Data handling

This page explains what data we access, what we never touch, where that data lives, and how you get it back any time. Written to be readable without a lawyer.

You are the data controller. Lead data belongs to you. You decide the purpose of processing, who gets to see it, and when it gets deleted. The final call is always yours.

Captivela is the data processor. We process data on your instruction, only for the work you ask for. We do not sell, rent, or reuse your data for another client.

Before paid work starts, we sign a Data Processing Agreement (DPA) with every client. That agreement references Indonesia’s Personal Data Protection Law (UU PDP No. 27 of 2022) and formally records the role split above, the sub-processor list, the retention periods, and our obligations if an incident happens. No paid work runs before both sides have signed that document.

All of it is marketing lead data. Every field below has a clear operational reason, and if a field is not used for your work, we do not ask for it.

• Prospect name, so we address people correctly in follow-up and avoid duplicate leads.
• WhatsApp number or other contact, the only reply channel. Without it, follow-up cannot run.
• Campaign source, so we know which ad is actually producing results, not just noise.
• Pipeline stage, so we can see where a lead stops moving.
• Booking status, so we can tell a lead that showed up apart from one that only asked a question.
• Transaction value, so we can connect ad spend to revenue instead of stopping at a chat count.

This is not a policy that gets negotiated per project. Clinical patient data stays outside our systems, and we will not accept it even if offered.

• Medical diagnosis in any form.
• Treatment records, prescriptions, or procedure history.
• Lab results, radiology, and other clinical documents.
• Before and after photos linked to a patient's identity.
• Card payment data and banking credentials.
• The contents of your clinic's electronic medical record system.

If a piece of work would require us to touch clinical data, we decline that work and suggest another path that does not move patient data out of your clinic’s own system.

The principle is simple. Data stays in accounts you own, and we come in as a guest with granted permission.

Google Sheets, ad accounts, and the WhatsApp Business number are registered in your name. We are only given access rights, not ownership.

The automation system runs on our infrastructure but stores as little as possible. What it keeps is only the last state needed so automation does not send a message twice.

We do not copy your database to personal laptops, and we do not keep old exports in a team member's personal storage.

We cannot work without third-party services, so we publish the list. If this list changes, active clients are notified before the change takes effect.

• Cloudflare: hosting the site and the form endpoint on Cloudflare Workers. Data involved: form submissions from this site and technical request logs. Global edge network; requests are processed at the Cloudflare data center nearest the visitor.
• Google: Google Sheets as pipeline storage, Google Analytics for site traffic. Data involved: marketing lead data in Sheets, anonymous traffic data in Analytics. Google's data centers.
• WhatsApp Business API provider: sending and receiving messages. Data involved: contact numbers and marketing conversation content. Region follows whichever provider is used on your account.
• Language model (LLM) provider: agent processing for reply drafts and lead classification. Data involved: conversation snippets and lead attributes needed for that task only, at the provider’s data center, with no model training on your data.

For the language model provider specifically, we use a paid tier that does not use customer input to train models. Only the snippet of data a task needs is sent, not your entire lead base. If you do not want any LLM processing at all, that part can be switched off and the work continues manually.

Active lead data: for the duration of the engagement, stored in systems you own, not on our private servers.

Lead data after the engagement ends: 30 days. Once the final export is delivered, our access is revoked and our own working copies are deleted.

Operational and audit logs: 90 days. These hold a trail of who changed what, not the full content of conversations.

Forms from the Captivela site: 12 months, deleted sooner if you ask.

Captivela is small. That means the list of people who touch your account is short, and we can name them one by one if you ask.

• Access is granted per client, not one key for every account.
• Only the people actively working on your account have access.
• Every operational account uses two-factor authentication.
• Access is revoked the same day someone stops handling your account.
• We never ask for your clinic system's password. Connections happen through the platform's own official permission grant.

Export: send a request by email or WhatsApp. We prepare a CSV export of all your lead data within 5 business days, in a format other systems can read, not a proprietary lock-in format. No charge for this.

Deletion: requests are carried out within 30 days. We confirm in writing what was deleted. If some data must legally be retained, we state which part and why, rather than quietly dropping it from the list.

Incidents: if a breach or unauthorized access happens, we notify you within 72 hours of finding out, covering what happened, which data was affected, the steps already taken, and what you need to do. We notify you even when the news is bad for us.

Captivela currently operates as a sole proprietorship and does not yet hold a formal security certification such as ISO 27001 or SOC 2. What we do have is the practice written on this page, a signed DPA, and a willingness to answer audit questions from your team. If your organization requires that certification, better you know now than after the contract is running.

Send the question through the form. We answer with technical detail, not marketing language.