Privacy policy and data retention
Last updated: 4 November 2026
This policy explains what personal data Capital OS collects, why, for how long it is kept, who it is shared with, and how to exercise your rights. It applies to the capital-os.net site, the Capital OS customer workspace and the reports generated there.
1. Data controller
Xolo Go OÜ, a private limited company under Estonian law, registered under number 14717109, with its registered office at Paju tn 1a, 50603 Tartu, Estonia, publisher of Capital OS. Contact for any question about your data: contact@capital-os.fr.
2. Data collected
- User account: last name, first name, email address, password (stored hashed, never in plain text), company and role when you provide them.
- Company data: the SIRET or SIREN number you enter, associated public information (Sirene register, BODACC, INPI), financing needs, size, revenue and other answers you provide to obtain an eligibility report.
- Payment: payments are processed by Stripe. Capital OS neither receives nor stores your card numbers; only the transaction ID, amount and payment status are kept.
- Correspondence: messages sent via contact forms or by email.
- Browsing data: IP address, browser and device type, pages viewed, visit source and interactions, collected through the server's technical logs and, only with your consent, through the audience-measurement and advertising tools described in section 5.
- Login via Google or Facebook: if you choose this login method, see section 6.
3. Purposes and legal bases
| Purpose | Legal basis (GDPR, art. 6) |
|---|---|
| Creating and managing your account, producing your reports and files, providing the subscribed service | Performance of a contract |
| Billing, accounting, fraud prevention | Legal obligation |
| Site security, technical logs, abuse prevention | Legitimate interest |
| Responding to your contact requests, customer follow-up | Legitimate interest or pre-contractual measures |
| Audience measurement and site improvement (Google Analytics 4, Hotjar, Microsoft Clarity) | Consent |
| Advertising and campaign measurement (Google Ads, Meta Pixel, LinkedIn Insight Tag) | Consent |
| Sending information about our services by email | Consent, or legitimate interest for our clients (opt-out possible at any time) |
4. Retention periods
| Data | Retention period |
|---|---|
| Account, reports and files | For the entire duration of the account, then deleted 3 years after the last login |
| Prospects (forms, reports without an account) | 3 years from the last contact |
| Invoices and accounting records | 10 years (accounting obligations) |
| Server technical logs | 12 months maximum |
| Cookie choices | 6 months, after which you are asked again |
| Audience-measurement and advertising cookies | 13 months maximum from the date they are set |
| Google Analytics 4 statistical data | 14 months maximum, then automatically deleted |
5. Audience measurement, advertising and cookies
Capital OS uses cookies and trackers. Strictly necessary cookies (session, security, remembering your choice) are set without consent. All other tools below are loaded only after your consent, given or refused in the banner shown on your first visit. You can change this choice at any time via the “Manage my cookies” button; refusing has no effect on access to the site.
Audience measurement (“Audience measurement” category)
- Google Analytics 4 (Google Ireland Limited): traffic statistics, page views, journeys and conversions. Google uses the
_gaand_ga_*cookies. IP addresses are not recorded by Google Analytics 4. To learn more about how Google uses data from sites that use its services: policies.google.com/technologies/partner-sites. You can also install the Google Analytics opt-out add-on. - Hotjar (Hotjar Ltd, Malta) and Microsoft Clarity (Microsoft): heat maps and anonymised session recordings to improve usability. Input fields are masked.
Google Search Console
We use Google Search Console to track the site's presence in Google search results (queries, impressions, clicks, indexing errors). This tool does not set any cookie on your device: it provides aggregated, anonymous statistics from the Google search engine.
Advertising (“Marketing” category)
- Google Ads (Google Ireland Limited): measuring conversions from our ads and retargeting. You can manage Google ad personalisation at myadcenter.google.com.
- Meta Pixel (Meta Platforms Ireland Limited): measuring the effectiveness of our Facebook and Instagram ads and building audiences. Meta and other third parties may use cookies, web beacons and similar technologies to collect or receive information from our site and elsewhere on the internet, and use it to provide measurement services and target ads. See Meta's privacy policy and your ad preferences.
- LinkedIn Insight Tag (LinkedIn Ireland Unlimited Company): measuring LinkedIn campaigns and aggregated demographic statistics.
You can also opt out of interest-based advertising from many advertisers at youronlinechoices.com.
6. Login via Google or Facebook
If you choose to log in with your Google or Facebook account, we only receive the information needed to create and identify your account: name, email address, account ID and, where applicable, profile picture. We never post on your behalf, do not access your contacts, and do not use this data for advertising purposes.
The use of information received from Google APIs complies with the Google API Services User Data Policy, including its Limited Use requirements. You can revoke Capital OS's access at any time from your Google or Facebook account settings.
7. Deleting your data
You can request the deletion of your account and all associated data:
- send an email to contact@capital-os.fr with the subject “Delete my data”, from the address linked to your account;
- specify, if you logged in via Google or Facebook, which service was used;
- we delete your account, your reports and the data received from Google or Facebook within 30 days and confirm this to you by email.
Only data we are legally required to keep (invoices and accounting records) is retained, for the legal period, then deleted.
8. Recipients and processors
Your data is intended for Capital OS. It is never sold. It is shared, to the extent necessary, with the following providers:
- PlanetHoster Inc. (Canada) — site hosting;
- Supabase — database and authentication, servers located in the European Union;
- Stripe — online payment;
- Resend — sending transactional emails;
- Anthropic — generating AI analyses and reports;
- Google, Meta, LinkedIn, Microsoft and Hotjar — audience measurement and advertising, only with your consent.
9. Transfers outside the European Union
Some providers may process data outside the European Union, notably in Canada (PlanetHoster) and the United States (Google, Meta, Microsoft, Stripe, Anthropic). These transfers are governed by a European Commission adequacy decision (Canada; US companies certified under the EU-US Data Privacy Framework) or, failing that, by the European Commission's standard contractual clauses.
10. Your rights
You have the right to access, rectify, erase, restrict and object, as well as the right to withdraw your consent at any time and to set directives on the fate of your data after your death. To exercise them, write to contact@capital-os.fr; we respond within one month.
You can lodge a complaint with the Estonian data protection authority (Andmekaitse Inspektsioon) or with the authority of your country of residence, in France the CNIL.
11. Security
Exchanges with the site are encrypted (HTTPS), passwords are stored hashed, and access to data is limited to people who need it.
12. Changes to this policy
This policy may change, notably when a new service or tool is introduced. The date it was last updated appears at the top of the page.
This English version is provided for convenience. The French version, politique de confidentialité, is the reference text and prevails in case of any discrepancy.