Privacy

Scope and responsibility

This draft describes the current Capturemo website and mobile pilot, including optional accounts, cloud sync, transcription and AI summaries. It reflects implementation and deployment records reviewed on 13 October 2026. The cloud configuration was not independently rechecked on that date.

The operator’s legal name, business address and privacy contact are still to be supplied in the Imprint. This notice must be completed and reviewed before public release.

For professional project content, the customer may be the controller and Capturemo may act as a processor on the customer’s instructions. The applicable roles and data-processing agreement must be finalized before that service is offered. This notice does not replace the customer’s own duty to inform people whose data appears in a capture.

Website

Your browser sends connection data, including your IP address and the requested page, to the server that delivers this website. The public hosting provider, processing countries, log contents and retention are still to be confirmed.

The current website code sets no cookies, stores no language preference and includes no analytics, advertising, signup form, payment processing or account login. Fonts and images are served with the site. External information links only take you to another provider when you follow them.

The product illustrations do not access your camera, microphone or files, record audio, access app captures or send anything to an AI service.

The mobile app and your device

Capturemo stores captures in its private app storage: original photos, imported photos or videos, voice recordings, written notes, projects, edits and related metadata. This can include titles, timestamps, file information and optional location coordinates with accuracy information. Information about other people may be present in the content you choose to record or import.

Local capture, organization and export work without an account or internet connection. Camera, microphone, media selection and optional location access serve the corresponding feature. You can manage permissions in your device settings; refusing a permission limits the feature that needs it. Capturemo does not record new videos and does not assign the device’s current GPS position as the original location of imported media.

Device-only captures are not uploaded merely because you sign in. Device backups or transfers may create other copies depending on the operating system and your settings; the release’s backup behavior still needs to be verified. Private app storage is not a guarantee against access by someone using an unlocked device.

Accounts and optional cloud sync

Microsoft Entra External ID handles email/password registration, verification, sign-in and recovery. Capturemo uses account identifiers and session information to associate projects and captures with the right account. Saved sign-in credentials are held in the device’s secure credential storage.

Cloud sync is opt-in and transfers account-owned captures while the app is open. Existing device-only captures require a separate explicit import into the account. Synced media and metadata can then be downloaded to other devices signed into the same account.

Pausing sync stops further synchronization; signing out does not delete stored account content. These actions are different from deleting captures or deleting an account. Local use remains available without an account, but account details and connectivity are required for cloud features.

Service providers and storage

The current pilot uses the following services. These are documented service locations, not a guarantee that every provider operation, support access or subprocessor is confined to those locations.

• Microsoft Azure Blob Storage: private storage for synced original photos, imported videos, recordings and other media. Confirm the storage account’s primary and any replica/recovery locations before publication.
• Neon PostgreSQL: project and capture metadata, notes, transcripts, account identifiers and synchronization records. The documented database location is Frankfurt, Germany.
• Microsoft Azure Container Apps and Log Analytics: operation of the cloud API, cleanup jobs and operational logging in West Europe.
• Microsoft Entra External ID: account identity, authentication and recovery. Confirm the tenant’s data location and relevant security-log retention.
• Microsoft Azure Speech: transcription of voice recordings in West Europe.
• Microsoft Azure OpenAI: requested report summaries through a regional Standard deployment in West Europe.

Voice memo transcription

After a saved account capture has successfully synced, its voice memos can be transcribed automatically by Azure Speech. Capturemo sends the recording’s audio to the service; it does not send photos or public media links for transcription. Existing recordings in a syncing account may also be processed.

The resulting transcript, detected language, duration and processing status are stored with the account and cached on the device. Corrections are stored separately from the original machine transcript and recording.

Microsoft states that its fast transcription service does not retain the submitted content. That statement concerns the transcription service: Capturemo still stores your original recording and transcript as part of your capture under the retention rules below.

Optional AI summaries

Generating an AI summary is a separate action in Word export. Capturemo sends the selected saved and synced captures’ titles, written notes and available or corrected transcripts to Azure OpenAI. It does not send photos, videos, audio files or location metadata to the summary model. Personal information written or spoken in your notes can still be included in the text.

One summary covers the selected captures and can be reviewed and edited before being included alongside them in the same .docx file. Transcripts and summaries can be wrong; they do not make decisions about people with legal or similarly significant effects.

The backend does not keep the generated summary as a report archive. It retains a request record containing an account identifier, request identifier and time, without the prompt or summary text. Microsoft’s service can apply separate safety and abuse monitoring, including storage and authorized review of flagged content. Disabling response storage in our request is not a zero-retention guarantee. The applicable provider retention and monitoring configuration must be confirmed before publication.

Exports and sharing

ZIP and editable Word exports are generated on the device and passed to its share sheet. ZIP can contain original files, recordings, notes and metadata, including location information where present. Word contains the selected documentation and an optional reviewed AI summary; it does not embed imported videos.

The recipient, app or storage destination you choose receives that export under its own arrangements. Export files are prepared in temporary app storage; files you save or share elsewhere remain outside Capturemo’s cloud-deletion process.

Purposes and legal bases

The following is the proposed legal-basis mapping for this draft. It must be confirmed for the actual operator, contracts and customer relationships before publication.

• Providing requested accounts and cloud features: performance of a contract or steps at your request before a contract under Article 6(1)(b) GDPR, where those conditions apply.
• Necessary website delivery, proportionate operational/security logs and prevention of deleted data reappearing: legitimate interests under Article 6(1)(f) GDPR, subject to a documented assessment and suitable retention limits.
• Where processing genuinely relies on consent: Article 6(1)(a) GDPR, with a clear way to withdraw consent for the future. Granting a device permission or enabling a feature does not by itself settle its GDPR legal basis.
• Professional customer content processed on instructions: an Article 28 GDPR data-processing agreement; the customer determines the legal basis for its collection and use.

How long data is kept

Local captures remain in app storage until removed. Uninstalling the app, clearing its data or losing the device can remove local copies. Cloud content remains available during the current pilot until deleted; there is no implemented subscription-expiry or inactivity purge.

The recovery settings below were recorded on 6 October 2026. They must be rechecked before publication and are separate from deleting data from the live service.

• Azure media recovery: deleted blobs and deleted containers have seven-day soft-delete retention. Recovery expiry starts when deletion occurs; this is not a promise that every copy disappears seven days after your request.
• Temporary uploads: the staging lifecycle removes files after more than seven days since modification. It runs asynchronously and is a fallback, not an account-deletion deadline.
• Neon database recovery: the recorded production history window is six hours. Other branches or copies still need to be inventoried before a complete backup-retention statement can be made.
• Operational logs: the Azure Log Analytics configuration specifies 30 days. Confirm current settings, recorded fields and any separate provider/security logs.
• Deletion markers: minimal account/directory identifiers and timestamps remain to prevent old requests from recreating deleted data. They contain no email, names, notes, recordings or tokens. No automatic expiry is implemented; necessity, review criteria and a proportionate retention policy still need to be finalized.
• Processing records: transcription and summary attempt records support limits and duplicate-request prevention. No general age-based cleanup is implemented; applicable periods must be finalized. Whole-account deletion removes the account’s content and processing records, apart from the minimal deletion markers.
• The proposed 90-day period after a paid subscription ends is future commercial policy. It is not currently enforced and does not delay an explicit deletion request.

Deleting captures or your account

Deleting a synced capture or voice memo records its removal and schedules cloud cleanup. Device-only removal and cloud deletion are different: an offline action may need synchronization before it reaches the server.

Once the server accepts account deletion, it blocks further account access and removes live database content. A cleanup worker removes the account’s live media and Microsoft directory identity. It runs daily at 03:00 UTC and retries failures, so completion within 24 hours is not guaranteed. Previously issued media links can remain usable until expiry or file removal.

The initiating device removes that account’s local workspace after confirmed acceptance, with retries if file removal fails. Other devices can retain offline work for export and explicit removal. Device-only libraries and exports you saved elsewhere are not remotely erased. Provider recovery copies and minimal deletion markers follow the separate rules above.

Provider contracts and international access

Microsoft and Neon are the current cloud service providers. Their precise contracting entities, processor agreements, subprocessors, support access and any transfers outside the EEA must be confirmed for Capturemo’s accounts. An EU resource location alone does not establish that all processing stays within the EEA.

Before publication, identify any relevant transfer destinations and safeguards, such as an applicable adequacy decision or standard contractual clauses, and explain how to obtain the relevant information. No specific safeguard or all-EU guarantee is asserted in this draft.

Stripe, RevenueCat and app-store payment processing are not integrated in the current pilot. Update this notice with the actual purchase providers and data flows before paid purchases become available.

Your rights

Depending on the applicable conditions, you can request access, correction, erasure, restriction and data portability. You can object to processing based on legitimate interests on grounds relating to your particular situation. Where processing relies on consent, you can withdraw it for the future without affecting the lawfulness of earlier processing.

The operator’s privacy contact is still to be supplied in the Imprint. For content controlled by a professional customer, that customer is ordinarily the first contact for exercising your rights; Capturemo’s assistance process must be covered by the processing agreement.

You can complain to a competent supervisory authority, including the Austrian Data Protection Authority. Capturemo’s current website and app do not carry out solely automated decisions about you with legal or similarly significant effects.

Details still to confirm before publication

This draft is not the final launch notice. The following items remain open:

• Operator identity, postal address and public privacy contact; any required data-protection-officer contact.
• Website hosting, connection/security logs, processing countries and retention.
• Current cloud locations and recovery settings, device backup behavior, provider contracts, subprocessors and international-transfer safeguards.
• Retention and review criteria for deletion markers, processing records and identity/security logs; any additional recovery copies.
• Final legal bases, customer/controller roles and the professional-customer data-processing agreement.