Privacy Policy

Version 2.1 · Effective 27 August 2026

This policy describes how Capitis handles information — both about the people who use our website and API, and about the shoppers whose clicks pass through our tracking links. Capitis is operated by SINGLE.ID LTD, a company registered in England and Wales under company number 17044105, with its registered office at 20 Wenlock Road, London, England, N1 7GU.

Related documents: Cookies and tracking · Subprocessors · Security · Data Processing Addendum · Business contacts

The one distinction that explains everything else

There are two very different kinds of data here, and we are in a different legal role for each.

Your account data — we are the controller. If you sign up for Capitis, we decide what to collect about you and why. This policy governs that, and you can hold us to it directly.

Your end-users' data — we are your processor. If you are a publisher sending us identifiers, clicks and conversions about your own shoppers, you decide what to send and why. We only act on your instructions. The terms that govern it are in the Data Processing Addendum, and the privacy notice your shoppers should read is yours, not this one.

Everything below is split along that line.

One group is not covered by this policy at all. If you have never used Capitis, and we hold your business's published contact details because we researched you as a possible customer, you are in neither role above. That group has its own notice — Business contacts — covering what we hold, where we got it, and how to make us delete it.

Part one — if you have a Capitis account

What we collect about you

• Account information. Your email address; your name and profile picture if you sign in with Google or GitHub; your organisation name; and the authentication records needed to keep you signed in.
• Usage data. Which API endpoints you call and when, request volumes, error rates, dashboard actions, and an audit log of security-relevant events on your account (API keys created and revoked, webhooks changed, identifiers attached or revoked).
• Technical data. IP address and browser information in server logs, kept for operational and security purposes.
• Billing information. Your billing contact details, subscription tier and invoice history. Card details are handled entirely by Stripe — we never see or store them.
• What you write to us. Support emails, compliance reports and anything you send to our published addresses.

Why, and on what legal basis

We do not use your data for advertising, we do not sell it, and we do not use it to train machine learning models. There is no automated decision-making that produces legal or similarly significant effects on you.

Marketing

We send product and service email to account holders about the service they are using. If we ever send marketing that needs consent, we will ask for it, and every message will carry a one-click unsubscribe.

How long we keep it

Only one of those rows is enforced by a machine: server and operational log rows are deleted by a job that runs every night, once they are more than 90 days old. The rest are periods we apply by hand. Nothing on a schedule deletes an audit-log entry, a closed account or old support correspondence, and account deletion is carried out by a person when you ask for it.

Part two — shoppers, clicks and identifiers

This part describes data about your end-users. You are the controller; we are your processor. We are describing it here because transparency about it is what makes your own privacy notice possible to write.

What a click records

When a shopper follows a Capitis tracking link, we record, server-side: the timestamp, their IP address, their user agent (the browser and device string), the link, the merchant and the campaign name if you set one, the network the click was handed to, the address we sent the shopper on to, and the click token that lets a later conversion be matched back. Campaign is a single free-text field; there is no separate label.

The click record also carries columns for a country, a referring URL, a device class and a fraud score, and nothing fills them. They are empty on every click: we never read the browser's referring-URL header, we never parse the user agent, we compute no fraud score, and the country is only ever taken from a header that our current setup does not receive.

We do not set or read any cookie on the shopper, and we run no script on them. The redirect is a plain HTTP response. The full detail is on the Cookies and tracking page.

IP address and user agent are personal data. We are not going to call them anything else. Attribution does not depend on either of them — a conversion is matched back to a click through the click token alone. They are recorded because the affiliate networks require us to be able to evidence traffic quality on demand, and because a complaint about one specific click cannot be answered without them. Both are erased 90 days after the click; see How long we keep it below.

Identifiers

If you use the identity features, email addresses, phone numbers and wallet addresses reach us raw, and the API turns each one into an HMAC-SHA256 fingerprint the moment it arrives. Only the fingerprint is written to the database — the address or number you put in those fields is not stored. Raw is the only option we offer: there is no field anywhere in the API, and no column in the audience import, for an identifier you have hashed yourself, so the value does travel to us in the clear inside the encrypted connection.

Card tokens work differently. A card token is already an opaque reference issued by a card vault and it has to stay usable in that form, so we store it as issued, in lower case, and we do not hash it. Anything that looks like a real card number is rejected before it can be stored. If you send the card's brand, last four digits and expiry month and year alongside the token, we store those too.

Email and phone fingerprints get a second, secret-keyed hash before storage, using a secret held only in the API environment and never written to the database. This matters because the first fingerprint is deterministic — the same input always produces the same output, which is exactly what makes matching a returning shopper possible, and equally what would let someone holding both the parameters and a guessed value test for a match. The second, secret-keyed step means a stolen database on its own cannot be tested against a list of candidate email addresses. Wallet fingerprints do not get that second step: a wallet address is already public on the blockchain, so a further keyed hash would protect nothing.

One thing is yours to control, not ours. An end-user record also carries a free-form metadata object, and we store whatever you put in it, exactly as you send it. Put an email address in there and that email address is in our database in plain form. The promise above is about the identifier fields.

These are pseudonymous personal data, not anonymous data, and we treat them that way throughout. Each identifier can be revoked individually, from the dashboard or the API. The row stays, marked revoked, so the record of it having existed survives — but it stops matching from that moment.

Who else receives this

The affiliate networks. A click has to reach the network for the commission to be paid — that is what an affiliate link is. Awin, Admitad, Rakuten Advertising, CJ, Skimlinks, FMTC and the others receive the click and the tracking reference, and process it as independent controllers under their own privacy policies, for their own purposes. They are not our subprocessors and we cannot limit what they do with it.

The merchant receives the shopper on its own site after the redirect.

Our subprocessors are listed, with locations and transfer mechanisms, at capitis.app/legal/subprocessors. One of them does touch end-user data: Hostinger hosts every part of our production system — the servers, the database, the cache and the backups — so identifiers, clicks and conversions sit on Hostinger machines in Manchester. We do not own the hardware and we are not going to imply that we do. None of the others receives end-user data; what each one does touch is set out in the table on that page.

How long we keep it

IP address and user agent on a click: 90 days. A job runs every night and blanks both columns on every click older than that. The click row itself stays — it is the commission audit trail — but the two fields that point at a person are gone.

Identifiers: until revoked, or until the publisher's account is deleted. The rest of a click record, and conversion records: for the life of the account, because a network can reverse a conversion months after the fact. After account closure, deletion follows DPA §10.

If you are a shopper reading this

You probably arrived here from a publisher's privacy notice. To have an identifier removed, ask the publisher whose site you used — they can revoke it instantly. You can also email privacy@capitis.app; we will help, but in most cases we will need to route the request back to the publisher. The reason is not that we cannot find you: if you give us the email address or phone number you used, we can fingerprint it the same way and see whether it matches something we hold. It is that the fingerprint we store cannot be turned back into an address on its own, so without the publisher we cannot tell which of their shoppers you are, and they are the ones who can revoke the identifier.

Part three — the things that apply to everyone

Where your data is

All Capitis production infrastructure runs in Manchester, United Kingdom. Production personal data is not replicated outside the UK. A small number of subprocessors handling billing, email and sign-in are elsewhere; each is listed with its transfer mechanism on the subprocessors page.

Transfers from the EEA to us rely on the European Commission's adequacy decision for the United Kingdom, renewed on 19 December 2025 and valid until 27 December 2031.

Security

Described in full, including what we have not yet implemented, on the Security page.

Your rights

If you are in the UK, EEA or California you have rights to access, correct, delete, restrict, object to, and receive a portable copy of your personal data, and to withdraw consent where we rely on it. California residents additionally have the right to know and to opt out of sale or sharing — we do not sell or share personal information as those terms are defined by California law.

Email privacy@capitis.app. We respond within 30 days. We do not charge, and we will not treat you differently for asking.

Account deletion is currently handled manually by our team on request; a self-service control is in development.

Complaining

Tell us first — privacy@capitis.app. We will acknowledge your complaint and tell you what we are doing about it. Under the Data (Use and Access) Act 2025 we are required to make this easy and to respond, and we would rather hear it from you than from a regulator.

If you are not satisfied, you can complain to the UK Information Commissioner's Office (ico.org.uk, helpline 0303 123 1113), or to the data protection authority in your EU or EEA country. You can go to them without coming to us first.

Children

Capitis is not directed at anyone under 16. We do not knowingly collect their data, and publishers must not use Capitis links on properties directed at children or submit identifiers for them.

Changes

We will announce material changes by email at least 30 days before they take effect, and the version and date at the top of this page will change.

Contact

Capitis is operated by SINGLE.ID LTD, 20 Wenlock Road, London, England, N1 7GU — Company Number 17044105 (registered in England and Wales).