Capy procurement policy evidence
Only topics backed by verified findings appear below. Each row preserves the platform's exact policy words and capture provenance.
| Topic | Plan or tier | Risk | Their words | Source |
|---|---|---|---|---|
| DPA, audit rights & data residency | All applicable tiers | unknown | “ We are based in the United States, and we and our service providers may process personal information in the United States and other countries. These countries may have privacy laws that differ from the laws where you live.” | Captured 2026-09-24Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ Data Processing Addendum , which applies when we process personal data on behalf of eligible business customers.” | Captured 2026-09-24Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ Where required, we rely on legally recognized transfer mechanisms, which may include Standard Contractual Clauses, the UK International Data Transfer Addendum, adequacy decisions, data processing agreements, or other lawful mechanisms.” | Captured 2026-09-24Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ This Policy applies when we act as a controller of personal information, such as for account administration, marketing, website analytics, billing, security, support, and recruiting. When a business customer uses Capy to process personal information contained in its repositories, prompts, tickets, Slack messages, Linear issues, logs, or other Customer Content, we generally act as that customer’s processor or service provider. That processing is governed by our agreement with the customer, including our Data Processing Addendum where applicable.” | Captured 2026-09-24Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ account, billing, tax, and transaction records may be retained for legal and accounting purposes;” | Captured 2026-09-24Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ Deletion may not immediately remove data from encrypted backups, archival logs, legal holds, billing records, or systems where retention is required or permitted by law.” | Captured 2026-09-24Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “ Customer Content may be deleted or returned after termination according to the applicable agreement and our standard deletion processes; and” | Captured 2026-09-24Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ operational logs, security logs, telemetry, and backups are retained for limited periods based on security, reliability, and legal needs;” | Captured 2026-09-24Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ We retain personal information for as long as reasonably necessary for the purposes described in this Policy, including to provide the Services, maintain business records, comply with law, resolve disputes, enforce agreements, secure the Services, prevent abuse, and maintain backups.” | Captured 2026-09-24Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ Upon termination, your right to use the Services ends immediately. You remain responsible for fees incurred before termination. We may delete Customer Content according to our retention practices, unless we are required or permitted to retain it for legal, security, fraud-prevention, backup, accounting, dispute-resolution, or compliance purposes.” | Captured 2026-09-24Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ task, thread, PR, review, and integration history may be retained while your account or organization is active unless deleted or configured otherwise;” | Captured 2026-09-24Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ de-identified or aggregated data may be retained indefinitely if it no longer identifies a person or customer.” | Captured 2026-09-24Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Service providers and subprocessors that provide hosting, compute, storage, model processing, authentication, billing, analytics, monitoring, support, email, recruiting, workflow orchestration, and similar services. See Subprocessors .” | Captured 2026-09-24Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Others with your consent or at your direction. ” | Captured 2026-09-24Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Subprocessors , which identifies key service providers and customer-directed integration providers.” | Captured 2026-09-24Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Capy uses AI model providers and model-hosting infrastructure to provide the Services. When you run an agent or use an AI feature, we may send relevant prompts, code context, files, logs, tool outputs, images, screenshots, metadata, and generated content to the selected or routed model provider as needed to produce the requested Output.” | Captured 2026-09-24Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Other users in your organization when collaboration features, threads, projects, tasks, PRs, Slack sync, Linear delegation, or other sharing features make information visible to them.” | Captured 2026-09-24Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ model providers and infrastructure providers involved in delivering agent functionality;” | Captured 2026-09-24Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Payment processors and billing providers to process payments, subscriptions, credits, taxes, invoices, disputes, and fraud checks.” | Captured 2026-09-24Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Affiliates that process information consistent with this Policy.” | Captured 2026-09-24Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Integration content: information made available through connected services such as GitHub, Slack, Linear, Sentry, Vercel, or other integrations you authorize. This may include repository metadata, PR data, issue text, comments, Slack channel/thread messages, Linear issue context, Sentry issue data, deployment metadata, user identifiers, and permission metadata.” | Captured 2026-09-24Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ The Services may use third-party model providers, infrastructure providers, data stores, authentication providers, billing providers, analytics providers, customer-communication providers, recruiting providers, and connected integrations. Examples include model providers such as Anthropic, OpenAI, Google/Vertex AI, OpenRouter, xAI, Fireworks, Z.AI, and other supported model hosts; development integrations such as GitHub, Slack, Linear, Sentry, and Vercel; and service providers listed on our Subprocessors page.” | Captured 2026-09-24Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ The Services may link to or integrate with third-party services. Their privacy practices are governed by their own policies. We are not responsible for third-party privacy or security practices.” | Captured 2026-09-24Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ route Customer Content to model providers, infrastructure providers, connected integrations, and other subprocessors as needed to provide the Services;” | Captured 2026-09-24Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Authorities, courts, regulators, or third parties when we believe disclosure is necessary to comply with law, protect safety or security, investigate abuse, enforce agreements, or protect rights.” | Captured 2026-09-24Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ analytics, email, support, monitoring, and recruiting providers;” | Captured 2026-09-24Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ connected services you authorize, such as GitHub, Slack, Linear, Sentry, and Vercel;” | Captured 2026-09-24Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ route prompts, context, and Output to model providers and other processors as necessary to provide the Services;” | Captured 2026-09-24Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ authentication providers, such as Clerk;” | Captured 2026-09-24Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ We may disclose personal information to:” | Captured 2026-09-24Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Customer-directed integrations such as GitHub, Slack, Linear, Sentry, Vercel, model providers, BYOK providers, external subscriptions, MCP servers, or other third-party tools you configure or instruct the Services to use.” | Captured 2026-09-24Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ payment and billing providers, such as Stripe and Autumn;” | Captured 2026-09-24Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ We require service providers that process personal information on our behalf to protect it and use it only for authorized purposes. Customer-directed integrations and third-party services you choose to connect may process information under their own terms and privacy policies.” | Captured 2026-09-24Open source →Finding permalink → |
| Tier differences | All applicable tiers | unknown | “ subscriptions renew automatically until canceled;” | Captured 2026-09-24Open source →Finding permalink → |
| Tier differences | All applicable tiers | unknown | “ all fees are non-refundable except where required by law or expressly stated in these Terms or an order form.” | Captured 2026-09-24Open source →Finding permalink → |
| Tier differences | All applicable tiers | medium | “ We may modify, update, suspend, discontinue, or limit all or part of the Services. We will use reasonable efforts to avoid materially reducing paid functionality during a subscription term, but urgent changes may be necessary for security, legal, provider, infrastructure, safety, reliability, or abuse-prevention reasons.” | Captured 2026-09-24Open source →Finding permalink → |
| Tier differences | All applicable tiers | unknown | “ monthly subscription credits refresh monthly and do not roll over unless the Services or your plan expressly says otherwise;” | Captured 2026-09-24Open source →Finding permalink → |
| Tier differences | All applicable tiers | medium | “ Unless an order form states otherwise, we do not guarantee uptime, model availability, feature availability, compatibility, latency, or continued availability of any provider, model, integration, VM size, API endpoint, or feature.” | Captured 2026-09-24Open source →Finding permalink → |
| Tier differences | All applicable tiers | unknown | “ usage-based charges, credit purchases, seat charges, overages, and auto-reload charges may be billed to the payment method on file;” | Captured 2026-09-24Open source →Finding permalink → |
| Tier differences | All applicable tiers | unknown | “ promotional, referral, partner, open-source, trial, or grant credits may be subject to additional eligibility, expiration, usage, revocation, and anti-abuse rules;” | Captured 2026-09-24Open source →Finding permalink → |
| Tier differences | All applicable tiers | unknown | “ separately purchased credits may roll over as described in the Services;” | Captured 2026-09-24Open source →Finding permalink → |
| Tier differences | All applicable tiers | medium | “ We may offer free plans, trials, beta features, preview features, evaluation access, open-source credits, promotional credits, or experimental models. These features may be limited, modified, discontinued, rate-limited, or revoked at any time. Unless we expressly state otherwise, they are provided "as is," without service-level commitments, warranties, indemnities, or support obligations.” | Captured 2026-09-24Open source →Finding permalink → |
| Tier differences | All applicable tiers | unknown | “ You are responsible for configuring spend caps, auto-reload settings, model selection, VM size, and similar usage controls. If you dispute a charge, contact support@capy.ai within 30 days and pay all undisputed amounts.” | Captured 2026-09-24Open source →Finding permalink → |
| Tier differences | All applicable tiers | medium | “ You may stop using the Services at any time and may cancel paid subscriptions through the billing portal or by contacting us if self-service cancellation is unavailable.” | Captured 2026-09-24Open source →Finding permalink → |
| Tier differences | All applicable tiers | medium | “ Paid plans, credit purchases, subscription tiers, overage settings, auto-reload, billing intervals, seat charges, spend limits, promotional credits, and enterprise terms are described in the Services, on our pricing page, in the applicable order form, or in related documentation.” | Captured 2026-09-24Open source →Finding permalink → |
| Tier differences | All applicable tiers | unknown | “ you authorize us and our payment processors to charge all applicable fees, taxes, and charges;” | Captured 2026-09-24Open source →Finding permalink → |
| Tier differences | All applicable tiers | unknown | “ fees are stated in U.S. dollars and exclude taxes;” | Captured 2026-09-24Open source →Finding permalink → |
| Tier differences | All applicable tiers | medium | “ Some models, features, external subscriptions, BYOK configurations, or customer-directed integrations may be subject to different provider terms, retention, abuse-monitoring, or data-use practices. If you bring your own API key, connect your own ChatGPT/Codex or GitHub Copilot subscription, or instruct an agent to use a third-party service, that provider’s agreement with you may govern its handling of data.” | Captured 2026-09-24Open source →Finding permalink → |
Informational only, not legal advice. Terms can change; verify every cited source and capture date during procurement review.
📢 POLICY UPDATES ALERT
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.