Privacy Policy
This policy explains when Capleed processes personal data, for what purpose and on what legal basis. It serves as our transparency notice under Turkish Personal Data Protection Law No. 6698 ("KVKK") art. 10, and under GDPR arts. 13–14 where that regulation applies.
1. Data controller
Legal name: [full company name]
Address: [registered address]
Tax ID: [VKN] ·
Trade registry (MERSİS): [MERSİS]
Email: kvkk@capleed.com
2. What this policy covers
Capleed processes personal data in two distinct roles, and the distinction matters because it determines who you address a request to.
a) Where Capleed is the controller
Your visit to capleed.com, the demo request form, and any correspondence with us. Capleed decides the purpose and means of this processing; that is what this policy primarily governs.
b) Where Capleed is a processor
Data that customer companies enter into the platform — business card details of trade-show visitors, voice notes, forms, and the customer's own user accounts. For that data the customer company is the controller and Capleed acts only on its instructions under a Data Processing Agreement. If you handed your business card to a Capleed customer at a trade show and want to exercise a right over that data, address the request to that company; if it reaches us we forward it to them.
3. Personal data we process
3.1 Website visitors
- Connection data: IP address, browser and operating-system information, requested page, timestamp — generated in our hosting provider's server logs.
- capleed.com uses no advertising or analytics tracking cookies, builds no visitor profiles and sends no data to ad networks.
- Typefaces are loaded from Google Fonts, which means your browser's IP address is transmitted to Google (see section 5).
3.2 Demo request form
The form collects and stores: full name, company, work email, phone, country, target market and your free-text message. To prevent abuse we also store a SHA-256 digest of your IP address — the raw IP is never recorded. The digest is used only to rate-limit repeated submissions from the same source and is protected as personal data.
3.3 Platform user accounts
For users created by a customer's administrator: full name, email, role, optional profile picture and sign-in records. Passwords are held hashed by our authentication provider; Capleed can never see or store a plaintext password.
3.4 Data entered into the platform by customers
Business card images, voice recordings and their transcripts, form fields, name, job title, company, email, phone, website, country and any custom fields the customer defines. Capleed is a processor for this data (see section 2/b).
4. Purposes and legal bases
| Data | Purpose | Legal basis |
|---|---|---|
| Server logs | Service delivery, security, diagnostics | Legitimate interest (KVKK 5/2-f · GDPR 6/1-f) |
| Demo request form | Responding to you, scheduling a demo, preparing a quote | Explicit consent (KVKK 5/1 · GDPR 6/1-a) |
| IP digest (SHA-256) | Abuse prevention / rate limiting | Legitimate interest |
| User accounts | Performance of the contract, access control, support | Contract (KVKK 5/2-c · GDPR 6/1-b) |
| Invoicing and payment data | Accounting and tax obligations | Legal obligation (KVKK 5/2-a · GDPR 6/1-c) |
| Lead data in the platform | Capture, scoring and reporting on the customer's instruction | Customer is controller; Capleed is processor |
Where processing relies on consent you may withdraw it at any time. Withdrawal does not affect processing already carried out lawfully. Use the contact route in section 8.
5. Sub-processors and international transfers
We use the following providers to deliver the service. All are bound by contract and process data only on our instructions.
| Provider | Function | Location | Status |
|---|---|---|---|
| Supabase | Database, authentication, file storage | [region] | Required |
| Vercel | Application and website hosting | [region] | Required |
| Anthropic | Card/form reading and lead scoring (AI) | USA | Required |
| OpenAI | Voice-note transcription | USA | Required |
| Resend | Platform and account email | USA (sending infrastructure: Japan) | Required |
| Apollo.io | Record enrichment | USA | Optional |
| Lusha | Record enrichment | [region] | Optional |
| Serper | Record enrichment (web search) | USA | Optional |
| Google Fonts | Typeface delivery (capleed.com only) | USA | Required |
Providers marked Optional are disabled by default and engage only when a customer company turns enrichment on in its own configuration.
Some of the above are located outside Türkiye, so the processing involves an international transfer of personal data. Transfers are made on the basis of [chosen mechanism: standard contractual clauses / undertaking / adequacy decision] under KVKK art. 9 (and the corresponding GDPR Chapter V mechanism where applicable).
6. Retention periods
We do not keep personal data longer than the purpose requires. Periods are collected in a separate document: Data Retention Policy. In summary:
- Demo requests: 12 months from last contact, then deleted.
- Customer data: 30 days after the contract ends — the window allowed for export — then deleted.
- Backups: 7-day rotation; deleted data leaves backups within that window at the latest.
- Invoicing and accounting records: the statutory period, as a rule 10 years.
7. Security measures
- Every customer's data is separated at the database level with row-level security; one customer's query cannot reach another's rows.
- All connections are encrypted in transit (TLS); data is encrypted at rest.
- Third-party service keys are held in an encrypted vault; application tables store only a vault reference.
- Access to personal data follows least privilege. Every support session opened into a customer account is recorded and is visible to that customer's own administrator.
- Backup restorability is tested regularly.
8. Your rights
You have the right to: learn whether your personal data is processed; request information about it; learn the purpose of processing and whether it is used in line with that purpose; know the third parties, domestic or abroad, to whom it is transferred; have inaccurate or incomplete data corrected; request erasure or destruction where the statutory conditions apply; require that corrections and erasures be notified to those third parties; object to a decision produced solely by automated analysis that has an adverse effect on you; and claim compensation for damage suffered through unlawful processing. Where the GDPR applies you additionally have the rights to data portability and to restriction of processing.
How to reach us: send requests to kvkk@capleed.com or to the postal address in section 1, with enough information for us to verify your identity. We respond within 30 days at no charge; where a request entails additional cost, the fee set by the Turkish Data Protection Authority may apply. If our response does not satisfy you, you may lodge a complaint with the Turkish Personal Data Protection Board or your local supervisory authority.
9. Automated decisions and AI
The platform uses AI models to extract fields from card and form images and to score leads. A score is a suggestion: it is shown to the customer's staff, can be overridden, and does not by itself constitute an automated decision with legal effect. Our model providers are contractually barred from using submitted data to train their models.
10. Changes to this policy
When we update this policy we change the "last updated" date on this page, and we notify customers separately about material changes. The version published here is always the one in force.