Privacy policy

In one line: we keep what the app needs to run your event, a small security record of who changed what and from where, and nothing at all of your photos, videos or voice notes. Everything below says exactly what that means.

What we collect

Your account. Your name, email address and profile photo where you sign in with Google, the plan you are on, and your Studio credit balance and its ledger.

Your event.Everything you type into it — the title, date, place, the words on your invitation and thank-you cards, your plan, budget lines, return gifts, run sheet and website. Your guest list is yours: the names and contact details you enter, each guest's reply, plus-ones, dietary notes and the link token that opens their invitation.

About the media, not the media. File names, sizes, types, capture times, approval status, captions, optional transcripts and compact numeric waveform data for voice notes — never the files themselves (see below).

Technical and security details. When you sign in or change something, we record the time, your account, what changed, the kind of device and browser (for example “iPhone · Safari”), and the country your network reports. We do not store your IP address: it is turned into a one-way code, and we keep only the network block (for example 203.0.113.0) so a sudden change of network still stands out. Your live IP address is used in memory to stop abuse and rate-limit requests, and is not written down with it. We never ask your browser or phone for your location, and we never collect GPS coordinates.

Product analytics. Privacy-conscious events (for example “event created”, “render completed”) that never include file names, captions, transcripts, event names or drive identifiers.

Messages you send us.Support messages, “something's unclear” notes and the page you sent them from, so we can answer and fix what confused you.

Payments. Our payment providers (Stripe and Paddle) take your card details directly and handle them under their own terms. We never see or store card numbers — only what you bought, when, the amount, and a receipt reference.

Cookies

The cookies that keep you signed in and keep the site secure are always on — the site cannot work without them. Analytics cookies (Google Analytics) load only if you accept them in the banner, and you can change your mind at any time. If you arrive through a creator's link or a campaign link, a small cookie remembers which one for up to 90 days so the right creator is credited.

Our record of what happened

We keep a record of changes and of requests made to AI, so that a host can see the history of their own event and so we can answer questions about cost, faults and misuse. An AI entry holds who asked, from which part of the app, which model answered, how long it took, how many credits it cost, whether it worked, and at most the first 300 characters of the words you typed into that feature — never your photos, videos, voice notes or your guests' contact details. A change entry holds who changed what, from what to what, and the device details described above. These records are kept for 180 days and then deleted automatically. Inside Capsemble only a small number of administrators can read them, and their reading of them is itself recorded.

What we never collect

Your photo, video and audio files. They are stored on your device or transferred directly from the contributor's browser to the event host's connected cloud drive. Capsemble servers do not receive, buffer or retain media bytes, thumbnails or base64 copies. The one exception is content you ask the Studio to generate (see “AI assistance” below): the finished picture, clip or soundtrack passes through our servers in memory on its way to your browser and is not stored.

Cloud storage providers

When a host connects Google Drive, we request the narrowest practical scope: access to files Capsemble creates, not the whole drive. OAuth refresh credentials are encrypted with a managed key service before being stored and are never exposed to browser code. Files stored in a host's drive are processed by Google under Google's own terms.

Google user data.Capsemble's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically: we request the drive.filescope only; we use it solely to create the event folder and to read and write files inside it on the host's and their guests' behalf; we store file references (id, name, size, type, contributor, approval status) and never the file contents; we do not transfer Google user data to third parties except as needed to provide the service (Google itself), for security, or as required by law; we do not use it for advertising; and no human at Capsemble reads it except with the host's explicit permission for support, or as required for security or legal compliance. You can revoke access at any time in Capsemble Settings or at myaccount.google.com/permissions.

AI assistance

Media analysis (blur detection, duplicate grouping, transcription) runs in your browser. A remote text model may receive only non-sensitive, user-approved text such as captions or transcripts — never media bytes — and only where AI features are enabled.

Nobody trains on your event. Nothing you type, upload or generate is used to train anyone else’s AI model, ours included. We only use partners whose terms say customer data is not used for training, and we route Google requests through Vertex AI (Google Cloud) rather than the free Gemini API, which does train on what it receives. Where a partner offers a “don’t keep this” setting we send it. A partner that trains on what it is sent cannot be switched on at all — the app refuses it.

What we do learn from. We learn from the shape of events — what tasks an occasion needs, how long each takes, what depends on what, which stage an event is at — so Capsemble gets better at planning the next one. That is structure and timing only. Your photos, videos, voice notes, captions, guest lists and contact details are never part of it, and nothing that identifies you or your guests leaves your event.

Generated content.Hosts can ask Capsemble Studio to create artwork, short video clips and soundtracks from a written description. What is sent to the AI partner is the words the host types (with our own framing added, such as “no text, space for a message”) and the event title — never your photos, videos, voice notes or guest details. Partners currently include Google (Vertex AI), Kling and OpenAI; which one handles a request depends on what is being made. They process those words under their own terms; we choose settings that do not use them to train models, and some partners may keep prompts briefly for abuse monitoring. Google requests run on Vertex AI, where the Cloud terms say customer data is not used to train Google’s models. The result is returned to the host's browser and, if they choose to keep it, saved into their own event folder — it belongs to them and Capsemble keeps only a file reference. Before first use a host accepts a short notice saying exactly this, and we record that acceptance.

An event song.A host can have a song written and sung from the words left at their event. The host chooses line by line which written captions, approved voice-note transcripts and lines of their own are included, and sees the exact text before anything is sent. Only that text and a style note go to the partner (Google) — never the recordings, photos, guest names or anything else about the event. The sung lyrics are kept with the host's song so they can read them back. If a future feature ever needs to send a specific photo, clip or recording to a partner (for example to animate it), it will ask for separate, item-by-item permission first.

Keeping the platform safe

To stop Capsemble and its AI being used for serious harm — weapons, drugs, exploitation, fraud, violence, or finding and tracking a person — we automatically check the words sent to our AI features, the answers they give, event titles and descriptions, and messages sent through Capsemble. Most checks find nothing and keep nothing. When something matches, we keep a short record (who, which event, which check, and at most the first 300 characters of the words), our team reviews it, and a clear request for serious harm is declined. We may pause AI features or suspend an account while we look. These records are kept for up to two years, or longer where a review confirms a problem and the law requires it. Photos, videos and voice notes are never part of these checks.

Capsemble is for people 16 and older. We don't collect dates of birth: you confirm your age once when you create an account, and joining an event as a contributor carries the same confirmation. Only the confirmation and its date are stored. If we learn an account belongs to someone under 16, we close it and delete its records.

Law enforcement and regulators

We may disclose personal information to law enforcement agencies, regulatory authorities, courts or other government bodies where we are required or permitted by law to do so — for example, to comply with a warrant, subpoena, court order or other valid legal request; where we reasonably believe it is necessary to prevent or lessen a serious threat to someone's life, health or safety, or to report suspected child exploitation; to assist with the investigation of suspected unlawful activity; or to establish, exercise or defend legal claims. We check that a request is lawful and disclose only what it requires. We can only disclose what we hold — account details, event records and our security record — not photos, videos or voice notes, which stay in the host's or guest's own storage. Where the law allows it, we will tell the person concerned before or after we disclose.

Retention and deletion

Events expire per the host's retention setting. Deleting an event removes Capsemble records; the host separately chooses whether app-created files in their drive are removed. Contributors may remove their own eligible contributions before an event is locked. Our records of AI requests and of changes are kept for 180 days. Daily totals with no personal detail (how many requests, how many credits) are kept for as long as we need them for accounting. Deletion, export and administrator actions are recorded in a restricted log, and that log is kept for as long as the law requires us to be able to show what happened.

Your rights

You may request access to or deletion of your account data at any time by emailing support@capsemble.com. That includes a copy of what our records hold about you. Because media never rests with us, media deletion is under your or your host's direct control in your own storage. If you are in Australia and are unhappy with how we handle a request, you can take it to the Office of the Australian Information Commissioner.