Privacy notice

Draft of 16 October 2026

This notice explains how CaptiFi Connect Ltd uses personal data. It covers people who visit our website, people who sign up for and use a CaptiFi Connect account, and people whose numbers our customers text.

1. Who we are

CaptiFi Connect Ltd, company number [company number], registered office [registered office address]. We are registered with the Information Commissioner's Office (ICO) under number [ICO registration number].

For anything about your data, email hello@captificonnect.co.uk.

2. Our two roles

We hold personal data in two different capacities.

For our account holders and website visitors, we are the controller. We decide how and why that data is used, and most of this notice is about it.
For the contacts our customers upload and the texts they send and receive, we are a processor. The customer (the business that texted you) is the controller and decides how that data is used. We use it only to provide the service, on the customer's instructions and under a data processing agreement.

If a business has texted you through CaptiFi Connect and you want to know what data it holds about you, or want that data corrected or deleted, contact the business. If you contact us instead, we'll pass your request on. If the text came from a mobile number, you can reply STOP to stop further texts from that business.

3. Data we use as controller

Your name, email address and company name, and your password, which we store only as a one-way hash.
Sign-in and security records, such as sessions and IP addresses, which we use to keep accounts secure and stop abuse.
Information we collect when we check a new account, such as details about your business and how you plan to use the service.
Records of the credit added to your account, the texts you send, any refunds and adjustments, and your payments.
Sender name requests, with the purpose you give for each one.
Your API key and webhook settings, when each API key was last used, and a log of webhook deliveries.
Emails and messages you send us, for example when you ask for support.
Technical data that our servers may record when you visit the website, such as your IP address and browser type.

We use a cookie to keep you signed in to the dashboard, and your browser stores your choice of light or dark theme. We don't use advertising cookies. [Update this paragraph if analytics or other cookies are added]

4. Why we use it, and our lawful bases

To provide the service and manage your account (performance of our contract with you or your business).
To check new accounts and sender names, prevent spam and fraud, and keep the service secure (our legitimate interest in running a safe service, and our legal obligations).
To send you service emails, such as password resets and notices about your account (performance of our contract).
To answer your questions and support requests (our legitimate interests).
To keep financial and accounting records (legal obligation).
To improve the service, using figures about how it is used (our legitimate interests).
To tell you about our own products and services, where you have agreed to this or the law allows it. You can opt out at any time.

5. Data we process for our customers

As a processor we handle our customers' contacts (phone numbers, names, email addresses, notes and any custom fields a customer adds), the lists those contacts belong to, the content of texts sent and received, delivery statuses and times, and opt-out records.

We use this data only to provide the service to the customer and to keep it secure and working. We don't use it for our own marketing, and we don't sell it.

We share personal data only where we need to:

with mobile networks and SMS providers, which need the number and the text to deliver it;
with the companies that host our servers and send our emails [providers and locations to be added];
with professional advisers, such as lawyers and accountants; and
with regulators, the police or others where the law requires it, or where it's needed to protect people from fraud or harm.

The companies that process customer data for us are listed on our sub-processors page.

7. Transfers outside the UK

[Hosting location and any transfers to SMS providers outside the UK to be confirmed] If personal data is transferred outside the UK, we make sure it is protected by a safeguard that UK data protection law recognises, such as UK adequacy regulations or the International Data Transfer Agreement.

8. How long we keep data

Message content (the words of each text) is kept for 12 months by default and then deleted. [Confirm the deletion job is live before this notice takes effect]
Message records without the content (numbers, statuses, times and credits) are kept for [period] for billing and to deal with disputes.
Opt-out records stay on the customer's opt-out list until the person opts back in, the customer removes them or the account is deleted, so that texts to people who opted out keep being refused.
Account and billing records are kept while the account is open and then for [period] to meet accounting and legal requirements.
Security logs are kept for [period].

9. How we protect data

Traffic to the website, dashboard and API is encrypted with HTTPS.
Passwords are stored as scrypt hashes, and API keys only as SHA-256 hashes.
Webhook secrets and other secrets are encrypted at rest.
Each account can reach only its own data.
Phone numbers are masked in our logs.

10. Your rights

Under UK data protection law you have the right to:

ask for a copy of your personal data;
have inaccurate data corrected;
have your data deleted, in some circumstances;
restrict or object to how we use it, in some circumstances;
receive data you gave us in a portable format; and
withdraw your consent, where we rely on it.

Email hello@captificonnect.co.uk to use any of these rights. We'll reply within one month. If we hold the data as a processor for one of our customers, we'll pass your request to that customer.

11. Complaints

If you're unhappy with how we've used your data, please tell us first so we can try to put it right. You can also complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113.

12. Changes to this notice

We'll update this notice when the way we use personal data changes, and change the date at the top. If a change affects account holders, we'll email them.

13. Contact

Email hello@captificonnect.co.uk, or write to CaptiFi Connect Ltd, [registered office address].