Privacy policy

Who owns the data

A business that connects its Meta ad account and CRM to the platform is the owner (controller) of its customers' data. CAPI Platform processes that data only on the business's instructions and only for the purposes described on this page.

Visitors of capip.uz itself

For what you leave on capip.uz itself, the owner of the data is CAPI Platform, not a business that uses the platform. A request sent through the site's form — your name, phone number and what you wrote in the comment — is opened as a lead in the platform's own CRM (capiCRM), where the name, the number and the text are stored only encrypted, as described below for every capiCRM record. It is used to answer the request: to call or write back and, if you decide so, to set the service up. Our own team sees it; a reminder to call back, with your name and without the number, may also appear in our team's Telegram chat.

With the request come the address of the page the form was on, the language of the site and — if you came by an ad's link — that link's tags (UTM, fbclid) and Meta's cookies (_fbc, _fbp) when your browser has them for this site. So that the tags are not lost while you move between pages, your browser keeps them for that tab until it is closed (session storage, not a cookie).

The request is not sold, and nobody is given it to use for purposes of their own. As any business on the platform may, we may report it — that a request was left and, later, what came of it — to our own Meta ad account through the Conversions API, to measure our own advertising: only the hash of the phone number, the ad click identifiers named above and a hashed internal number are sent, with the name and time of the event and, for a sale, its amount — never the name, the number itself or what you wrote.

The support bot in Telegram is a relay. What you write to it — text, photos, voice messages — is copied through Telegram to our team's chat together with your Telegram name, username, your app's language and your Telegram ID (the number of your chat with the bot), and the answer comes back to you through the bot. The platform keeps neither the messages nor who wrote them: the conversation exists only in Telegram — in your chat with the bot and in our team's chat — and Telegram's own terms apply to it. The only thing the platform stores is which chat is the team's.

The public pages of capip.uz have no analytics counters and no advertising pixels, and the site sets no analytics or advertising cookies. The cookies it does set only make it work: one remembers which language you read it in; the rest appear when you sign in and serve the sign-in and the work in your account (the session, the team you chose).

What data is processed

User account: name, e-mail and password. The password is stored only as a hash. An account can also be made, and signed in to, with Google: it then has no password, and the platform takes only the name, the e-mail address (with Google's word that it is confirmed) and Google's identifier of the account (by which the same person is recognised at the next sign-in) from Google. The profile picture is not kept, contacts and access to the Google account itself are not asked for, and no Google access key is stored.

Meta data (through the access key the business connected): ad accounts, campaigns, ads, their spend and results, Facebook Pages and lead forms.

Lead form answers (such as name, phone number and answers to the form's questions) are delivered to the business's CRM and, if the business switched new-lead notices on, shown in the Telegram chat it connected. A copy is kept encrypted for up to 7 days, so a delivery can be retried, and is then erased. From the leads of the connected Pages' forms the platform also keeps, without the answers, the Meta lead ID, the identifiers of the ad it came from and SHA-256 hashes of the phone number and e-mail, to tie CRM records to their ads.

External CRM data (Bitrix24, amoCRM): names, stages, amounts and dates of leads and deals, ad tags (UTM, Meta lead ID) and, when the business chooses one, the option set in a list-type category field ("Category B", say), and the lead's responsible employee — by their number in the CRM, without a name. Phone numbers and e-mails from these CRMs are never stored in the clear: only their SHA-256 hash and a partly masked phone number.

Website tracking code (if the business installs it on its site): where the visit came from, that is UTM tags, fbclid and Meta cookies (_fbc, _fbp). The code reads no personal data and sends nothing anywhere; it only adds these markers to the site's forms as hidden fields.

Connection keys (Meta, CRM, Telegram) are stored only encrypted (AES-256-GCM).

capiCRM (when the business uses the platform's own CRM): the customer's name, phone, e-mail, form answers, comments and task texts. A CRM has to keep them, but they are stored only encrypted (AES-256-GCM), next to a hash for search and a partly masked phone for lists. Only team members allowed to work in that project see them in full.

Website forms: when a business connects its website to the platform, a request from the site (name, phone, e-mail, the form's other fields, the page address and ad tags) is delivered to the business's CRM. In capiCRM it is written as a lead — encrypted in the same way. On its way to Bitrix24 or amoCRM it is treated like lead form answers: kept encrypted only for retries and deleted after 7 days; the ad tags and Meta cookies (no name or phone) stay for reporting.

"Connect with Facebook" (Facebook Login for Business): the business's representative picks the business portfolio, the ad accounts and the Pages in Meta's own window. The platform receives from Meta only an access key limited to those chosen assets, the list of permissions granted and the identifiers of the chosen assets. The Facebook password, the personal profile, the friends list and messages are neither given to the platform nor asked for.

Call reviews (capiVoice, when a business connects its telephony): from the business's PBX (OnlinePBX) the platform takes the list of its calls with customers — the time, the length, the direction, the operator's extension and the customer's number — and, for a call that is reviewed, its recording. The list is taken from the moment the reviews are switched on — or, if the person switching them on asks, from a day up to 14 days earlier: the calls before the switching on are not reviewed by themselves. The calls are recorded by the business's own telephony, not by the platform. The customer's number is kept only as a SHA-256 hash and a partly masked number. The recording itself is not stored on the platform: it is fetched from the PBX when the call is reviewed and again each time someone on the business's team plays it. What was said in the call — its transcript, the summary and the comments on the operator's work — is stored only encrypted (AES-256-GCM); the scores are stored as numbers. Beside the scores the review leaves fixed codes, unencrypted and never in anyone's own words: what the recording turned out to be, how the conversation ended, three marks (a hot lead, a customer who may leave, a call a person should hear) and — for a lost conversation, only where the customer said why — one of eight reasons (price, timing, distance, a competitor, the terms, no longer needed, not a prospect, another reason). Operators appear by their extension and by the name the business gives it. The keys of the PBX and of the business's Gemini account are stored encrypted, like every connection key. A business may have only part of its calls reviewed as they end — the longer ones, and only within a daily budget or the daily minutes it sets — and the others only when someone on its team who may change the project asks for them, on the calls' pages or under an answer to a question about the calls. Until then the platform keeps of such a call only what the call list gives: its recording is not fetched for a review and neither it nor a transcript of it goes to Google, though the team can play it from the PBX like any other call.

Why the data is used

For reports that show which ads bring qualified leads and sales.

To deliver Meta lead form submissions and the business's website requests to the business's CRM.

To send CRM outcomes (such as a qualified lead or a sale) to Meta through the Conversions API, so Meta optimises the ads for them. Only hashed identifiers (hashed phone and email), the Meta lead ID and Meta cookies are sent.

To create ad campaigns in Meta on the business's instructions. A campaign is created paused, and nothing is spent until a user separately switches it on.

For the ad copy assistant: the short brief a user writes and the business and form names are sent to Anthropic's Claude model. No personal data of leads is sent to it.

To send reports to the Telegram chat the business chose.

In capiCRM, for the business's team to work with customers: calls, tasks and comments, turning a lead into a deal.

For task reminders and problem alerts (a connection error, the number of leads not delivered and the like) in the Telegram chat the business chose. Problem alerts carry no customer's personal data.

The account data — including the name, e-mail address and identifier received from Google — is used only to create the account, to recognise the person when they sign in, to match an invitation sent to that address, to show who is in a team and who did what in it, and to name the team that is made for a person who is in none (for example, someone who signs up without an invitation). The name and e-mail are seen by the members of the teams the person belongs to; a team the person has left still sees the name beside what they did there (a campaign they created, an ad they switched on or off, a task still assigned to them). A team made for a person carries their name: its members see it, and so does anyone who opens an invitation link to that team, before joining. The name can also appear in capiCRM's task reminders in the Telegram chat the team connected. When Google sign-in is started from an invitation page or Google is connected from the account menu, the e-mail address is passed to Google so that its window offers the right account. Account data is not used for advertising, and the name, the e-mail address and Google's identifier are not passed to Meta, to an external CRM or to Anthropic.

For call reviews: to turn the recordings of a business's calls into text and to score its operators' work by the criteria the business set — for the business's own team: its head of sales and whoever it lets into the project. Where the project has a lead with the same phone number (matched by the hash), capiVoice shows that lead and the ad it came from: on the call's page, as the lead's title and CRM link in the lists of people still waiting for a call, and in the table of calls by ad — totals only there, without any number. From that table and from a call's page the calls list can be narrowed to one ad's callers: it then names the ad above the calls, each shown as in any list — by its partly masked number. The daily numbers a business sends to its Telegram chat are seen by everyone in that chat. The business's team — not those who may only view the project — can also ask capiVoice about the calls in words (the worst conversations of a day, why customers refuse, whether those who chose a form's answer meant it); Gemini answers from the calls' reviews and transcripts and links every call it names. To narrow the calls to the people who chose an answer in the business's lead forms, or whose lead reached a stage of its funnel (a quality lead, a sale, junk), the platform matches the lead and the call by the hash, on its own side. Where the project has the person's leads, capiVoice also says what the CRM knew of them before — new to it, come back to it of their own accord (they rang in, or left a new lead after a gap of more than 30 days), or known to it and only rung by the team — with how many leads it has of the number, the day of the first, the ad it came from and whether one was qualified or sold before: on the call's page, as a mark in the calls list and as counts of people in the statistics, from which, and from the list, the calls can be narrowed to the new, the returning or the known. It tells this from the CRM's records the platform holds — those changed since its history import began (30 days back when the CRM was connected; a business may import a year) — matched by the hash on the platform's side; nothing is written to the CRM.

Who the data is shared with

Meta Platforms, through the Marketing API and the Conversions API, within the accounts the business itself connected.

The CRM the business chose: Bitrix24 or amoCRM. With capiCRM the data stays on the platform itself.

Telegram: reports, new leads, task reminders and problem alerts in the chat the business connected. Where the business switched it on for a chat, also capiVoice's daily numbers under the project's name — counts (among them how many conversations were not reviewed) and an average score for the previous day's calls, how that average moved against the day before, and how many people are still waiting for a call at the time the message is sent — and how many more people's last conversation was not reviewed —: no operator's name or extension, no customer's number, nothing that was said.

Anthropic: only the short brief for the ad copy assistant described above.

Google, for call reviews: a reviewed call's recording, and then its transcript, are sent to Google's Gemini API with the business's own API key, to be turned into text and scored. They travel inside the request: the platform uploads no file to Google and opens no stored conversation there. Google handles them under the terms of the Gemini API for that key. When someone on the business's team asks capiVoice a question about its calls, the question and the conversation before it on the page are sent the same way, with the same key, together with what the platform finds to answer it: of the calls, their time, operator, length, scores, codes, reviews and transcripts, with every phone number written in digits replaced; of the leads, only the answers the business's own lead forms offer that at least five people chose, and how many people chose them; and of the person a call is with, what the CRM knew of them before — new, returning or known, how many leads it has of them, the day of the first, whether one was qualified or sold before, and from which day the platform holds the CRM's records. Never a customer's number, its hash or mask, a lead's title or a name from the CRM. Neither the question nor the answer is stored on the platform.

Infrastructure: Vercel (hosting) and Neon (database, Frankfurt, European Union).

Data is not sold. Nothing is given to anyone for advertising except the Conversions API events sent to the business's own Meta dataset, as described above.

How long data is kept

The copy of lead form answers, and of website requests bound for Bitrix24 or amoCRM: at most 7 days, encrypted, for delivery retries and for the preview in a form's settings.

Report data and hashes: while the project exists on the platform.

When a business disconnects Meta, the access key and the list of ad accounts and Pages are deleted at once.

capiCRM records (leads, deals, comments, tasks): while the business's project is on the platform; switching capiCRM off keeps them, and they come back when it is switched on again.

Password reset links: 24 hours, single use.

An access key given by "Connect with Facebook" that is not bound to a project goes stale after an hour and is deleted.

A user account (name, e-mail, the password's hash or Google's identifier of the account): until the account is deleted; being removed from a team does not delete it. A sign-in session ends by itself after 30 days without use, and its record is deleted within a day after that. A team named after the person it was made for keeps that name until the team is deleted or, on request, renamed.

A request left on capip.uz itself: until it is deleted from our CRM; we delete it when you ask.

Call reviews: a call's transcript and the review's texts are kept for the term the business set — 180 days unless it chose another, from 30 days to 3 years — and are then erased; the scores, the codes beside them, the hash and the masked number stay while the project exists. Disconnecting the telephony deletes all of the project's calls from the platform at once, with their transcripts and scores. No recording is kept at all. Of the questions asked of capiVoice, the platform keeps only how many a project asked on each day and how many tokens their answers took — for 90 days, deleted at once when the telephony is disconnected. Of the reviews, it also keeps, per project and day, the tokens no call's record holds — attempts the model's service billed that failed afterwards, and calls judged again by hand — and the seconds of recordings those attempts heard: numbers only, for 90 days, deleted at once when the telephony is disconnected.

Deleting data

If you filled in a lead form in a business's ad, that business owns your data: send your deletion request to it.

A business can disconnect Meta itself at any time under "Connections": the access key and the list of ad accounts and Pages are then deleted at once. Revoking the access key in Meta Business settings stops it working at once; the copy stored on the platform and the lists are deleted by disconnecting under "Connections".

A business connected with "Connect with Facebook" can also remove the app on Meta's side: Meta Business settings → Integrations → Connected apps. The access key stops working at once; its copy on the platform is deleted by disconnecting under "Connections".

If you signed in with Google, you can cut the connection yourself at any time on your Google account's linked apps page (myaccount.google.com/linkedapps). The platform holds no Google access key, so nothing remains on its side to revoke; your account on the platform, with its name, e-mail and Google's identifier, stays until it is deleted.

If you left a request on capip.uz itself, the owner of that data is CAPI Platform: ask us through any of the contacts on the site, and the request is deleted from our CRM. What you wrote to the support bot is not kept on the platform; your chat with the bot you can delete in Telegram yourself.

If you spoke by phone with a business that reviews its calls on the platform, that business owns the recording and what the platform keeps of the call: send your request to it. The business can erase a customer's calls from the page of any one of them — all of that customer's calls together: their transcripts, reviews, scores with the codes beside them and the customer's number — or all of its calls at once by disconnecting its telephony in capiVoice's settings. The recordings themselves are in its own PBX.

You can also write to us at the address below: requests to delete personal data, a user account (with its name, e-mail and Google's identifier) or a business's whole project are carried out within 30 days.

Security

All connections use HTTPS. Access keys are stored encrypted; customers' phone numbers and e-mails as hashes (in capiCRM, and in the copy kept up to 7 days for delivery retries — encrypted). An account's name and e-mail are stored as they are, so the person's team can see them; a password only as a hash.

Each project's data is visible only to team members with access to that project. The organization's owner sees all of its projects; the others, admins included, can be given only the ones they need.

Contact

For questions and data deletion requests, write to: capiplatform@gmail.com