Capafy Privacy Policy

Version: v1.1
Effective Date: 8 August 2026
Operated by: CAPAFY PTE. LTD. (UEN: 202619379G), 60 PAYA LEBAR ROAD, #11-47, PAYA LEBAR SQUARE, SINGAPORE 409051

---

Table of Contents

1. Introduction
2. Who This Policy Applies To
3. Information We Collect
4. How We Use Your Information
5. Legal Bases for Processing
6. How We Share Your Information
7. International Data Transfers
8. Data Retention
9. Your Rights
10. Cookies and Tracking Technologies
11. Age Restriction
12. Account Security
13. Changes to This Policy
14. Contact Us

---

Section 1. Introduction

CAPAFY PTE. LTD. ("we," "us," or "our") operates the Capafy Platform at capafy.ai — a marketplace where Users discover and access AI Skills developed by independent Publishers. The Platform is accessible via web browser and command-line interface (CLI).

This Privacy Policy explains:

• What personal information we collect from you when you use the Capafy Platform;
• Why we collect it and what we do with it;
• With whom we share it;
• How long we keep it; and
• What rights you have and how to exercise them.

This Policy applies to all users of the Capafy Platform, including visitors, registered Users, and Publishers. By using the Platform, you acknowledge that you have read and understood this Policy.

This Policy does not govern how individual Publishers handle personal data within their Skills. Each Publisher is responsible for their own data practices, which they are required to disclose on their Skill listing page. We encourage you to review the data flow declaration on any Skill before purchasing.

---

Section 2. Who This Policy Applies To

Users are individuals who register for a Capafy account to browse, purchase, and use Skills. This Policy applies in full to you.

Publishers are individuals or entities who register to publish Skills on the Platform. This Policy applies to you as a User; additionally, when a Publisher processes User personal data through its Skill, its role may be that of an independent controller, processor, joint controller, or another regulated party depending on the processing and applicable Data Protection Laws, as further described in the Capafy Publisher Agreement and any applicable data-processing agreement.

Visitors are individuals who access capafy.ai without registering. We collect limited technical data from visitors; see Section 3.4.

---

Section 3. Information We Collect

We collect information in three ways: information you give us directly, information generated through your use of the Platform, and information we receive from third parties.

3.1 Account Information

When you register, you provide:

• Email address (used for login and communications);
• Display name and profile information you choose to add;
• Password credential (stored as a one-way hash — we cannot recover or view your password).

3.2 Publisher-Specific Information

If you register as a Publisher, we additionally collect:

• Identity verification documentation submitted during KYC review;
• Bank account details, SWIFT/BIC codes, and related payment routing information for settlement;
• Tax residency documentation and any withholding tax forms you submit;
• Your Skill files (including SKILL.md, scripts, references, and assets) submitted via the Publisher Skill for review and distribution.

3.3 Transaction and Financial Data

When you make or receive payments on the Platform, we collect:

• Purchase amounts, timestamps, and order identifiers;
• Payment method details processed through our payment processor (we do not store full card numbers);
• Refund and dispute records;
• For Publishers: settlement amounts, Platform Sandbox Fee deductions, and payout records.

3.4 Usage and Technical Data

When you use the Platform, we automatically collect:

• IP address and approximate geolocation derived from IP;
• Browser type, operating system, and device identifiers;
• Pages visited, features used, and navigation patterns;
• Skill invocation logs, session counts, and performance metrics.

3.5 AI Interaction Data

When you use a Skill in the Capafy Cloud Runtime, interaction content (your inputs and Skill outputs) may be processed by Capafy to host and execute the Skill and to route requests and responses through Capafy's proxy or relay infrastructure. Where a Skill uses an external LLM provider or other external service, relevant interaction content may be transmitted through that infrastructure to the provider or service selected by the Publisher, as disclosed on the Skill's listing page. The external provider or service processes that content under its own applicable terms and data policies.

We do not use your AI interaction content to train our own models.

3.6 AI Personal Profile

If you choose to create an AI Personal Profile (preferences and context used to personalize Skill behavior), that profile is stored in your account and is entirely under your control. You can modify or clear it at any time. See Section 9 for your self-service options.

3.7 Communications

If you contact us via support, we retain records of those communications for as long as necessary to resolve the matter and manage ongoing service quality.

---

Section 4. How We Use Your Information

We use your information for the following purposes:

We do not use your personal data to make automated decisions that have legal or similarly significant effects on you without providing a meaningful way to contest the outcome.

---

Section 5. Legal Bases for Processing

For users in jurisdictions requiring a legal basis for data processing (including the EU/EEA under GDPR):

Where we rely on legitimate interests, we have assessed that those interests do not override your rights and freedoms. You may object to processing based on legitimate interests; see Section 9.

---

Section 6. How We Share Your Information

We do not sell your personal data to third parties.

We share your information with the following categories of recipients, only as necessary for the purposes described in this Policy:

6.1 Service Providers

We engage third-party providers who process data on our behalf under data processing agreements that restrict their use of your data to delivering services to us. These include cloud infrastructure providers for hosting, storage and compute; payment processors for payment execution and KYC; and email and notification providers for transactional and account communications. A Skill may also use an external LLM provider or other external service selected by its Publisher. Capafy may route relevant interaction content to those services through Capafy's relay infrastructure, but the external LLM inference service is provided by the Publisher-selected provider and is not supplied or resold by Capafy. The applicable providers and services are disclosed on the Skill listing.

6.2 Publishers (Limited)

When you purchase and use a Skill, the Publisher of that Skill receives access to order summary information for its own Agents (order status, usage duration and dispute status). Capafy does not provide the email address associated with your Capafy account, separate dispute notifications, or your personal profile to a Publisher through the Publisher Console. If you choose to contact a Publisher directly using contact details displayed on a Skill listing, any information you provide directly to that Publisher is handled under that Publisher's applicable privacy terms.

Publishers do not have access to your purchases or activity on other Agents, your Capafy account email address, or your personal profile through the Publisher Console. A Publisher can only see the order information described above for its own Agents.

6.3 Legal and Regulatory Disclosure

We may disclose your information where required by law, court order, or lawful government request, or where we believe disclosure is necessary to prevent fraud, protect our legal rights, or protect the safety of users or the public. Where legally permitted, we will notify you of such disclosure.

6.4 Business Transfers

If we are involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will provide notice before your information is transferred and becomes subject to a different privacy policy.

6.5 What We Do Not Do

We do not:

• Sell your personal data to data brokers or advertisers;
• Use your AI interaction content to train AI models operated by Capafy. Whether a Publisher-selected external LLM provider may use submitted content for model training is disclosed on the relevant Skill listing and governed by that provider's applicable terms and data policies.

---

Section 7. International Data Transfers

We are headquartered in Singapore. Your personal data may be stored and processed in Singapore and in other countries where our service providers or the Publisher-selected external services disclosed on a relevant Skill listing operate, including countries outside your jurisdiction.

For users in the EU/EEA: where we transfer personal data outside the EU/EEA to countries not covered by an adequacy decision, we rely on Standard Contractual Clauses approved by the European Commission, or other appropriate safeguards under GDPR Chapter V.

For users in the UK: we rely on the UK International Data Transfer Agreement (IDTA) or equivalent UK-approved mechanisms.

You may request information about the specific safeguards applicable to your data transfer by contacting us at the address in Section 14.

---

Section 8. Data Retention

We retain your personal data for as long as necessary for the purposes for which it was collected, subject to the following:

Where applicable law requires us to retain data for a longer period than stated above, the legal requirement takes precedence. Where applicable law permits shorter retention and you exercise a deletion right, we will delete or anonymize data accordingly.

---

Section 9. Your Rights

Depending on your jurisdiction, you may have the following rights with respect to your personal data:

Access — request a copy of the personal data we hold about you.

Correction — request that we correct inaccurate or incomplete data.

Deletion — request that we delete your personal data, subject to our legal retention obligations described in Section 8.

Data portability — request your data in a structured, machine-readable format where technically feasible and legally required.

Restriction of processing — request that we limit how we use your data in certain circumstances.

Objection — object to processing based on our legitimate interests. We will assess whether our interests override your rights and respond accordingly.

Withdraw consent — where we rely on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

Complaint — lodge a complaint with your local data protection authority. For EU/EEA users, this is the supervisory authority in your EU member state. For UK users, this is the Information Commissioner's Office (ICO). For Singapore users, the Personal Data Protection Commission (PDPC).

Self-Service Options

You can exercise the following rights directly in your account at any time, without contacting us:

• Modify or clear your AI Personal Profile;
• Edit or delete reviews and ratings you have published;
• Delete active Skill instances that are in standby (instances tied to active orders cannot be deleted while the order is in progress);
• Create, view, and revoke Access Tokens in your account console.

Account deletion: You may delete your account through the account settings page. Once a deletion request is processed, data subject to legal retention obligations (see Section 8) is retained for the applicable period; all other personal data is deleted within 30 days.

To exercise rights that are not available through self-service, contact us at the address in Section 14. We will respond within the timeframe required by applicable law. For GDPR purposes, we aim to respond within 30 calendar days, extendable to 90 days for complex requests with prior notice to you.

---

Section 10. Cookies and Tracking Technologies

We use the following categories of cookies and similar technologies:

Strictly necessary cookies — maintain your login session, security settings, and language preferences. These cannot be disabled without impairing your ability to use the Platform.

Analytics cookies — help us understand how the Platform is used, identify performance issues, and prioritize improvements. These are processed on an aggregated basis. You may opt out through your browser settings or a cookie preference center where provided.

We do not use cookies or tracking pixels to build advertising profiles or to share your browsing behavior with advertising networks.

If we introduce new categories of cookies in the future, we will update this Policy and, where required by applicable law, seek your consent.

---

Section 11. Age Restriction

The Capafy Platform is intended for users who have reached the age of majority in their jurisdiction. We do not knowingly collect personal data from individuals below the applicable age of majority.

If we become aware that an account is held by someone who has not reached the applicable age of majority, we will terminate the account and delete the associated personal data, subject to any retention required by applicable law (such as transaction records that must be retained for tax or anti-fraud purposes).

---

Section 12. Account Security

We implement technical and organizational measures appropriate to the risk level of the data we process, including encryption in transit and at rest, access controls, and regular security reviews. Internal access to raw User data is restricted: our staff require dual approval before accessing User interaction data, and such access is limited to dispute resolution and audit scenarios.

Your account is accessed via email-based authentication. You are responsible for keeping your login credentials secure and for all activity that occurs under your account. Each account supports multiple API Access Tokens, which you can create, view, and revoke at any time through your account console. We recommend revoking tokens you no longer use.

If you suspect unauthorized access to your account, contact us immediately at [email protected].

---

Section 13. Changes to This Policy

We may update this Policy from time to time. When we do, we will post the updated Policy at https://capafy.ai/privacy-policy and update the "Effective Date" above. Your continued use of the Platform after an update takes effect constitutes acceptance of the updated Policy. If you do not accept an update, you may close your account.

---

Section 14. Contact Us

Mailing address: CAPAFY PTE. LTD., 60 PAYA LEBAR ROAD, #11-47, PAYA LEBAR SQUARE, SINGAPORE 409051

We will acknowledge receipt of your request and respond within the timeframe required by applicable law.

---

This Privacy Policy is issued by CAPAFY PTE. LTD., incorporated in Singapore.
Registered address: 60 PAYA LEBAR ROAD, #11-47, PAYA LEBAR SQUARE, SINGAPORE 409051
English is the sole authoritative language of this Policy. Any translation is provided for reference only.