Privacy Policy
Last updated: September 2026
This Privacy Policy explains what data Mango Group, an Estonian company operating under the Kaptila brand ("Kaptila", "we", "us"), collects through Kaptila Welco, Kaptila DeskPilot, and the client portal at portal.kaptila.com (together, the "Services"), and how we use it.
Mango Group's company registration in Estonia is in progress. Once complete, this page will be updated with our full registered business details as data controller. In the meantime, privacy questions or requests can be sent to notification@kaptila.com.
1. Data we collect
We collect different data depending on how you interact with Kaptila:
- Account data — name, email address, phone number, company name and billing address, when you register a Kaptila account or subscribe to a product.
- Billing data — subscription and invoice history. Card details are collected and stored by our payment processor, Stripe; Kaptila does not receive or store your full card number.
- Kaptila Welco content — the public content of your website, which Welco crawls to build its knowledge base, and the messages exchanged between your website visitors and the Welco widget, including any name, email, or message a visitor submits to reach your team.
- Kaptila DeskPilot content — the text of internal IT requests you submit, and any routing configuration (e.g. approver email addresses) you set up.
- Usage and log data — technical data such as IP address, browser type, and pages visited, collected automatically when you use the Services or the public website.
2. How we use it
We use this data to: provide and maintain the Services; process payments and send billing communications; respond to support requests; send service-related notices (e.g. trial ending, setup status); and understand aggregate usage of our website to improve it.
3. Legal basis for processing
Where the General Data Protection Regulation (GDPR) applies, we process personal data on the following bases: performance of a contract (providing the Services you subscribed to), legitimate interest (securing and improving the Services, responding to inquiries), and consent (where you have explicitly given it, such as optional marketing communications).
4. Who we share data with
We share data with the following categories of third-party providers, solely to operate the Services:
- Stripe — payment processing and billing.
- Anthropic — the AI provider behind Welco and DeskPilot. When Welco answers a visitor or DeskPilot structures a request, the relevant content is sent to Anthropic's API to generate a response.
- Email delivery and hosting providers — to send account and notification emails and to host the Services.
- Google Analytics — on our public website (
kaptila.com) only, to understand aggregate visitor traffic. The client portal and the Welco/DeskPilot products themselves do not use Google Analytics.
We do not sell personal data. Some of these providers may process data outside the European Economic Area; where that is the case, they do so under appropriate safeguards such as Standard Contractual Clauses.
5. If you use Kaptila Welco on your own website
If you embed the Welco widget on your website, you are the data controller for your own website visitors, and Kaptila acts as a data processor on your behalf for the conversations and leads Welco collects. You are responsible for ensuring your own visitors are appropriately informed (e.g. in your own privacy policy) that a chat widget is present and how their messages are handled.
6. Data retention
We retain account and billing data for as long as your account is active and as required by applicable tax and accounting law thereafter. Welco knowledge-base content and conversation/lead data are retained for as long as the related subscription is active, and are deleted or anonymized within a reasonable period after cancellation, unless you request earlier deletion.
7. Your rights
Subject to applicable law, you have the right to: access the personal data we hold about you; request correction of inaccurate data; request deletion; object to or restrict certain processing; and request a portable copy of your data. To exercise any of these rights, contact notification@kaptila.com. If you are in the EU/EEA and believe your rights have not been respected, you may also lodge a complaint with your local data protection authority (in Estonia, the Estonian Data Protection Inspectorate — Andmekaitse Inspektsioon).
8. Cookies
The client portal uses only strictly necessary storage (such as your login session) to operate — no advertising or tracking cookies. Our public marketing website uses Google Analytics, which sets cookies to measure aggregate site usage.
9. Children's privacy
The Services are intended for business use and are not directed at children. We do not knowingly collect personal data from children.
10. Changes to this policy
We may update this Privacy Policy from time to time. We will notify you of material changes by email or through the client portal before they take effect.
11. Contact
Questions about this Privacy Policy or how your data is handled can be sent to notification@kaptila.com.