Privacy Policy

This policy applies to:

• Account holders — the individual who signs up and pays for a CapXHQ workspace.
• Team members — colleagues invited into a workspace by an admin.
• Invited suppliers — people who respond to a quote or tender via a secure token link, without a CapXHQ account.
• Internal collaborators — people invited to view or comment on a project or comparison via a secure token link, without a CapXHQ account.

Account data. When you create an account we collect your name, work email address, organisation name, and an encrypted password hash. If you enable two-factor authentication, we store the associated TOTP factor metadata (never the underlying secret in a way we can read).

Data you enter into the platform. This includes capital projects, budgets, financial year data, supplier invitations, quote and tender responses, weighted scoring, approval documents, comments, and any file references or notes you add. Content submitted by suppliers or collaborators via secure token links is stored against the workspace that issued the link.

Technical data. Our hosting and error-monitoring providers process standard technical data such as IP address, browser user-agent, session timing, and error stack traces, so that the service can run reliably and be debugged when something goes wrong.

Personal data is processed on the following legal bases:

• Performance of a contract — to provide the CapXHQ service you have signed up to use, including running your workspace, storing your project data, and enabling collaboration with your team and suppliers.
• Legitimate interests — to secure the platform against abuse (rate limiting, session integrity, error monitoring), and to send essential service emails such as team invitations, password resets, and security-relevant notices.
• Legal obligations — where we are required to retain or disclose data by applicable law.

CapXHQ uses a small set of trusted sub-processors to run the service. Data is only shared with them for the specific purpose of operating CapXHQ:

• Supabase — database, authentication, and row-level security enforcement.
• Vercel — application hosting and content delivery.
• Resend — transactional email delivery (team invitations, password resets, and similar).
• Sentry — error monitoring, so we can detect and fix bugs promptly.

Once paid subscriptions launch, Stripe will be added as the payment processor. This page will be updated to reflect that change at the same time.

We do not sell personal data, and we do not share it with advertisers or marketing networks.

When you invite a supplier or an internal collaborator, CapXHQ generates a long, random token embedded in a URL. That URL is the credential — anyone who has it can access the specific response or view it was issued for, without logging in.

We do this deliberately so external participants don't need to create an account just to respond to a quote or view a comparison. Token links are scoped to a single resource, expire after a reasonable window, and can be revoked at any time by the workspace admin. Please treat token links as sensitive and share them only with the intended recipient.

Workspace data is retained for as long as the workspace is active. When an account is deleted, workspace data is removed within 30 days, except where a shorter or longer retention period is required by law (for example, tax or accounting records).

Backups may retain data for a short additional period as part of normal database backup rotation, after which it is permanently overwritten.

You have the following rights over your personal data, and can exercise any of them by contacting us at the email address below:

• Access — request a copy of the personal data we hold about you.
• Correction — ask us to correct data that is inaccurate or incomplete.
• Deletion — ask us to delete your account and associated personal data.
• Portability — request your data in a structured, machine-readable format.
• Objection — object to processing based on legitimate interests.
• Complaint — lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) if you believe your rights have been infringed.

Each organisation's data is completely isolated from every other organisation. Access is enforced at the database level using row-level security, not merely by the application interface. Connections between your browser, the application, and the database are encrypted in transit. Passwords are stored only as one-way hashes. Access to production systems is restricted to the operator and audited by our infrastructure providers.

CapXHQ uses only strictly necessary cookies — specifically, a session cookie for authentication and a CSRF-protection cookie. We do not set advertising, tracking, or analytics cookies. A dedicated Cookie Policy is available at /cookies.

We may update this policy from time to time — for example, when we add a new sub-processor. The “Last updated” date at the top of the page always reflects the most recent change. Material changes will be communicated to account holders by email in advance where practical.

Questions about this policy, or any privacy-related request, can be sent to support@capxhq.com.