Skip to main content
Capi Video

Privacy Policy

Introduction

This Privacy Policy explains how Capi Video, a video hosting and distribution platform, processes personal data: which data, for what purpose, for how long, who it is shared with and how you exercise your rights. It covers the website, the dashboard, the API and the player that sellers embed in their own pages.

Who we are

Capi Video is provided by Guilherme Lico Barscevicius Consultoria em Tecnologia da Informação, registered under CNPJ 36.742.159/0001-29, with its registered office at Av. Paulista, 171, Bela Vista, São Paulo/SP, CEP 01311-904 ("Capi Video", "we").

Our data protection officer (encarregado, LGPD Art. 41) is Guilherme Lico Barscevicius. Send any privacy request or question to privacidade@capivideo.com.

Controller and processor

We are the controller (LGPD Art. 5 VI) of the data of people who have a Capi Video account — sellers, creators and the members of their teams — and of visitors to our website.

Sellers use Capi Video to publish videos to their own audience. For the data of people who watch those videos, buy access to them or interact with the player (viewers and buyers), the seller is the controller and Capi Video is the processor (operador, LGPD Art. 5 VII): we process that data only to provide the service to the seller, following the seller's instructions and the Terms of Service (LGPD Art. 39), and never for our own purposes.

If you are a viewer or buyer, send your requests about that data to the seller, who decides about it and must answer them; read the seller's privacy policy to learn how they use your data. As the processor, we help the seller answer you, and you can also export or delete the data linked to your email yourself (see Your rights).

Data about account holders

When you create an account or are invited to a workspace, we process:

  • Account: name, email address, preferred language, and the workspaces and roles you belong to. You sign in with a link sent to your email; Capi Video does not use passwords.
  • Content: the videos, captions, thumbnails and other material you upload or create with the platform.
  • Billing: plan, subscription and invoices. Payment details are collected and stored by Stripe; no card data passes through our servers.
  • Sessions and security: your open sign-in sessions, with the browser used and a hash of the IP address, and the record of administrative actions taken in workspaces, with IP address and browser.
  • Privacy choices: your consent and email preferences and the privacy requests you make, with date, browser and IP address.
  • Notifications: if you turn on browser notifications, the delivery address your browser provides.

Data about viewers and buyers

When someone watches a video or interacts with the player, we process, on the seller's behalf:

  • Playback: how much of the video was watched and where, device type, browser, operating system and the referring site. The IP address is used to deliver the video, but it is not stored with these statistics. Where the law requires consent, as in Brazil and Europe, statistics are collected only after the viewer accepts in the player's banner.
  • Purchases: when the seller connects Hotmart, Eduzz or Kiwify, we receive purchase notifications from those platforms, which may include the buyer's name, email, phone number, CPF and address, and we keep the buyer's email or identifier and the products bought to grant access to the videos.
  • Sign-in to restricted videos: the email a buyer signs in to the player with and the verification code sent to it, stored only as a hash.
  • Consent: the choice made in the player's banner, with date, browser and a hash of the IP address.

Purposes and legal bases

We process account holders' data to perform our contract with you (LGPD Art. 7 V): creating and maintaining the account, hosting and delivering your videos, billing the plan and sending the service's emails. On the basis of our legitimate interest (Art. 7 IX), we protect the platform against fraud and abuse, keep security records and fix errors. We also process data to comply with legal and regulatory obligations (Art. 7 II). We ask for your consent (Art. 7 I) before sending workspace content to AssemblyAI for transcription or to OpenAI for subtitle translation.

For viewers' and buyers' data, the seller chooses the legal basis. Where the law requires it, the player asks for the viewer's consent before collecting statistics and loading marketing pixels.

With your consent (LGPD, Art. 7(I), and GDPR, Art. 6(1)(a)), we use Google Tag Manager, Google Analytics and Google Ads to measure visits to our own site and dashboard and the results of our campaigns. We never use them on sellers’ embedded videos, players or funnels. Before consent, Google receives only cookieless signals without identifiers through Consent Mode. To withdraw your consent, use the Cookie preferences button.

How long we keep data

We keep account data and content for as long as the account exists. Other data is deleted automatically within the periods below:

  • Deleted workspaces and videos: they stay in the trash for 30 days so they can be restored, and are then deleted along with their files.
  • Playback sessions and their events: 90 days. The aggregated statistics that remain identify no one.
  • Purchase notifications received from sales platforms: 30 days.
  • Purchased access: while it is valid; access with no end date lasts as long as the seller keeps the sale. Expired access is deleted 365 days after it ends, and refunded or charged-back access is deleted at once. Access from a cancelled subscription lasts until the end of the period already paid for and then expires; when the platform does not report that period, it is deleted at once. The number of a refunded or charged-back transaction is kept with no time limit, so that it cannot grant access again.
  • Consent records: 730 days, to prove the choice made.
  • Record of administrative actions: the IP address and browser are deleted after 90 days; the record of the action remains without them.
  • Sign-in links and ended sessions: 7 days after they expire or end. Buyers' verification codes: 1 day after they expire.
  • Privacy requests: we keep a record of how each request was handled. If a request is not confirmed or is cancelled, the email given is replaced by a hash 30 days after it closes.
  • Backups: the database is copied every day, encrypted. Deleted data may remain in these copies for up to 5 weeks, until they are replaced.

When you delete your account, we immediately delete the account, the workspaces you own and their content. The consent records and records of administrative actions linked to you remain, without your email, IP address and browser.

Sub-processors

We use the providers below to run the service. Each one processes data only for the stated purpose. When a provider is outside Brazil, the international transfer follows the LGPD (Art. 33) and, for the European Economic Area, the GDPR (Chapter V).

  • Oracle Cloud Infrastructure

    Purpose:
    Server that runs the application and stores the database
    Data shared:
    All the data described in this policy
    Country:
    Brazil
    Legal basis:
    Service agreement, and Standard Contractual Clauses (SCC) when outside Brazil

  • Backblaze B2

    Purpose:
    Storage of the database backups
    Data shared:
    The whole database, encrypted (AES-256) before it is sent
    Country:
    United States
    Legal basis:
    Standard Contractual Clauses (SCC)

  • Cloudflare

    Purpose:
    DNS service for the domain
    Data shared:
    Only the domain's DNS records; it receives no visitor data and no requests
    Country:
    United States
    Legal basis:
    Not applicable: no personal data is shared

  • Bunny.net

    Purpose:
    Storage, encoding and CDN delivery of videos and files such as thumbnails
    Data shared:
    The videos and material uploaded, and the viewer's IP address when delivering the video
    Country:
    Slovenia (EU)
    Legal basis:
    Standard Contractual Clauses (SCC)

  • Resend

    Purpose:
    Sending the service's emails (sign-in links, invitations, notifications and privacy request confirmations)
    Data shared:
    Recipient email address and message content
    Country:
    United States
    Legal basis:
    Standard Contractual Clauses (SCC)

  • Stripe

    Purpose:
    Payment processing and plan billing
    Data shared:
    Billing email and payment details (no card data leaves Stripe)
    Country:
    United States
    Legal basis:
    Standard Contractual Clauses (SCC)

  • OpenAI

    Purpose:
    Subtitle translation
    Data shared:
    Transcript and subtitle text sent for translation
    Country:
    United States
    Legal basis:
    Workspace consent for subtitle translation (on the AI features page) and Standard Contractual Clauses (SCC)

  • Sentry

    Purpose:
    Error and performance monitoring of the application, in the API, the web server and the browser (including the dashboard and the embedded player)
    Data shared:
    Technical details of the error, IP address, browser and operating system, the page or route address without its parameters, the referring site and, for a 10% sample of visits, navigation performance measurements. The API and the dashboard also send the user and workspace IDs, and the API the request ID. When an error occurs in the dashboard, a recording of the moments before it is sent, with every text, field and media masked and addresses without their parameters; the embedded player is never recorded. Cookies, form contents, request bodies and authentication headers are removed before sending, and the API does not send errors caused by the client (4xx).
    Country:
    United States
    Legal basis:
    Legitimate interest in the service's reliability and Standard Contractual Clauses (SCC)

  • Your browser's notification service (Google, Mozilla, Apple or Microsoft)

    Purpose:
    Delivering the notifications you turn on in the browser
    Data shared:
    Notification text and the delivery address the browser provides
    Country:
    United States
    Legal basis:
    Your consent, when you turn notifications on

  • AssemblyAI

    Purpose:
    Transcription of video audio for captions
    Data shared:
    The videos' audio
    Country:
    United States
    Legal basis:
    Workspace consent for transcription (on the AI features page) and Standard Contractual Clauses (SCC)

Services the seller turns on

The services below receive data only when the seller connects them to their own workspace. The seller chooses each one, and they process the data under their own privacy policies and their own agreement with the seller.

  • Hotmart, Eduzz and Kiwify

    Purpose:
    Send Capi Video the sales made on the platform, to grant access to the videos
    Data shared:
    Purchase and buyer details, such as name, email, phone number, CPF and address
    Country:
    Brazil
    Legal basis:
    The seller's instruction

  • Meta Pixel (Facebook and Instagram)

    Purpose:
    Measures the results of the seller's ads from the player
    Data shared:
    Video playback events, IP address, browser and Meta's cookies
    Country:
    United States
    Legal basis:
    The viewer's marketing consent, given in the player's banner

  • Google tag (Google Ads and Google Analytics)

    Purpose:
    Measures the results of the seller's ads and audience from the player
    Data shared:
    Video playback events, IP address, browser and Google's cookies
    Country:
    United States
    Legal basis:
    The viewer's marketing consent, given in the player's banner

  • TikTok Pixel

    Purpose:
    Measures the results of the seller's ads from the player
    Data shared:
    Video playback events, IP address, browser and TikTok's cookies
    Country:
    Singapore and United States
    Legal basis:
    The viewer's marketing consent, given in the player's banner

  • Custom pixel

    Purpose:
    Tracking code written by the seller, run in an isolated frame of the player
    Data shared:
    The playback events the player passes to the code; the seller sets where they go
    Country:
    Set by the seller
    Legal basis:
    The viewer's marketing consent, given in the player's banner

Your rights

The LGPD (Art. 18) gives you the right to: confirm whether we process your data and access it; correct incomplete, inaccurate or outdated data; ask for unnecessary data, or data processed in breach of the law, to be anonymised, blocked or deleted; receive your data in a portable format; delete data processed with your consent and withdraw that consent; know who we share your data with; and object to processing. You can also lodge a complaint with Brazil's data protection authority (ANPD).

  • With an account: open your account menu and go to Privacy and data. There you can download all your data at once as a JSON file, change your consent preferences and ask for your account to be deleted. Deletion is completed as soon as you confirm it through the link sent to your email, valid for 24 hours.
  • Without an account (viewers and buyers): on the privacy request page, enter your email and choose to export or delete your data. We send a confirmation link valid for 24 hours, and the request is carried out as soon as you confirm it. The page reaches the data linked to your email across every seller on Capi Video, and the export groups it by seller.
  • By email: send any other request, such as correcting data or changing your account's email, to the data protection officer at privacidade@capivideo.com. We answer within 15 days (LGPD Art. 19). We may ask you to confirm your identity before acting on it.

Make a privacy request without an account

For data processed on a seller's behalf, the seller is the one who answers your request; the options above help you exercise your rights in the meantime.

Data protection officer (encarregado)

Capi Video's data protection officer is Guilherme Lico Barscevicius. They receive complaints and communications from data subjects and from the ANPD and advise our team on data protection. Contact: privacidade@capivideo.com.

Users in the European Economic Area

If you are in the European Economic Area, the United Kingdom or Switzerland, the GDPR also gives you the rights of access, rectification, erasure, restriction, portability and objection, exercised through the same channels described above and answered within 30 days (GDPR Art. 12(3)), and the right to complain to your country's data protection authority. The legal bases are those described above (performance of the contract, legitimate interest, legal obligation and consent), and transfers outside the EEA use Standard Contractual Clauses.

Cookies and browser storage

We use necessary cookies to keep you signed in, remember your language and keep buyers signed in to restricted videos. We use Google Tag Manager, Google Analytics and Google Ads to measure our site, dashboard and campaigns only with your consent. These services are not used on sellers’ embedded videos, players or funnels. Marketing pixels a seller turns on in the player load only with the viewer’s consent. See the full list in the Cookie Policy.

Security

We protect data with encryption in transit (TLS) on every connection, sign-in by a link sent to your email (no passwords), session cookies that scripts cannot read, role-based access control in each workspace, encryption of integration credentials and backups, and signed, short-lived links for restricted videos.

If a security incident may cause significant risk or harm, we will notify the ANPD and the people affected (LGPD Art. 48) and, when it involves data processed on a seller's behalf, the seller.

Children's privacy

Accounts are for people aged 18 or older (see the Terms of Service), and we do not knowingly collect personal data from children. Anyone may watch videos through sellers' embedded players; viewer statistics are pseudonymous and, where the law requires, collected only with consent, and a seller whose content targets children is responsible for the parental consent their audience requires. If you believe a child has provided us with personal data, write to privacidade@capivideo.com so we can delete it.

Changes to this policy

We may update this policy when the service changes. The date of the last update appears at the top of the page, and we will tell account holders about significant changes by email or in the dashboard.

Contact

Guilherme Lico Barscevicius Consultoria em Tecnologia da Informação, CNPJ 36.742.159/0001-29, Av. Paulista, 171, Bela Vista, São Paulo/SP, CEP 01311-904. Data protection officer: Guilherme Lico Barscevicius, privacidade@capivideo.com.