Privacy Policy

Last updated June 2026

1. Who we are

This policy explains how Capient AS, registered in Norway (organisation no. 988 350 362), registered office Drammensveien 133, 0277 Oslo, Norway ("Capient", "we", "us"), collects and uses personal data when you use CapientOS (the "Platform"). For the personal data described here, Capient is the data controller. Where we process data on behalf of a customer organisation, we act as that organisation's processor under our customer agreement.

2. The personal data we collect

Data you provide

  • Account data — name, email address, and password (stored hashed);
  • Sign-in data — if you sign in with Google, the basic profile information Google shares with us;
  • Organisation and membership data — your role and team membership;
  • Content you create or upload — companies and peers you track, KPI targets, mandates and plans, IR deliverables, and documents you upload to your workspace;
  • Communications — messages and support requests you send us.

Data collected automatically

  • Device and browser information;
  • Usage data (pages visited, features used);
  • IP address and approximate location;
  • Cookies and similar technologies (see section 8).

The Platform also processes business and market data about publicly listed companies (e.g. share prices, financials, and publicly available website content). Where such data incidentally includes personal data of company representatives, we process it on the basis of our legitimate interest in providing investor-relations analysis.

3. How we use your data and our legal bases

Under the EU/EEA General Data Protection Regulation (GDPR), we rely on the following legal bases:

  • Performance of a contract — to create and operate your account, provide the Platform, and process transactions;
  • Legitimate interests — to secure, maintain, and improve the Platform, prevent fraud and misuse, and provide market and peer analysis;
  • Consent — for non-essential cookies/analytics and optional marketing communications, which you can withdraw at any time;
  • Legal obligation — to comply with applicable laws.

4. AI processing

To power the IQ assistant and generate IR deliverables, content you submit and relevant platform data may be sent to our AI subprocessors (see section 6) for processing. Under those providers' API terms, your content is not used to train their models. AI output is generated for you and is treated as your Customer Content.

5. How we share your data

We share personal data with:

  • Other members of your organisation, according to their role;
  • Service providers (subprocessors) who process data on our behalf under appropriate contracts (see section 6);
  • Authorities or third parties where required by law or to protect our rights;
  • A successor in the event of a merger, acquisition, or reorganisation.

We do not sell your personal data.

6. Subprocessors

We use the following categories of subprocessors to operate the Platform. This list may change; we will keep it current.

  • Hosting & storage — Vercel (application hosting and file storage) and Neon (database);
  • AI processing — Anthropic (Claude) and OpenAI;
  • Market & web data — EODHD (market data) and Firecrawl (website content);
  • Email — Resend (transactional email);
  • Analytics — PostHog (product analytics);
  • Maps — Mapbox.

7. International transfers

Some of our subprocessors are located outside the EEA, including in the United States. Where personal data is transferred outside the EEA, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or an adequacy decision.

8. Cookies and analytics

We use strictly necessary cookies to run the Platform and, with your consent, analytics cookies to understand usage. You can manage your preferences through our cookie banner and your browser settings.

9. Data retention

We keep personal data for as long as your account is active and as needed to provide the Platform, then for any period required to comply with legal obligations or resolve disputes. After account termination, Customer Content is available for export for a reasonable period before deletion.

10. Security

We apply appropriate technical and organisational measures to protect personal data. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

11. Your rights

Subject to applicable law, you have the right to access, correct, delete, or port your personal data; to object to or restrict certain processing; and to withdraw consent. To exercise these rights, contact us at contact@capientco.com. You also have the right to lodge a complaint with your local data protection authority — in Norway, the Norwegian Data Protection Authority (Datatilsynet).

12. Children's privacy

The Platform is intended for business use and is not directed to children. We do not knowingly collect personal data from children.

13. Changes to this policy

We may update this policy from time to time and will notify you of material changes by email or through the Platform.

14. Contact us

For questions about this policy or our data practices, contact contact@capientco.com.

This Privacy Policy was last updated in June 2026.