1. Controller
Navescale, Lda
Praça Duque de Saldanha 1, 2º andar
1050-094 Lisbon, Portugal
NIF: 518556719
DPO contact:
[email protected]
2. Data collected
Qaptivo collects and processes the following data:
- Customers (dashboard users): email, password (bcrypt-hashed), name of the institution
- Visitors (chatbot users): conversation messages, email/phone/name (if provided voluntarily), IP address (for rate limiting only), UTM parameters and referrer
3. Purposes of processing
- Provision of the AI chatbot and lead capture service
- Automatic lead scoring to prioritise sales follow-up
- Continuous improvement of the service (unanswered questions, health of the knowledge base)
- Sending notifications and weekly reports to Customers
- Invoicing and subscription management
4. Legal basis
- Performance of the contract (art. 6.1.b GDPR): processing of the data required to provide the service
- Legitimate interest (art. 6.1.f GDPR): lead capture on behalf of the Customer, service improvement
- Consent (art. 6.1.a GDPR): the visitor voluntarily provides their contact details through the chatbot
5. Legal status of Qaptivo
Qaptivo acts under two distinct legal statuses, to be specified for each processing operation:
- Controller for the data of its own Customers (dashboard accounts, invoicing, support, qaptivo.com prospects).
- Processor within the meaning of art. 28 GDPR for the data of the visitors and prospects of each Customer school, processed through the chatbot widget. The school is then the controller and determines the purposes. A Data Processing Agreement (DPA) is entered into with each Customer school (available at qaptivo.com/en/dpa).
6. Sub-processors
Qaptivo uses the following sub-processors, all covered by adequate safeguards (Data Privacy Framework and/or standard contractual clauses of the European Commission):
- Hetzner Online GmbH (Germany, Frankfurt): server hosting, database and file storage
- Anthropic, PBC (USA): AI processing of conversations (Claude model). Data sent through the API is not used to train the models.
- OpenAI, L.L.C. (USA): generation of embeddings for semantic search. Data sent through the API is not used to train the models.
- Cloudflare, Inc. (USA): Browser Rendering API for crawling school websites, and Turnstile for anti-bot protection
- Stripe, Inc. (USA / Ireland): payment and invoicing of Qaptivo subscriptions
- Sendinblue (Brevo) (France): sending of transactional emails (lead notifications, weekly reports)
- Giphy, Inc. (USA): search and display of GIFs in conversations (only if the option is enabled by the school)
- Functional Software, Inc. (Sentry.io) (USA): application error monitoring. Active filter on personal data (PII scrubbing).
- JustShipIt Pte. Ltd. (DataFast) (Singapore, EU infrastructure): analytics for the qaptivo.com marketing website only (has no access to widget data or to Customer schools' data)
Any change to this list is notified to Customers in advance with reasonable notice, in accordance with the commitments of the DPA.
7. Retention period
- Conversations: 12 months, then automatic deletion or anonymisation
- Leads: kept as long as the Customer account is active, deleted on request
- Customer accounts: kept for the duration of the subscription + 30 days after termination
8. Rights of data subjects
In accordance with the GDPR, you have the following rights:
- Right of access to your personal data
- Right to rectification of inaccurate data
- Right to erasure ("right to be forgotten")
- Right to restriction of processing
- Right to data portability
- Right to object to processing
To exercise these rights, contact us at [email protected]. We will respond within 30 days.
9. Security
- Passwords hashed with bcrypt (cost factor 12)
- Communications encrypted over HTTPS (TLS 1.2+)
- Data isolation per tenant (each customer only accesses their own data)
- Rate limiting on public endpoints
- Daily database backups
10. Cookies and analytics
The qaptivo.com website uses DataFast to measure its
audience (page views, visitor origin). This service is loaded only
after your explicit consent via the cookie banner. You can withdraw
your consent at any time by deleting the
qaptivo_consent cookie in your browser settings.
DataFast has no access to the data collected through the chatbot
widget.
The Qaptivo widget embedded on our Customer schools' websites sets no cookie and no local identifier until the visitor clicks the bubble to open the chat. When opened, a temporary in-memory session identifier (not persisted across page reloads) is used to maintain the continuity of the conversation. No advertising or third-party tracking cookie is set.
11. Transfers outside the EU
Some data is transferred to the United States (Anthropic, OpenAI, Stripe, Cloudflare, Giphy, Sentry). These transfers are governed by the EU-US Data Privacy Framework and/or standard contractual clauses approved by the European Commission. Primary hosting (database and application files) remains located in Germany (Hetzner, Frankfurt).
12. Automated decisions and lead scoring
The Qaptivo service applies an automated analysis to captured conversations in order to assess the prospect's level of commercial interest ("lead scoring", a score from 0 to 100 calculated from engagement and the intentions expressed).
In accordance with article 22 GDPR, this analysis produces no legal effects concerning the data subject and does not similarly significantly affect them. It is used solely to help the school's human teams prioritise their follow-up calls. No decision (admission, refusal, granting of funding) is taken on the basis of this score. The data subject may at any time request that this score be erased by contacting the Customer school or Qaptivo.
13. Complaints
If you consider that the processing of your data does not comply with the GDPR, you may lodge a complaint with the CNPD (Comissão Nacional de Proteção de Dados, the supervisory authority competent for Navescale, Lda in Portugal) or with the data protection authority of your country of residence (for example the CNIL in France).