Privacy policy

Captevio is a trading name of Niumora Limited, registered in England and Wales. Niumora Limited (“we”, “us”) provides Captevio, a service that lets lodges, hotels, tour operators and other businesses show popups and forms on their own websites, send email to their guests, and see what works.

We handle personal information in two different roles:

• As a controller for information about our own customers and the people who visit captevio.com: account holders, team members, and anyone who contacts us.
• As a processor (operator) for information our customers collect about visitors to their websites and the guests on their email lists. The customer decides what to collect and why, and their own privacy notice applies. If you gave your details to a lodge or hotel through a form powered by Captevio, please contact that business first; we will help them respond.

As a UK company, we are subject to the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We also aim to meet the EU GDPR for visitors and customers in the European Union, South Africa’s Protection of Personal Information Act (POPIA) for those in South Africa, and other privacy laws that apply to us.

What you give us

• Account details: your name, email address and password (handled by Clerk), and the names of your organisation and websites.
• Billing details: your billing email, plan and invoices. Card details are collected and held by Stripe; we never see or store full card numbers.
• Your content: popups, email templates and campaigns, images you upload, integration settings, and messages you write in the AI builders.
• Anything you send us when you contact support.

What we collect automatically

• Technical information such as browser type, device and pages visited in the dashboard.
• Your IP address, used at the time of a request for security, rate limiting and spam prevention. We do not store it with your account.
• Error reports, which can include the page you were on and technical details of what went wrong.
• Usage records needed for billing, such as how many popups were shown, emails sent and AI tokens used.

When a customer adds Captevio to their website, our script collects the following on their behalf:

• A random visitor ID and session ID, kept in the visitor’s browser storage, so we can count unique visitors and respect limits such as “show this once”.
• Which popups were shown, closed, clicked or submitted, and on which page.
• Where the visit came from: the referring site, campaign (UTM) parameters, advertising click IDs such as gclid or fbclid, and the Google Analytics client ID if the site uses Google Analytics.
• Device type, browser (user agent) and country. Country is worked out from the IP address when the request arrives; the IP address itself is not stored.
• Whatever a visitor types into a form, such as their name, email address, travel dates or a message. The customer chooses which fields to ask for.

If the customer has connected Google Analytics, the Meta Pixel or an email or CRM tool, these events and form submissions are passed to those services under the customer’s own account and terms.

Customers are responsible for telling their visitors about this in their own privacy notice and for asking for consent where the law requires it.

Captevio includes AI builders that design popups and emails from your instructions. They are powered by AI models from Anthropic.

What is sent to the AI

• The messages you write in the builder, and earlier messages in the same conversation.
• Images you attach, such as a screenshot of your website or a photo to use.
• The design you are working on: its HTML, and for emails its subject line and preview text.
• Screenshots of that design, rendered by Cloudflare (or ScreenshotOne) so the AI can check how it looks.

The builders do not send your contact lists, leads or visitor analytics to the AI. Please don’t paste guests’ personal information, payment details or other sensitive information into a builder conversation.

Training and retention

Anthropic processes this information to generate a response, as our sub-processor. Under its commercial terms, Anthropic does not use data sent through its API to train its models. We do not train AI models on your content either.

We save builder conversations and designs in your account so you can come back to them, and keep records of AI usage (such as tokens used) for billing and to improve cost and quality.

AI output

AI-generated designs and text can contain mistakes. Please review everything before you publish it. Our Terms explain this in more detail.

• To provide, maintain and support the service, including showing popups, storing submissions and sending email.
• To create and manage accounts, and to bill for paid plans.
• To keep the service secure and to prevent spam, fraud and abuse.
• To send service messages, such as receipts, payment problems, security notices and changes to these terms.
• To respond to support questions.
• To understand how the service is used, in aggregate, and improve it.
• To meet legal obligations and enforce our terms.

We do not sell personal information, and we do not use our customers’ visitor or guest data for our own marketing.

Legal bases

Where UK GDPR, EU GDPR or POPIA require a legal basis, we rely on: performing our contract with you; our legitimate interests in running, securing and improving the service; your consent, where we ask for it; and complying with the law. For visitor and guest data, we process on our customers’ instructions.

We use the following service providers (sub-processors) to run Captevio. Each receives only what it needs for its task, under contract.

We also share information:

• With the integrations a customer connects, such as ActiveCampaign, Brevo, Kit or a webhook, at that customer’s direction.
• When the law requires it, or to protect the rights, safety and property of our customers, their visitors, the public or us.
• With a buyer or successor if our business is sold or reorganised, under the protections of this policy.

Several of our providers are based outside the UK and the European Economic Area, mainly in the United States. When information is transferred, we rely on the safeguards the law provides: UK adequacy regulations (such as the UK–US data bridge), the UK International Data Transfer Agreement or Addendum, the EU standard contractual clauses, and our providers’ data processing agreements. Where POPIA applies, we transfer information only under equivalent protections.

We keep account information and your content for as long as your account is open. When you close your account, we delete or anonymise it within a reasonable period, except where we need to keep it longer for legal, tax or accounting reasons, or to resolve disputes.

Visitor and guest data is kept for as long as the customer keeps it in their account. Customers can delete enquiries and contacts at any time, and this data is removed with the rest of the account when it is closed. Backups are overwritten on a rolling basis.

We protect information with encryption in transit, access controls that keep each organisation’s data separate, encryption of the credentials you give us for connected integrations, spam protection on public forms, and monitoring. No system is perfectly secure; if we become aware of a breach that affects your information, we will tell you and the relevant authorities as the law requires.

Depending on where you live, you may have the right to:

• ask what information we hold about you and get a copy;
• have it corrected or deleted;
• object to or restrict how we use it, including for direct marketing;
• receive it in a portable format;
• withdraw consent, where we rely on it.

To use these rights, email [email protected]. We may need to confirm your identity. If your information was collected by one of our customers, we will pass your request to them.

You can also complain to a data protection authority. Our lead authority is the UK Information Commissioner’s Office. In the EU you can contact your local supervisory authority, and in South Africa the Information Regulator. We would appreciate the chance to help first.

On captevio.com, we use cookies that are needed to sign you in and keep your session secure. We do not use advertising cookies on our own site.

On our customers’ websites, the Captevio script uses the browser’s local and session storage (keys beginning captevio_) to remember the visitor ID, which popups have been seen or dismissed, and where the visit came from. It reads, but does not set, the Google Analytics cookie if one exists. Where a customer enables bot protection, Google reCAPTCHA may set its own cookies.

Captevio is a service for businesses and is not meant for children. We do not knowingly collect information from anyone under 18 as a customer.

We may update this policy as the service changes. We will change the date at the top, and if a change is significant we will tell account holders by email or in the dashboard before it takes effect.

Questions or requests about privacy: [email protected]
Captevio is a trading name of Niumora Limited, registered in England and Wales.