Privacy Notice

Effective date: October 18, 2026 · Last updated: October 23, 2026 · Version 1.1 · Previous versions: Version 1.0 (effective October 16, 2026)

Revision note, October 18, 2026: §2.10, §3, §7 and §10 updated the same day to describe consent handling for website analytics.

This notice explains how RECAPTURED, LLC, a Delaware limited liability company (“ReCaptured,” “we,” “us”) handles personal information when you use the ReCaptured platform. That includes the web app at app.recaptured.io, our mobile and desktop apps, our APIs, and our MCP server (together, the “Service”). If you visit recaptured.io or contact us before you have an account, see Section 2.10.

1. Two roles: whose data is it?

ReCaptured is sold to businesses (“Customers”). Each Customer has its own workspace (an “organization”). How we handle your information depends on which role we are in:

• We act on the Customer’s behalf for Customer Data. Customer Data is everything a Customer and its users put into or connect to the Service: records, files, messages, meetings and transcripts, field audio, forms, signatures, and data from connected tools. The Customer decides how that data is used and is the “controller” (or “business”). We are its “processor” (or “service provider”), and we use Customer Data only to provide the Service under our agreement with the Customer. If your information is in a Customer’s workspace (for example, you are their employee, client, subcontractor, meeting guest, or someone who submitted their web form), the Customer’s own privacy notice applies. Send requests about that information to the Customer. We will help them answer.
• We decide for account and service data. We are the controller for the information described in Section 2: who you are as a user, how you sign in, how the Service is used, and how we communicate with you. This notice covers that information.

2. Information we collect as controller

2.1 Account information

• Your name and email address.
• The organizations you belong to, and your role and seat type in each.
• Who invited you, and when your account was created or last used.

2.2 Sign-in and security information

• Password. If you set one, we store only a one-way hash; we never store your password itself.
• Single sign-on. If you sign in with Google or Microsoft, we receive your account identifier, email address, whether that email is verified, and your name. We do not receive your Google or Microsoft password.
• Multi-factor authentication. This is required for every user. We store your authenticator or passkey details. For passkeys that means a public key and device metadata; we never receive your biometric data, which stays on your device. Authenticator secrets are encrypted.
• Sessions. For each signed-in session we keep your IP address, browser user agent, device type, sign-in method, and when you were last active. Sessions expire after at most 30 days.
• Security and audit logs. These record sign-ins, sign-in failures, permission changes, and other security-relevant actions, with IP address and user agent. We keep them to protect the Service and to meet our security and audit obligations.

2.3 Product usage analytics

We measure how the Service is used so we can improve it. We built this ourselves; no third-party analytics or advertising company receives it.

• What we collect: which screens and features are used (for example, “the Tasks board was opened”), counts, durations, error types, and coarse device information (device class, browser and operating-system family, language, time-zone offset, and country at the organization level).
• What we never collect in analytics: web addresses or search terms; record contents, names, emails or anything you type; IP addresses or full user agents.
• How events are linked to you: by a pseudonymous key derived from your user ID. The same key is used if you belong to more than one organization, so we can measure usage of the Service as a whole without knowing who you are.
• How it is reported: breakdowns covering fewer than five people are suppressed.
• Your choice: you can turn analytics off at any time under Account → Privacy → Share product usage analytics. Turning it off stops collection and deletes the raw events we already hold about you.
• Not included: sessions where ReCaptured staff are acting in an account for support.

2.4 Error reports

When the app crashes, it sends a technical report so we can fix the problem. The report contains only the error type and the location in our own code. It contains no message text, web address, user agent, or account or organization identifier. Error reports respect the analytics setting in Section 2.3.

2.5 Billing information

Billing is set up at the organization level. Payments are processed by Stripe, and we do not receive full card numbers. We keep invoices and billing records as the law requires.

2.6 Approximate location for the weather widget

If your organization uses the weather widget, we work out an approximate location (city level) from your IP address, or from a location you enter. To do this we send the IP address or location to the geolocation and weather providers we use; the list is available on request at privacy@recaptured.io.

2.7 Information from connected tools

If you connect Google Workspace, Microsoft 365, Slack or another tool, the Service accesses that tool’s data only within the permissions you grant, to provide the feature you turned on (for example, syncing files or calendar events). That data becomes Customer Data (Section 1). You can disconnect a tool at any time.

Google user data. ReCaptured’s use and transfer of information received from Google APIs complies with the Google API Services User Data Policy, including its Limited Use requirements. We do not use Google user data for advertising, we do not sell it, and we do not use it to train generalized AI models.

2.8 When you contact us

If you email us or ask for support, we keep the message and our reply.

2.9 Information stored on your device

See Section 7 for cookies and similar storage.

2.10 If you visit recaptured.io or contact us before you have an account

• Contact information you provide (name, email address, phone number, company and role) when you contact us, book a call or sign up.
• Communications between you and ReCaptured, including emails, text messages, and, where consent has been obtained, call recordings and transcripts.

We do not buy personal information from data brokers.

Text messaging and mobile information. If you provide your mobile number and opt in to receive text messages from ReCaptured, we use it to send the messages described in our SMS Terms — conversational replies, scheduling and follow-up messages, and service updates related to your relationship with us.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties, excluding the service providers and aggregators that deliver messages on our behalf. Sharing with subcontractors in support services, such as customer service, is permitted.

You can withdraw consent to text messaging at any time by replying STOP to any message from us. Reply HELP for assistance, or write to support@recaptured.io.

Third-party services on recaptured.io.

• Google Analytics 4 (Google), only if you accept. When you first visit, a banner asks whether we may use Google Analytics to count visits and measure which pages and buttons are used. It is not loaded until you select Accept. If you select Decline, or your browser sends a Do Not Track or Global Privacy Control signal, it is not loaded at all and the banner is not shown. Google Analytics does not receive your name, your email address or anything you type into a form.
• Google Fonts (Google), to serve the site’s typeface, which means your browser requests the font files from Google.
• Calendly, only if you load it. Our Book a call page uses Calendly, a third-party scheduling service, to let you pick a time. Calendly is not loaded when you open the page: it loads only after you select “Choose a time”. This applies to every visitor, including when your browser sends a Do Not Track or Global Privacy Control signal, and accepting Google Analytics does not load it. If you never load it, Calendly receives nothing from you through our site, and you can still reach us at sales@recaptured.io. Once loaded, Calendly receives the name, email address and time you enter and processes them under Calendly’s own privacy policy. When we checked, loading the calendar also caused your browser to contact these services on Calendly’s behalf, which may set cookies or similar identifiers: Google Analytics and Google Tag Manager, Meta (Facebook) Pixel, Segment, Sprig, Survicate, Braze, Stripe, Google reCAPTCHA, Google Sign-In, Airbrake, Google Fonts, and Amazon CloudFront (which serves Calendly’s images). Calendly set the cookies __cf_bm and _cfuvid, and Stripe set the cookie m. These services are chosen and operated by Calendly, not by us.

You can change your analytics choice at any time: Change your analytics choice Choosing again deletes the Google Analytics cookies this site set in your browser.

3. How we use controller information, and our legal bases

We do not use your information for advertising, and we do not build profiles that make decisions with legal or similarly significant effects on you.

4. Sensitive information

The Service has features that can involve sensitive information. For each one, the Customer decides whether to turn it on.

• Meeting recording. Recording starts only after every participant has been asked and has agreed. We keep a record of each consent.
• Precise location (for example, GPS time tracking). This runs only after the person has opted in, and we keep a record of that consent.
• Field audio. Where the law requires it, the Customer must give its people notice before recording. The Service records which notice was given.
• Voice identification. We do not build or store voiceprints.
• Health information. Not permitted. ReCaptured does not currently sign Business Associate Agreements or accept protected health information.

We do not use sensitive personal information to infer characteristics about you.

5. Artificial intelligence

Some features use AI models, for example the assistant, summaries, transcription, search, and the knowledge features that turn content into findable statements.

• Who processes it. To produce results, the relevant content is sent to our AI providers: currently OpenAI and Anthropic for language models and embeddings, and Deepgram for transcription.
• The providers’ obligations. Each provider is bound by terms that limit its use of content to returning results to us and prohibit training on it. Details of each provider’s retention are available on request at privacy@recaptured.io.
• Screening. Before any content reaches an AI provider, the Service screens it automatically, and it blocks the request if the check cannot be completed.
• No training. We do not use Customer Data to train AI models that serve other customers. We do not allow our AI providers to train their models on it.
• Audio. How long recordings are kept after transcription is controlled by your organization’s settings.
• Labels. AI-generated content is labelled in the product.
• Customers’ own AI apps. A Customer can choose to connect its own AI app to the Service through our MCP server. Data then flows to that app under the Customer’s instructions and the Customer’s agreement with that app’s provider. That provider works for the Customer, not for us.

6. How we share information

• Service providers. These are the companies that host, secure and operate the Service for us, such as cloud hosting, database, email delivery, text-message delivery, scheduling, payments, meetings infrastructure and AI providers. The current list, what each one does and where it processes data is available on request at privacy@recaptured.io; a published list follows with our data processing agreement. Each is bound by terms that limit its use of the data to providing services to us. We give Customers advance notice before we add one.
• Within your organization. Your organization’s administrators can see your account details, role, activity and sign-in sessions. They can also manage, suspend or remove your account.
• Legal and safety. We disclose information when the law requires it, or when it is needed to protect the rights, safety or security of users, Customers, the public or ReCaptured. We will try to notify the Customer first unless the law prohibits it.
• Business transfers. If we are involved in a merger, acquisition or sale of assets, information may transfer, but it stays protected by this notice.

We do not sell personal information. We do not “share” it for cross-context behavioral advertising. That has been true for the last 12 months, and we have no actual knowledge of selling or sharing personal information of anyone under 16.

7. Cookies and similar storage

The Service uses only storage that is strictly necessary for it to work, so there is no cookie banner in the app. We use no advertising cookies and no third-party trackers in the Service.

The app also saves display preferences in your browser’s local storage, such as panel widths, column choices, theme and dismissed tips, and keeps your current organization and return page for the session. None of this is sent to third parties.

Our website, recaptured.io. The website sets no cookies of its own. It stores your analytics choice in your browser’s local storage, and Google Analytics sets cookies only after you accept it (Section 2.10). If your browser sends a Do Not Track or Global Privacy Control signal, Google Analytics is not loaded and none of its cookies are set.

Customer websites. A Customer may put our visitor-insights script on its own website. That script is controlled by the Customer. By default it waits for the visitor’s consent before collecting anything, and it respects Do Not Track and Global Privacy Control signals. The Customer’s website privacy notice applies.

8. How long we keep information

Deleted information may persist in encrypted backups for a limited period before it is overwritten.

Customer Data is kept according to the Customer’s instructions and settings. Messages are currently kept until the Customer deletes them. When a Customer leaves, it can export its data for 30 days; we delete what remains within 90 days after that, keeping only sealed signature records, audit logs and invoices as the law requires.

9. Security

• Encryption: data is encrypted in transit (TLS) and at rest. Sensitive fields get additional encryption.
• Isolation and access: each Customer’s data is isolated at the database level. Multi-factor authentication is required for every user. Secrets are kept in a managed vault.
• Attachments: uploaded files are scanned for malware.
• Our posture: the Service is built with the control requirements of SOC 2 and ISO 27001 in mind. We are not certified against any framework and do not claim compliance with HIPAA. No system is perfectly secure. If we learn of a breach affecting your information, we will notify you and the relevant authorities as the law requires.

Report a vulnerability: security@recaptured.io (see our security.txt).

10. Your rights

Depending on where you live, you may have the right to:

• know what personal information we hold about you and get a copy;
• correct it;
• delete it;
• receive it in a portable format;
• object to or restrict certain uses (including analytics; see Section 2.3);
• withdraw consent where we rely on consent;
• appeal our decision on your request.

We will not treat you differently for exercising these rights.

How to make a request

• Information in a Customer’s workspace (Customer Data): contact that Customer. They control it, and our tools let them handle access, correction and deletion requests.
• Information we control (Section 2): email privacy@recaptured.io from the address on your account, or write to the postal address in Section 15.
• Verification: we will verify your identity before acting.
• Authorized agents: an agent may submit a request for you with your signed permission.

Timing. We acknowledge requests within 10 business days and respond within 30 days. Where the law allows, we may extend this once, with notice to you.

Appeals and complaints. If we decline your request, you can appeal by replying to our decision. We will answer the appeal within the time the law requires. If you are in the EU or UK, you may also complain to your data protection authority.

Opt-out signals. We honor Global Privacy Control signals as an opt-out of sale or sharing. We do neither in any case. On recaptured.io, a Global Privacy Control or Do Not Track signal also means Google Analytics is not loaded (Section 2.10).

11. Where we process information

The Service is hosted in the United States (Virginia, us-east-1). If you are outside the United States, your information is transferred to and processed in the United States.

12. Children

The Service is for business use by people aged 18 or older. We do not knowingly collect information from children. If you believe a child has given us information, contact privacy@recaptured.io and we will delete it.

13. California notice at collection

The table below summarizes, for the last 12 months, the categories of personal information we collect as a business (controller), where they come from, and why. The categories are those defined in the California Consumer Privacy Act. We sell none of these categories and share none of them for cross-context behavioral advertising.

Retention for each category is in Section 8.

14. Changes to this notice

• Material changes: if we make a material change, such as a new purpose, a new category of information, or a new kind of recipient, we will tell you at least 30 days before it takes effect, by email and in the app. We will not apply a material change to information we collected before it without your consent where the law requires it.
• Other changes: we publish them with a new effective date.
• History: every version stays linked from the top of this page.

15. Contact us

RECAPTURED, LLC
2305 Pennsylvania Avenue
Wilmington, DE 19806

Privacy: privacy@recaptured.io · Security: security@recaptured.io