not use customer data to train models.
• AI-generated output can be inaccurate. Your organization is responsible for reviewing AI output before relying on it or sending it to third parties (see the Terms of Service).
• Where your organization uses AI calling, calls are placed and processed by our voice AI provider (Retell AI), and recordings and transcripts are stored in your organization's workspace. Your organization is responsible for call-recording consent and disclosures required in its jurisdictions.

6. Third-Party Integrations You Connect

ATLAS connects to third-party services only when you or your organization's administrator sets up the connection. For every connected account: OAuth access and refresh tokens are stored encrypted at rest (AES-256-GCM), we request only the scopes needed for the feature, and you can disconnect at any time from the product's settings, which deletes the connection and, where supported, revokes our access with the provider.

• Google Calendar — two-way calendar sync. See the dedicated Google section below.
• LinkedIn — connect a LinkedIn account to publish posts. We request your basic profile and email for identification and the member-posting permission. We read your profile identity and publish only the posts you compose and approve in ATLAS.
• Facebook & Instagram (Meta) — connect Facebook Pages and linked Instagram business accounts to publish posts. We access your list of managed Pages, page identity, and publishing permissions, and publish the content you schedule.
• Other social accounts via Post for Me — some social publishing runs through the Post for Me API, to which we send your post content and media for publication to the accounts you connected.
• GitHub — connect a GitHub account in the Website Designer to import repositories and push generated website code to repositories you choose.
• Apollo.io (data enrichment) — if your organization configures its own Apollo API key, lead search and enrichment queries are sent to Apollo, and returned business contact data is stored in your organization's CRM. Your organization is responsible for its lawful use of enrichment data.
• Email sending domains (Postmark) — your organization verifies its own sending domains; the associated sending tokens are stored with the organization's configuration and used to deliver its email through Postmark.

7. Google User Data (Google API Services)

When you connect Google Calendar, ATLAS uses Google's OAuth 2.0 flow and requests the following scopes: openid, email, and https://www.googleapis.com/auth/calendar.events (view and edit events on your calendars).

ATLAS's use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

What we access and why

• Your Google account email address — to label the connection and prevent duplicates;
• Calendar events — read to show your availability, detect conflicts, and reflect changes made in Google Calendar back into ATLAS; written to create, update, and delete the ATLAS meetings you schedule so both calendars stay in sync.

How we store it

• OAuth access and refresh tokens are encrypted at rest with AES-256-GCM and used only to perform the sync;
• A minimal copy of event data (times, title, status) is stored to power your ATLAS calendar view and conflict detection.

How we share it (we don't, except as below)

• Teammates in your organization see only busy/free status derived from your connected calendar, never event titles, descriptions, or attendees;
• Google user data is not transferred to third parties, advertising platforms, or data brokers; it is not used for advertising; it is not used to train AI or machine-learning models; and it is not sent to the AI features described above;
• Humans do not read this data except (a) with your affirmative agreement, (b) as necessary for security or to comply with applicable law, or (c) when the data has been aggregated and anonymized for internal operations.

Disconnecting

You can disconnect Google Calendar at any time from Calendar settings or the Integrations page. Disconnecting stops the sync, deletes the connection and its stored tokens, and revokes ATLAS's access with Google. You can also revoke access from your Google Account permissions page.

8. How We Share Information

We share information only as follows:

• Within your organization — according to the roles and permissions your administrators configure;
• With sub-processors — service providers listed in the next section who process data on our behalf to run the Service;
• With Google and LinkedIn — website visit and conversion data for analytics and advertising measurement, including hashed contact details as described under "Cookies", only as your cookie choices allow;
• With integrations you connect — as described above, under your control;
• With recipients you choose — for example, when your organization sends an email, meeting invitation, or social post through ATLAS;
• For legal reasons — when required by law, legal process, or to protect the rights, safety, and security of Captivix, our customers, or the public; and
• In a business transfer — in connection with a merger, acquisition, or sale of assets, subject to this policy.

Support access: Captivix platform administrators can access customer workspaces for support and operations, including a supervised "impersonation" mode. Impersonation is visibly indicated in the product and every start and stop is recorded in the audit log.

9. Sub-processors and Service Providers

We use the following providers to operate the Service. This list reflects the providers actually in use as of the date above.

Client-side resources: the app loads the Inter font from Google Fonts, and some lead avatars are generated by the DiceBear API. We do not embed third-party advertising or product-analytics trackers in the ATLAS application itself. Our public marketing website (captivix.com) uses the analytics and advertising tools described under "Cookies".

10. Multi-Tenancy and Data Isolation

Every organization's data is segregated by an organization identifier enforced in the application's data layer: each request is resolved to the acting user's organization, and queries are scoped to that organization. Users can only belong to and act within organizations they are members of, subject to role-based permissions (owner, admin, sales, user tiers) that administrators can tune per organization. Public pages (scheduling links, supplier portals) resolve their organization from the link token itself and expose only the minimal fields needed for that page.

11. Security

• Transport encryption (HTTPS/TLS) for the Service;
• Encryption at rest for high-sensitivity secrets: OAuth tokens, third-party API keys, and stored connection strings are encrypted with AES-256-GCM;
• Passwords stored as bcrypt hashes; first-login password setup for invited users;
• HTTP-only, secure session cookies; server-side sessions with a 7-day expiry; sessions destroyed on logout;
• Role-based access control and per-organization permission overrides;
• Rate limiting on public endpoints and anti-abuse controls on public forms;
• Audit logging of security-relevant actions, including all platform-administrator impersonation.

No method of transmission or storage is 100% secure; we cannot guarantee absolute security. Please use a strong, unique password and notify us of any suspected unauthorized access.

12. Data Retention

• Login sessions expire after 7 days (or on logout).
• Invitation links and OAuth state tokens expire automatically.
• Website-deployment telemetry is pruned on a rolling basis (raw health samples after about 7 days; daily rollups after about 90 days).
• Customer Data (CRM records, communications, files, recordings) is retained for as long as the customer's organization keeps it in the Service or until the organization asks us to delete it. Customer Data is deleted within 30 days of account closure.
• Audit logs and billing records are retained for 3 years for security and legal compliance.

To request deletion of an account, an organization, or specific records, contact us at the address in the Contact section; we will act on verified requests within the timeframes required by applicable law.

13. Your Rights and Choices

Depending on where you live (for example, under the GDPR, UK GDPR, or CCPA/CPRA), you may have rights to access, correct, delete, export, or restrict the processing of your personal information, and to object to certain processing.

• If your data is in a customer's workspace (for example, you are a lead or contact of an ATLAS customer, or you booked a meeting with one), the customer organization is the controller — please contact them first. We assist our customers in honoring such requests.
• If you hold an ATLAS account, contact us directly and we will respond to verified requests.
• Email recipients can use the unsubscribe link in emails sent through ATLAS; unsubscribes, bounces, and complaints are added to suppression lists that block further sends to that address from the sending organization.

We do not discriminate against you for exercising your rights. You may also lodge a complaint with your local data-protection authority.

14. International Data Transfers

The Service is hosted in the United States (AWS US East). If you access the Service from outside the United States, your information is transferred to and processed in the United States and in the countries where our sub-processors operate. For transfers of personal data from the EU or UK, we rely on Standard Contractual Clauses (SCCs) as the lawful transfer mechanism. Customers who require a Data Processing Agreement (DPA) incorporating SCCs may request one by contacting us at privacy@captivix.com.

15. Children

The Service is a business tool and is not directed to children. We do not knowingly collect personal information from anyone under 18. If you believe a child has provided us personal information, contact us and we will delete it.

16. Changes to This Policy

We may update this policy from time to time. We will post the updated version on this page and update the "Last updated" date; for material changes we will provide additional notice (for example, by email or in-product notice) before the change takes effect.

17. Contact Us

Questions or requests about this policy or your data:

Captivix, Inc.

1320 Tower Rd., Schaumburg, IL 60173

Phone: +1 (312) 324-4514

Email: privacy@captivix.com

Or visit our Contact Page