Privacy Policy

Last updated: 12 July 2026

This policy explains what personal data URLCapsule collects, why, and your rights. We are the data controller. We keep data collection to the minimum needed to run the Service and we never sell your data.

1. Who we are

URLCapsule is operated by Orion Sky Marketing Ltd ("we"). For any privacy request, contact support@urlcapsule.com. We process personal data in line with the EU General Data Protection Regulation (GDPR) and Spanish data protection law (LOPDGDD).

2. What we store

• Account data: your email address, a securely hashed password, plan status, and a save token used by the Apple Shortcut.
• Your saved links: the URLs you save, plus the title, description, favicon, a screenshot of each page, extracted text, and AI-generated categories and summaries.
• Billing data: if you subscribe, Stripe processes your payment. We store a Stripe customer and subscription identifier and your plan status; we do not store your full card number.
• Technical data: limited logs (IP address, timestamps, error data, rate-limit counters) needed for security and to operate the Service.

3. Why we process it (legal bases)

• To provide the Service (contract): store, capture and search your links, run your account.
• To take payment (contract): manage your subscription through Stripe.
• Security and abuse prevention (legitimate interest): logs, rate limiting.
• Legal compliance (legal obligation): tax and accounting records where required.

4. Subprocessors

We share the minimum data necessary with trusted providers who process it on our behalf:

Where a provider is outside the EU, transfers are covered by appropriate safeguards such as Standard Contractual Clauses.

5. Retention

We keep your data while your account is active. If you delete a link it is removed, and if you delete your account we delete your personal data and saved content within a reasonable period, except where we must keep limited records (for example billing) to meet legal obligations.

6. Your rights

Under GDPR you have the right to access, rectify, erase, restrict, and port your data, and to object to certain processing. You can export or delete your data from within the app, or email us. You may withdraw consent at any time and lodge a complaint with the Spanish data protection authority (Agencia Espanola de Proteccion de Datos, aepd.es).

7. Cookies

We use a single essential session cookie to keep you logged in and a CSRF token to protect your account. We do not use advertising or third-party tracking cookies.

8. Security

Passwords are hashed, traffic is encrypted in transit (HTTPS), and access to your links is scoped strictly to your account. No system is perfectly secure, but we work to protect your data and will notify you and the authorities of a breach where the law requires.