Privacy Policy

1. Information We Collect

CapituAI collects the following information when you use our service:

• Account Information: Name, email, and profile picture via Sign in with Google
• Usage Data: YouTube video URLs you submit for transcription
• Generated Content: Transcriptions and chapters generated from your videos
• Google OAuth Tokens: We store your Google access token and refresh token securely on our servers so we can list your channel's videos and fetch video metadata on your behalf without asking you to sign in repeatedly. These tokens grant read-only access (youtube.readonly) and are deleted when you revoke access or delete your account.
• Payment Data: Email, amount and, where applicable, CPF. Card data is collected and tokenized directly by Mercado Pago — we never receive or store card numbers or CVV.
• Usage Analytics: Product usage events (pages visited, features used) collected via PostHog on the capituai.cc website to help us improve the service. The browser extension carries no analytics — see section 4.
• Browser Extension Data: The IDs of the YouTube videos whose pages you open with the extension installed, so we can check whether chapters already exist for them. Everything else the extension handles stays on your device — see section 4.

2. How We Use Your Information

We use your information to:

• Process and transcribe YouTube videos
• List videos from your own YouTube channel so you can pick one to transcribe
• Automatically generate chapters using AI
• Manage your credit balance
• Improve our services

3. YouTube Access

When you log in with Google, we request read-only access to your YouTube data only to:

• Identify your YouTube channel
• Fetch public information about videos you submit

CapituAI uses YouTube API Services. By using CapituAI you also agree to the YouTube Terms of Service. In addition to our privacy practices described here, Google's handling of your data is described in the Google Privacy Policy.

4. Browser Extension

The CapituAI browser extension (Chrome, Brave and Edge, Manifest V3) is covered by this same Privacy Policy. It adds a chapters panel to YouTube video pages and a popup listing your recent videos and your credit balance.

What it keeps in your browser. The following is stored locally by the extension (chrome.storage.local, on your own device) and is never sent to our servers:

• Extension session: so you don't have to sign in again every time you use it
• Video title cache: titles of YouTube videos, fetched from YouTube's public oEmbed endpoint, used to make the popup list readable
• Language: the language you selected on the website
• Panel state: whether the panel is collapsed or expanded
• Extension state: whether you disconnected the extension, the reason for the last failed connection attempt, and the last processing stage seen for each video, so we notify you only once when chapters are ready

How your account is connected. A content script running on capituai.cc reads the session of a user who is already signed in on the website and exchanges it, through our own backend, for a separate extension session. The point is to spare you a second sign-in. No token is sent to any third party — only to CapituAI's own backend.

What is sent while you browse. When you open a YouTube video page while the panel is expanded, the extension sends our backend the ID of that video to check whether chapters already exist and display them. That means the videos you watch with the panel open become known to our server. With the panel collapsed, no request is made — not for the video, not for your credit balance. No page content is read or transmitted beyond the video ID that is already in the URL.

The extension does not:

• Record clicks, scrolling, typing, or your browsing outside YouTube video pages
• Read the content of the pages you visit
• Contact any server other than our Supabase, capituai.cc and YouTube itself (for the video's public title and thumbnail)

5. Data Sharing

We do not sell, rent, or share your personal information with third parties, except:

• Service Providers: Supabase (database and authentication), Modal.com (processing), OpenAI (AI transcription), Resend (transactional email delivery), Mercado Pago (payment processing), PostHog (product analytics)
• Legal Requirements: If required by law

6. Payment Processing (Mercado Pago)

Payments are processed by Mercado Pago, which acts as processor/controller of payment data. We share with Mercado Pago only the data needed to process the charge (e.g., email, amount, CPF when required). Card data is handled and tokenized directly by Mercado Pago — we never receive or store card numbers or CVV. The processing of this data is also subject to the Mercado Pago Privacy Policy.

7. Legal Bases (LGPD)

We process personal data in accordance with the Brazilian General Data Protection Law (LGPD — Law No. 13,709/2018), on the following legal bases (art. 7):

• Performance of a contract: creating your account, processing purchases and providing the service
• Legal/regulatory obligation: tax records and fraud prevention
• Legitimate interest: security, service improvement and support

8. Security

We implement security measures to protect your information:

• Secure OAuth authentication
• Data encryption in transit (HTTPS/TLS)
• Access control policies (Row Level Security)

9. Your Rights

You have the right to:

• Access your personal information
• Request correction of incorrect data
• Request deletion of your account and data
• Revoke YouTube access at any time

You can revoke CapituAI's access to your Google/YouTube data at any time via the Google security settings page. Upon revocation we delete your stored Google tokens and YouTube API data within 30 calendar days; upon your deletion request, within 7 calendar days.

10. Data Retention

We retain your information while your account is active. Upon account deletion, all your data will be permanently removed within 30 days.

Payment and transaction records may be retained for the period required by legal and tax obligations (approximately 5 years), after which they are deleted or anonymized.

Data obtained from YouTube API Services (such as video and channel metadata) is refreshed or deleted at least every 30 calendar days, in accordance with the YouTube API Services Developer Policies.

11. Cookies and Similar Technologies

We use essential cookies to maintain your login session. We also use PostHog, a product analytics tool, to understand how the service is used (pages visited, features used) and improve it. We do not use advertising cookies and we do not sell this data.

12. Changes to This Policy

We may update this policy periodically. We will notify you of significant changes by email or through a notice in the service.

13. Google API Services Compliance

14. Contact