Privacy Policy

Last updated: 17 October 2026

This policy explains how 3DOMCommerce OÜ ("Capabl", "we", "us") handles personal data when you visit www.capablhq.com (the "website") and when you or your company use the Capabl platform (the "platform"). One policy covers both.

1. Who we are

Capabl builds software that audits retail product pages and generates content that makes them visible in AI and traditional search. The data controller is 3DOMCommerce OÜ (registry code 17011396), Järvevana tee 9, 11314 Tallinn, Estonia. You can reach us about privacy at info@capablhq.com.

2. Data we process on the website

• Audit requests. When you request an audit, we receive your email address, your website, and optionally your LinkedIn profile and a description of your challenge. We use them to reply to you and prepare the audit. Legal basis: steps taken at your request before a contract, and our legitimate interest in answering business enquiries.
• Analytics. We measure website usage with PostHog, hosted in the EU, in a cookieless mode: no cookies or browser storage are set and session recording is off. We see aggregated page views and clicks. Legal basis: our legitimate interest in improving the website.
• Server logs. Our hosting provider records technical data such as IP address, browser type and the pages requested, to deliver and secure the website.

3. Data we process on the platform

• Account data: name, work email and sign-in details of the people who use Capabl on behalf of a brand.
• Brand data: product catalogues, product page content and the content Capabl generates for you. This is business data; it contains personal data only where your content does.
• Connected-channel data: data from services you choose to connect, such as Google Merchant Center (see section 4).

We process platform data to provide the service under our contract with your company, and to secure and support it.

4. Google user data

If you connect a Google Merchant Center account, you sign in with Google and grant Capabl the https://www.googleapis.com/auth/content scope. Capabl never asks for your Google password.

What we access and why

• Read: the Merchant Center account you connect and the products in it (titles, descriptions, attributes, prices, availability, images and their status), so we can audit how your catalogue appears on Google surfaces.
• Write: product data you review and approve in Capabl, such as improved titles, descriptions and attributes, which we submit to your Merchant Center account on your instruction.

We use Google data only to provide these features to you. We do not use it for advertising, we do not sell it, and we do not share it with anyone other than the service providers listed in section 5 that help us run Capabl.

Storage and security

The OAuth tokens Google issues are stored encrypted and are used only by our servers to call the Merchant Center API on your behalf. Data is encrypted in transit.

Revoking access

You can disconnect Google Merchant Center in Capabl at any time, or revoke Capabl's access from your Google Account at myaccount.google.com/permissions. When access is revoked or the connection is removed, we delete the stored tokens and the product data we received from Google Merchant Center.

Limited Use

Capabl's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

5. Service providers

We share personal data only with providers that process it for us under contract:

• Amazon Web Services — website hosting, infrastructure and email (Amazon SES)
• Supabase — platform database, authentication and storage
• PostHog (EU) — cookieless website analytics
• Anthropic (Claude Haiku) — AI model that generates content from brand data

Where a provider processes data outside the European Economic Area, we rely on appropriate safeguards such as the EU Standard Contractual Clauses.

6. Retention

• Audit requests: 12 months after our last contact with you.
• Platform account and brand data: for as long as your company's account is active, then deleted within 30 days after closure.
• Google OAuth tokens and Merchant Center product data: until you disconnect or revoke access, then deleted immediately.

7. Your rights

Depending on where you live, you may have the right to access, correct, delete or export your personal data, to object to or restrict its processing, and to withdraw consent. To exercise them, email info@capablhq.com. You can also complain to a data protection authority. Our lead authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee); in the United Kingdom you can contact the Information Commissioner's Office, and elsewhere in the EU your local authority. We reply within one month.

8. Changes

We will post any change to this policy on this page and update the date above. If a change is significant, we will tell platform users before it applies.

9. Contact

3DOMCommerce OÜ, Järvevana tee 9, 11314 Tallinn, Estonia — info@capablhq.com