Privacy Policy

Effective: 15 May 2026 Last updated: 5 November 2026

The short version

We don't collect data about the people solving CAPTCHAs. No IP, no User-Agent, no fingerprint, no behavioral telemetry. This is architectural, not a policy promise.

For customers (people who sign up to embed our widget), we hold the minimum we need: your email, your site key configurations, audit logs of your own actions, a billing pointer to Stripe, the date of your first server-verified session, a 1–5 setup rating if you give one, your answer if we ask how you would feel without Caputchin, your answers to our optional sign-up questions, counts of what you set up in your first three days, a referral code if you are on a paid plan, and your answer if you tell us why you cancelled.

Who we are

Caputchin is operated by Praxa Lab, an Australian business (praxalab.com). Praxa Lab is the controller of personal data described below. "We", "us", and "our" in this policy mean Praxa Lab.

What we collect

From visitors solving CAPTCHAs

Nothing personally identifying. The widget protocol does not accept IP addresses, User-Agents, geolocation, fingerprints, behavioral telemetry, cross-site identifiers, or device IDs.

From customers

Field	Why
Email address	Sign-in, transactional email, account contact
Pseudonymous session handle	Server-minted identifier like "thoughtful-monkey-42", not your real name or any tracking ID
Site key configurations	The site keys you create
Audit logs of your management actions	Security and accountability for your own actions on your own account
Stripe customer reference	Alpha plans and above. We don't store card numbers; Stripe holds those.
First server-verified session date	Tells us whether new accounts finish setting up. Kept until you delete your account.
Satisfaction rating (1–5), if you give one	Tells us how setup went. We look only at the average. Kept until you delete your account.
Your answer to "How would you feel if you could no longer use Caputchin?" (optional)	If you use Caputchin on a paid plan, your own or one of a troop you belong to, the dashboard may ask you this, with three answers to pick from. We store your answer, or that you skipped, with the time and the paid account you were asked through. We ask at most once every 90 days. We use the answers to see whether customers would miss Caputchin. Our staff see only how many people gave each answer, never yours. Kept until you delete your account.
Your answers to our sign-up questions (optional)	Who your sites are for, how you heard about us (with any words you type under "Other") and what you are protecting, if you answer. We use them to see which customers each channel brings and what they set Caputchin up on. You can skip any of them. Kept until you delete your account.
Your first three days of use	Three days after you sign up, we count how many site keys you created, how many of them had a server-verified session (and how many such sessions), and how many people you added to your troops in those three days, and combine them into one score. We use it to see which channels bring customers who finish setting up. It holds counts only, nothing about your visitors. Kept until you delete your account.
Your referral link (paid plans)	The first time you open Settings on a paid plan, we create a random code and show it as a link you can share (`?ref=r-` and the code). It contains neither your account ID nor your email. When someone signs up through it, the code is recorded as the `ref` tag of their account (see "How you found us"), so we can see that your link brought them. We use it to see how many customers come from recommendations. Our staff can see how many sign-ups each link brought on your account page in our admin tools; elsewhere all referral links are counted as one group. There is no reward. You can replace the code at any time in Settings; later sign-ups with the old code are then no longer linked to you. Kept until you delete your account.
Your answer when you cancel (optional)	When you cancel a paid plan, we ask "What made you cancel?". You can leave it empty. We use your answer to see what to fix. If you tick the box that lets us email you once about it, we record that you agreed, the exact wording you agreed to and when; only then may we write to you, once, by hand. You can withdraw that at any time by replying to our email or writing to info@caputchin.com. Your answer is not sent to Stripe. Kept until you delete your account.
How you found us	The campaign tags on the link you arrived from (`ref`, `utm_source`, `utm_medium`, `utm_campaign`) and the caputchin.com page you came from, recorded once when your account is created. We use them to see which channels bring customers. We read them on our servers, from the link or from the page where you clicked "Sign in". Nothing is stored on your device for this.
Which Caputchin plugins have verified a site key, and when each first did	When one of our plugins (such as the Keycloak extension) verifies a token, it tells us its name. We note the date it first verified each site key, so we can see which plugins customers use. Nothing about your visitors is added. Deleted with the site key.

We do not collect your name, organization, phone number, geolocation, IP, or fingerprint, unless you type them into the optional "Other" answer or your answer when you cancel.

If you sign in via GitHub or Google OAuth, those providers share your OAuth subject and email; we store only the email.

From customers using hosted verification

Form submissions transit our infrastructure briefly on the way to your destination and are discarded after dispatch. We don't store them. The DPA governs this.

Operational error logs

When our service hits an unexpected, unhandled error, we record a technical error event so we can diagnose and fix it: the error type, message, and stack trace, the route path, and the build version. By construction these events cannot receive a visitor's IP, User-Agent, fingerprint, or request headers; they are not designed to capture request bodies or email addresses. They hold only what our own code emitted at the point of failure, are stored in the EU, and are deleted after 14 days.

Lawful basis

Customer account data, hosted-verification dispatch, billing: performance of a contract (GDPR Art. 6(1)(b)). Audit logs, operational error logs, how you found us, your referral link, your sign-up answers and which plugins have verified a site key: legitimate interest (Art. 6(1)(f)). First server-verified session date, satisfaction rating and your answer to how you would feel without Caputchin: legitimate interest (Art. 6(1)(f)) in improving the product. Your answer when you cancel: legitimate interest (Art. 6(1)(f)) in improving the product. The one follow-up email about that answer: your consent (Art. 6(1)(a)), which you can withdraw at any time. We don't rely on consent for any other processing.

Retention

Plan-dependent (typically 30 days Solo, 6 months Alpha, 1 year Troop, 2 years Apex). At expiry, data is hard-deleted. Apex plan downgrades trigger a 30-day data freeze before deletion. The first server-verified session date, the satisfaction rating, your answer to how you would feel without Caputchin, your sign-up answers, your referral link, your answer when you cancel and your follow-up consent are not session data: they are kept until you delete your account. The record of which plugins verified a site key is not session data either: it is kept until you delete that site key.

Subprocessors

Listed at /legal/subprocessors. State-bearing data sits in EU regions. We give 30 days advance notice on changes.

International transfers

State-bearing data (database, hosting, transactional email) stays in the EU under normal operation. Two cases involve non-EU infrastructure:

Payments via Stripe. Stripe is contracted via its Australian entity (Stripe Payments Australia Pty Ltd) and processes payment data on its global infrastructure regardless of contracting entity. We never receive or store card numbers; Stripe handles the full PCI surface. Email and billing-address fields shared with Stripe transit Stripe's network.
OAuth sign-in via GitHub or Google. User-initiated at sign-in. Users who prefer EU-only sign-in can use email magic-link instead.

Praxa Lab is an Australian entity, not established in the EU. We have not appointed an EU representative under GDPR Article 27. Article 27(2) exempts non-EU controllers whose processing of EU residents' data is occasional, does not include large-scale processing of special categories (Art. 9) or criminal-convictions data (Art. 10), and is unlikely to result in risk to rights; our current processing falls within that exemption. We will appoint a representative and publish their contact details on this page if our EU processing crosses the threshold. EU residents can exercise their GDPR rights directly via info@caputchin.com.

Your rights

You can access, correct, delete, or export your data. Most is self-service in the dashboard. For anything that isn't, write to info@caputchin.com; we respond within 30 days.

These rights are granted by GDPR (EU/EEA), UK GDPR, the revised Federal Act on Data Protection (Switzerland), the Australian Privacy Act + APPs, CCPA + CPRA and other US state laws, LGPD (Brazil), PIPEDA (Canada), Privacy Act 2020 (New Zealand), APPI (Japan), PDPA (Singapore), POPIA (South Africa), the Digital Personal Data Protection Act 2023 (India), NDPA 2023 (Nigeria), KVKK (Turkey), and the personal-data laws of the Middle East. Where a local right is stronger than what we describe, the local right applies.

You can also complain to your country's data-protection supervisory authority:

Region	Authority
Australia	Office of the Australian Information Commissioner (OAIC)
UK	Information Commissioner's Office (ICO)
Switzerland	Federal Data Protection and Information Commissioner (FDPIC)
California	California Privacy Protection Agency (CPPA)
Elsewhere	Your country's data-protection authority

Sale of personal information (California)

We do not sell personal information and do not share it for cross-context behavioral advertising. You can confirm this by writing to us.

Children's privacy

Caputchin is not directed at children. Customers operating child-directed sites have their own COPPA, GDPR Article 8, and UK Age Appropriate Design Code (Children's Code) obligations (see Terms §4).

Cookies and tracking

On your website (where our widget runs): the widget sets no cookies by default. If a site owner turns on persistent verification reuse, the widget sets one first-party cookie, __cptr. It holds only the clearance, carries no identifier and expires with the reuse window. The site owner discloses it in their own cookie policy.

On our website (caputchin.com): no cookies until you choose a language in the language menu. That choice is kept in one NEXT_LOCALE cookie so the site stays in your language. If you switch between light and dark mode, that choice is kept in your browser's local storage. No analytics, no marketing cookies.

On our dashboard (where you sign in to manage your account): one strictly-necessary opaque session cookie. Exempt from consent under the EU ePrivacy Directive. No analytics, no marketing cookies, no fingerprinting, no consent banner.