Contents

Privacy Policy

Last updated on 28 June 2026

1.Introduction

This privacy policy (“Privacy Policy”) explains how capria handles your personal data. It applies to our mobile application, our website at www.capria.me, and any related services we offer (together: the “Services”).

capria is a sole proprietorship registered with the Dutch Chamber of Commerce under registration number 42083324. In this Privacy Policy, “capria”, “we”, “our” or “us” refers to capria as the controller of your personal data.

We are committed to protecting your privacy and processing your personal data in line with the EU General Data Protection Regulation (“GDPR”). This Privacy Policy describes what data we collect, how and why we process it, who we share it with, and how long we keep it. It also explains your rights as a data subject and how you can exercise them.

Please read this Privacy Policy carefully. You can find our contact details in the Contact details section below.

2.Personal data

The table below sets out the personal data we process, why we process it, and the lawful basis we rely on under the GDPR. Not every row applies to every user. A category only applies if you actually use the relevant feature. For example, if you do not turn on push notifications, we do not process a device token for that purpose, and if you do not subscribe, we do not process payment data.

Personal data What we do with it and why Why we are allowed to use it (lawful basis)
Account information: your name, your email address, and how you sign in (either with your email and password, or with your Apple or Google login). We use this information to set up your account, let you log in, keep your account secure, and run the app for you. We also use it to reply when you contact us for help, and to let you know if these Terms or this Privacy Policy change in an important way. We rely on performance of a contract, because we need this information to provide the service you signed up for. For service messages and important notices, we rely on our legitimate interests in keeping you informed, or on a legal obligation where one applies.
The content you create in capria: your goals, sub-goals, tasks, daily plans, the tasks you choose to focus on, your mood and energy, your reflections, and your scores. This information is what makes capria work for you. We use it to show your daily plan, the tasks you are focusing on, your mood and energy, your reflections, and your scores and progress over time. Without it, the app cannot do what it is meant to do. We rely on performance of a contract, because we need this information to provide the service you signed up for.
Your notification settings and your device’s notification token, which is a code that lets push notifications reach your specific phone. We use this information to send the reminders you have switched on, such as a nudge to plan your day, focus on a task, or reflect in the evening. We rely on your consent. You can turn notifications off in your device settings at any time, which withdraws that consent.
Technical and usage information: your device type and model, a device identifier (which is a code that identifies your device), the operating system and app version you use, your time zone, and your IP address (which is the network address your device uses to connect to the internet, and which appears in our server logs). We use this information to keep the app secure and running properly, to find and fix problems, and to see which features people use so we can make capria better. We rely on our legitimate interests, namely keeping capria secure and improving it. We have weighed these interests against your rights and consider that they do not override them.
Payment and subscription information: whether you are on the free or paid plan, what you have bought, and whether your subscription is active. We use this information to start and manage your subscription and to unlock the paid features. The payment itself goes through the app store, so we never see or store your card details. We rely on performance of a contract, because we need this information to provide the paid service you signed up for. We also rely on a legal obligation to keep transaction records for the period the law requires.
Your email address and your choices about which emails you want to receive. If you have opted in, we use this information to send you newsletters, offers and product updates. If you joined our waitlist on our website, we use it to tell you when capria launches. We rely on your consent. You can withdraw it at any time using the unsubscribe link.

What these lawful bases mean:

  1. Performance of a contract: we are allowed to use your information when we need it to give you the service you asked for. Without it, we could not provide capria to you.
  2. Consent: we are allowed to use your information because you have actively given us permission. You can take that permission back at any time.
  3. Legitimate interests: we are allowed to use your information for a genuine, reasonable business purpose, as long as it does not override your rights and freedoms.
  4. Legal obligation: we are allowed, or sometimes required, to use your information because the law says we must.

Changes to personal data

We want the personal data we hold about you to stay accurate and up to date. If any of your personal data changes, for example your email address, please let us know as soon as possible. If any information we hold about you is wrong or incomplete, you have the right to have it corrected or completed.

Sensitive personal data

capria is not designed to collect sensitive personal data, and we do not ask you for it. Your reflections are free text, so please do not enter information you consider sensitive, for example details about your health. capria does not intend to process special category data, and we ask you not to provide it.

3.How we collect, keep and share your data

Device and technical information we collect automatically

When you use the Services, we and our infrastructure providers automatically collect and log certain technical information from your device. This includes your device type and model, the operating system and app version you use, your time zone, a device identifier (which is a code that identifies your device), and your IP address (which is the network address your device uses to connect to the internet, recorded in our server logs). We use this information to keep capria secure and running properly, to find and fix problems, and to protect the app against misuse. We rely on our legitimate interests for this.

We do not use analytics inside the app to track which features or screens you use. We do use a privacy-friendly, cookieless analytics service on our website, which we describe in Section 8 (Cookies and similar technologies) below.

How long we keep your personal data

We keep your personal data only for as long as we need it for the purposes set out in this Privacy Policy. We keep the information in your account for as long as your account is active.

If you delete your account, or ask us to delete your data, we permanently delete it from our active systems immediately. Because we keep secure daily backups, a copy may remain in those backups for up to 7 days afterwards, after which it is permanently deleted. We may keep some information for longer where the law requires it, for example records we need to meet our tax and accounting obligations.

If you have signed up to our newsletter or waitlist, that is managed separately. Deleting your account does not automatically unsubscribe; you can unsubscribe at any time using the link in our emails.

Who we share your personal data with

We do not sell your personal data. To run capria and provide our services, we share your personal data with a small number of trusted providers who process it on our behalf and only for the purposes we instruct. These are:

  1. Supabase, our database and backend provider, which securely stores your account and the content you create. Supabase processes this data in the European Union (Frankfurt, Germany).
  2. Resend, our email provider, which we use to send you account and service emails. Resend processes data in the United States.
  3. Cloudflare, which hosts our website, routes our email, and provides the website analytics described in Section 8 (Cookies and similar technologies). Cloudflare is based in the United States.
  4. Apple, which processes your payments and subscription through the App Store, delivers push notifications, and provides Sign in with Apple if you use it. Apple is based in the United States.
  5. Google, which provides Sign in with Google if you use it. Google is based in the United States.

We may also share your personal data with law enforcement authorities, regulators or courts where they lawfully request it, for example to help prevent or detect crime.

Some of these providers are located outside the European Union. How we protect your data when it is transferred to those countries is explained in Section 4 (International data transfers) below.

4.International data transfers

capria is based in the Netherlands, and the core data in your account is stored on servers in the European Union. Some of the companies that help us provide the Services are based outside the European Economic Area (the “EEA”), mainly in the United States. This applies, for example, to the providers we use for email delivery, website hosting, payments, push notifications, and signing in with Apple or Google.

When we transfer your personal data outside the EEA, we make sure it stays protected to the standard required by European law. We rely on appropriate safeguards for this, such as the European Commission’s Standard Contractual Clauses, or a provider’s certification under the EU-US Data Privacy Framework where that applies.

You can ask us for more information about these safeguards, or for a copy of them, using the contact details at the end of this policy.

5.How we keep your data secure

We take the security of your personal data seriously and use appropriate technical and organisational measures to protect it. For example, your data is encrypted while it travels between your device and our servers and while it is stored, access to it is restricted, and our database is hosted in the European Union.

No method of sending or storing data is completely secure, so we cannot promise absolute security. If you believe your account or your data has been compromised, please contact us using the details at the end of this Privacy Policy.

6.Your rights

You have a number of rights over the personal data we hold about you. You can ask us to:

  1. Access your data and receive a copy of it;
  2. Correct or complete data that is inaccurate or incomplete;
  3. Delete your data, except where we need to keep it to meet a legal obligation or to establish, exercise or defend a legal claim;
  4. Provide your data in a portable format, so you can move it to another service;
  5. Restrict how we use your data in certain situations, for example while we check the accuracy of data you have contested, or while we consider an objection you have raised;
  6. Withdraw your consent at any time, where we rely on your consent to process your data. This does not affect any processing we carried out before you withdrew it;
  7. Object to processing we base on our legitimate interests, where you feel your interests or rights outweigh ours;
  8. Object to the use of your data for direct marketing at any time.

To exercise any of these rights, contact us using the details at the end of this Privacy Policy. We will respond within one month. If your request is complex, or you have made a number of requests, we may extend this by a further two months, and we will let you know if we do. Exercising your rights is free, but we may charge a reasonable fee or decline a request that is clearly unfounded or excessive. Where we have reasonable doubts about who is making a request, we may ask for information to confirm your identity.

Complaints

If you believe we have not handled your personal data properly, you have the right to lodge a complaint with a data protection authority. As capria is based in the Netherlands, the relevant authority is the Dutch Data Protection Authority (Autoriteit Persoonsgegevens). You can also complain to the supervisory authority in the EU country where you live or work, or where you think the issue took place. Making a complaint does not affect any other legal remedy you may have.

The contact details of the Dutch Data Protection Authority are:

Autoriteit Persoonsgegevens
PO Box 93374
2509 AJ The Hague
The Netherlands
autoriteitpersoonsgegevens.nl/en/contact
Phone: +31 (0)70 8888 500

7.Age

capria is intended for people aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you are under 18, please do not use capria or provide any personal data to us.

If you believe someone under 18 has provided us with personal data, please contact us using the details below and we will delete it.

8.Cookies and similar technologies

The capria app and our website, www.capria.me, do not use cookies.

The app is a native mobile app, and to keep you signed in and to make it work, we store a small amount of technical information on your device, such as a secure login token and your settings.

To understand how our website is used, we use Cloudflare Web Analytics, a privacy-friendly analytics service. It does not use cookies, does not track you across other websites, and does not build a profile of you. It collects aggregate information such as page views, which pages people visit, and where visitors come from. Because this does not rely on cookies, we do not need to ask for your consent, but we want you to know we use it.

9.Changes to this policy

We may update this Privacy Policy from time to time, for example when we add new features or when the law changes. When we make a significant change, we will let you know in a suitable way, for example through the app or by email, before the change takes effect. The date at the top of this policy shows when it was last updated, and we encourage you to review it from time to time.

10.Contact details

Please find below the contact details of capria:

capria
Bella Vistastraat 178
1096 GM Amsterdam
Chamber of Commerce (KvK) number: 42083324
Email: [email protected]

If you have any questions about this Privacy Policy or about how we handle your personal data, or if you want to exercise your rights, please contact us at [email protected].