# Privacy policy

Last updated: 1 November 2026.

This policy covers kapabl.dev, the Kapabl MCP endpoint at kapabl.dev/mcp, and sign-in at auth.kapabl.dev (together, "the service"). Kapabl is operated by Devesh Mukesh Varma, an individual based in India; Kapabl is not yet incorporated. "Kapabl", "we" and "us" refer to the operator. Our postal address is available on request. Questions go to [legal@kapabl.dev](mailto:legal@kapabl.dev).

## What we collect

- **Visiting the site.** Pages are served by Cloudflare. Like any web server, Cloudflare receives your IP address, browser details and the pages you request. We set no cookies and run no analytics or advertising trackers.
- **Signing in with Google.** We ask Google only for the `openid` scope. Google confirms who you are and sends us an opaque account identifier. We keep that identifier and nothing else from Google: not your name, email address or profile photo. We never see or store your Google password.
- **Access granted to apps.** When you allow an app (for example an AI agent) to use Kapabl for you, we store a record of that permission: the app's identity, the scopes you approved and your account identifier. Access tokens expire after one hour and are stored only as hashes.
- **Actions an app takes for you.** To carry out a tool call through kapabl.dev/mcp, our servers process the request's arguments and any needed credentials in memory, only to route the action to the service it is meant for. They are discarded when the request completes. What we keep is a log entry: the app, your account identifier, the action, a one-way digest of the arguments and whether the call succeeded. We never store the arguments themselves, tokens or passwords.
- **Email.** If you write to an @kapabl.dev address, your message is stored in our mailbox, hosted by Zoho in India.
- **Payments.** We do not take payments yet. Payment features run only on test networks with no real money. We will update this policy before we accept any payment.

## Why we use it

To sign you in, to check that an app may act for you, to carry out the actions you authorize, to keep a security and audit record of those actions, and to answer your messages. Where we rely on your consent, you can withdraw it at any time (see "Your choices and rights").

We do not "sell" or "share" personal information, as those terms are defined under the California Consumer Privacy Act and other US state privacy laws, and we do not use personal data for targeted advertising or cross-context behavioral advertising.

## Who processes it for us

| Service | What it does | Data it handles |
|---|---|---|
| Cloudflare | Hosting, network, storage of sign-in records, logs | Requests, account identifier, permission records |
| Google | Sign-in | Your Google account, under Google's own privacy policy |
| Zoho | Email | Messages you send us |

## Legal disclosures and business transfers

- **Legal obligations and safety.** We may disclose information if required by law, subpoena, court order or a lawful government request, or when necessary to protect the security, rights or property of Kapabl, our users or the public.
- **Business transfers.** If Kapabl is incorporated, merged, acquired, financed or sold, your information may be transferred as part of that transaction, subject to confidentiality protections and to this policy.

## International transfers

Cloudflare runs a global network, so your data may be processed in India, the United States and other countries where our service providers operate. Email stays with Zoho in India. For users in India, transfers outside India follow Section 16 of the Digital Personal Data Protection Act, 2023, including any country restrictions the Central Government notifies.

## How long we keep it

- Access tokens: one hour.
- Permission records: until you or the app revoke them, or until you ask us to delete them.
- Tool-call logs: as long as Cloudflare's log retention for our plan, currently a few days.
- Email: in our mailbox until you ask us to delete it.

## Your choices and rights

**Everyone.** Wherever you live, you can ask to access, correct or delete your personal data, withdraw your consent, or revoke every app's access, by writing to [legal@kapabl.dev](mailto:legal@kapabl.dev). Withdrawing consent is as easy as giving it: one email, or removing Kapabl from your Google account settings. We will not treat you differently for exercising these rights. If we deny a request, you can appeal by replying to our answer, and someone who did not make the original decision will review it.

**Users in India (Digital Personal Data Protection Act, 2023).** You also have the right to nominate another person to exercise your rights if you die or become unable to. To nominate someone or raise a grievance, contact our Grievance Officer:

- Name: Devesh Mukesh Varma
- Designation: Founder, Kapabl
- Email: [legal@kapabl.dev](mailto:legal@kapabl.dev)
- Postal address: available on request at the email above

We acknowledge grievances within 24 hours and resolve them within 15 days, or within any shorter period the DPDP Rules set. If you are not satisfied with our answer, you can complain to the Data Protection Board of India.

**Users in the United States.** Under applicable state privacy laws, including the CCPA/CPRA, you can ask what categories of personal information we collect, and ask us to delete or correct it. We do not sell or share personal information, so there is nothing to opt out of. We confirm receipt of a verifiable request within 10 business days and respond within 45 calendar days.

## Customers' own users

When a business uses Kapabl to let agents act on its own website or services, that business is the Data Fiduciary (in India) or controller (in the United States), and Kapabl acts only as its Data Processor or Service Provider. That processing is governed by our Terms of Service and a Data Processing Agreement we sign with the business before processing begins. We do not use end users' data processed for a business for any purpose other than providing and securing the service for that business.

## Children

Kapabl is not meant for anyone under 18. We do not knowingly collect personal data from anyone under 18. If we learn that we have, we will delete it promptly.

## Changes

We will update the date above when this policy changes. Before a material change takes effect, we will announce it on this page and on the sign-in page.