Privacy Policy
Last updated: 15 October 2026
Captus is operated by Captus Digital Solutions (“Captus”, “we”, “us”), which provides an AI assistant that businesses (“Clients”) connect to their WhatsApp Business number to reply to their customers. This policy explains what personal data we handle, why, and the choices you have. It applies to our website captus.cc, our dashboard app.captus.cc, and the WhatsApp assistant service.
Our role
For messages between a Client and their customers, the Client is the data controller and Captus processes that data on the Client's behalf to provide the service. For Client account data (e.g. the email you sign in with), Captus is the data controller.
What we collect
- Client account data — name, email address and sign-in details, business name and description.
- Business information the Client provides — opening hours, products, prices, policies, FAQs, notes and uploaded documents.
- WhatsApp conversation data — the customer's WhatsApp phone number and profile name, and the content of messages exchanged with the Client's number (text, voice notes, images and documents), with timestamps.
- Booking data — appointment details a customer books, and, if the Client connects Google Calendar, free/busy information and the events Captus creates.
- Technical data — server logs such as request times and error messages, used to run and secure the service.
How we use it
- To generate and send replies to customers on the Client's behalf, and to remember context within a conversation.
- To make, change and remind customers about bookings.
- To show conversations to the Client in the dashboard and alert them when a chat needs a human.
- To operate, secure, troubleshoot and improve the service.
We do not sell personal data, and we do not use conversation content for advertising.
Service providers
We use the following providers to run Captus. They process data only as needed to provide their service to us:
- Meta Platforms — WhatsApp Business Platform, to receive and send WhatsApp messages.
- Google — Gemini API, to generate replies and understand voice notes, images and documents; Google Calendar, if the Client connects it.
- Neon — database hosting (Singapore).
- Render — application hosting (Singapore).
- Vercel — website and dashboard hosting.
- Clerk — dashboard sign-in and account management.
Some of these providers may process data outside your country. We rely on their contractual safeguards for such transfers.
Retention
We keep conversation and business data for as long as the Client's account is active, so the assistant and the Client can refer back to it. When a Client closes their account, or when deletion is requested as described below, we delete the related data from our active systems within 30 days.
Security
Data is encrypted in transit. Each Client's data is isolated at the database level, so one business can never see another's conversations. Third-party credentials, such as calendar access tokens, are stored encrypted.
Your rights
Depending on where you live (including under Malaysia's Personal Data Protection Act 2010), you may have the right to access, correct or delete your personal data, or to object to its processing. If you are a customer who messaged a business that uses Captus, you can contact that business directly, or contact us and we will pass your request on and assist. See Data deletion for how to have your data deleted.
Children
Captus is a business tool and is not directed at children under 13.
Changes
We may update this policy. We'll change the date at the top, and tell Clients by email about significant changes.
Contact
Captus Digital Solutions — questions or requests: hello@captus.cc