Privacy Policy
Last updated 6 November 2026
This Privacy Policy explains how CapiMail handles personal data. It covers two roles: data about our customers (the people who run a workspace) and recipient data that customers process through CapiMail to send their own email.
Customer data we collect
- Account and organization details you provide (name, email, company, website, sending use case).
- Authentication and security data needed to operate your workspace.
- Billing and credit-ledger records for purchases and usage.
- Operational logs used to run, secure, and support the service.
Recipient data you process
When you import contacts and send email, CapiMail processes recipient data on your behalf as a processor. Contact records can include readable email addresses, names, custom fields, and consent evidence. Delivery payloads contain recipient addresses and message content needed to send email. Hashed addresses are also used for suppression and matching; this does not mean all recipient data is stored only as hashes. You remain the controller of your recipient data.
Data from connected platforms (Meta and WhatsApp)
When WhatsApp messaging is enabled for your workspace and you connect your own Meta WhatsApp Business Account through Meta's signup flow, CapiMail receives and stores the data needed to send messages on your behalf: your WhatsApp Business Account ID, phone number IDs and display numbers, message template names and approval status, and message delivery statuses (sent, delivered, read, failed). We process message content and recipient phone numbers only to deliver the messages you send. We use this data solely to provide the service to you, we do not sell it, and we do not use it for our own advertising. Messages are delivered directly through Meta's WhatsApp Cloud API, and Meta's own terms and privacy policy apply to the WhatsApp platform. The access token Meta issues for your account is stored encrypted and used only to send and manage messages for your workspace. You can disconnect the account at any time; see our Data Deletion instructions.
How we use data
- To provide and secure the service, deliver email, and enforce consent, suppression, and sending limits.
- To monitor deliverability and protect the shared sending reputation.
- To bill accurately and maintain an auditable credit ledger.
- We do not sell personal data, and we do not use your recipient lists for our own marketing.
Subprocessors
We use a small set of infrastructure and delivery subprocessors by category: an authentication and database provider, an email delivery provider, an application and worker hosting provider, and a payment processor (used only when you purchase credits). The named list of subprocessors and the regions applicable to your workspace is available on request. Contact support for these details before sending data with residency restrictions.
Retention and your choices
- Delivery payloads are eligible for scheduled deletion after the workspace retention window (30 days by default, configurable from 1 to 90 days). This cleanup applies to delivery payloads, not every copy of data in contacts, saved templates, or campaign content.
- Provider event logs have a separate retention window, 90 days by default. Contact records, saved templates, campaign content, consent history, suppression records, and billing records have separate operational and audit purposes; delivery-payload cleanup does not delete them.
- Contact support to request access, correction, export, or deletion of your data. Requests require identity and workspace authorization checks. Some records may need to be retained for legal obligations, billing reconciliation, security, or suppression enforcement.
Who we are and how to contact us
CapiMail is operated by PT Nderek Gusti Adil Karya, Kana Park Kano F7 No 28, Desa/Kelurahan Babat, Kec. Legok, Kab. Tangerang, Provinsi Banten 15820, Indonesia. For privacy questions or data requests, contact us at support@capimail.com or +62 815 2423 5787. To ask us to delete data, follow our Data Deletion instructions.