Privacy policy
Last updated: 9 October 2026 · Version 1.4
This policy explains what personal data KaizenProof handles, why, who else receives it, and what you can do about it. It covers:
- people who use KaizenProof as members of a workspace;
- people who are invited to a workspace;
- visitors to the KaizenProof website.
1. Who we are
KaizenProof is run by Capital AI Srl, an Italian company.
- VAT number (P.IVA): 13856590966
- Website: capital-ai.eu
- Contact for privacy and everything else: vincent@capital-ai.eu
- Data Protection Officer: Capital AI has not appointed one. Write to vincent@capital-ai.eu with any question about your data.
2. The short version
- Your employer (or whichever organisation runs your workspace) decides what goes into the workspace. For that content we work on its behalf. For your account and the security of the service we decide ourselves (section 3).
- What you type in a workspace is stored on Google Cloud in the EU and sent to Anthropic, in the United States, whose Claude model does the analysis. Under Anthropic's commercial terms it may not train its models on that content.
- Your sign-in is handled by Firebase Authentication (Google), which processes data in the United States.
- If you leave a workspace or delete your account, what you wrote stays in the workspace. It is then linked to a random internal identifier, not to your name or email, and is shown as "Former member" (section 9).
- If your workspace buys a plan, payments go through Stripe. Stripe handles the card or bank details; we keep only Stripe's reference numbers and the state of the subscription (section 4).
- No advertising. On our public pages, and only if you click "Accept analytics", we use Google Analytics to count visits and Microsoft Clarity for heatmaps and recordings of clicks and scrolling with all text hidden. Neither ever runs inside the app or once you are signed in (section 11).
3. Two roles: workspace content and everything else
KaizenProof is sold to organisations ("customers"). Each customer has a workspace. Its members report everyday work problems ("frictions"), answer follow-up questions, get a suggested fix ("countermeasure") and later confirm whether the fix held ("check-ins").
Workspace content. This means frictions, answers to the why questions, root causes, countermeasures, check-in answers, "me too" entries, thanks (stars) and credits, standards, the workspace's goal, the workspace name, the workspace's brand on templates (a name, two colours and a logo), the member list and invitations. For this content the customer is the controller and Capital AI is its processor, acting under our Data Processing Agreement with the customer. Questions about this content, including requests to see or erase it, should go first to the organisation that runs your workspace. We will help them, and we will pass your request on to them if it reaches us.
Everything else. This means your account, sign-in and security records, your email preference, your progress in the free course, your private milestones, billing data for a paid plan, abuse limits, the product's own usage counts and visits to the public website. For this data Capital AI is the controller.
4. What we collect and where it comes from
| What | Examples | Where it comes from |
|---|---|---|
| Account data | email address; name and profile photo address if you sign in with Google; an internal user id; whether your email is verified; when you last signed in | You, through Google sign-in or an email sign-in link (Firebase Authentication) |
| Membership data | your role (owner or member), when you joined, the day you were last active, copies of your name and email shown to your colleagues | Created when you join or create a workspace |
| Workspace content | the text you type when you report a friction (20 to 2,000 characters), optional time figures (how often, how many minutes), your answers to the why questions, edits to the root cause, reasons you give when rejecting a suggestion, check-in answers and minutes saved, "me too" entries with any time figure you add, thanks (stars) you give, the model's output | You and your colleagues |
| Information about other people inside workspace content | what you type can mention colleagues, managers, customers or suppliers, by name or by role | You and your colleagues. We do not check or filter this text. |
| Workspace brand on templates | the name, the two colours and the logo (a PNG image, at most 256 KB) that a workspace owner sets for the template files members download; the internal user id of the owner who last changed it, and when. The logo is stored without the metadata the uploaded file carried (text comments, camera or location data, timestamps). A brand is rarely personal data; it can be when the name or logo is a person's own | A workspace owner |
| Invitation data | the invited email address, who invited it, to which workspace, when, how many times it was sent, whether it was accepted or revoked | The workspace owner who sends the invitation |
| Invitation limits | a keyed one-way hash of an invited email address and the times invitations were sent to it, used to stop anyone sending more than 3 invitations to one address in 7 days | Created when an invitation is sent |
| Email preference | whether you want check-in emails | You (settings or the unsubscribe link) |
| Course progress | for each lesson of the free course you complete: when, whether you marked "I did this", and when your next review is due. Never your answers | You, when you use the course while signed in |
| Private milestones | the date of a few "firsts" (for example your first friction reported), shown only to you | Created by the service as you use it |
| Usage records | records of steps in a workspace (for example "friction submitted", "countermeasure exported"), holding internal ids, your user id and times, never your text; daily counters of analysis use, friction creations and invitations | Created by the service as you use it |
| Website analytics, only if you accept | for Google Analytics: page address, page title, the events listed in section 11, a random browser identifier, browser, device, language, referring page, approximate location from the IP address. For Microsoft Clarity: page address, clicks, scrolling and pointer movement, the layout of the page with all text hidden, a random browser identifier, browser, device, screen size, referring page, approximate location from the IP address. Never anything you type (section 11) | Your browser, on our public pages, after you click "Accept analytics" |
| Visitor events | records of a page being viewed ("landing viewed", "intake viewed", "pricing viewed") or a free template downloaded, holding only the event name, the time and, for a download, which template and file format | Your browser, on our public pages. Nothing that identifies you is stored with it |
| Technical and security logs | our application logs hold internal ids and counts, never your text or email. Google Cloud's own request logs record, for each request, the IP address, browser type and address of the page or API called | Your browser and our servers |
| Emails we send you | the email address it went to, the subject and the body | Created when we send a sign-in link, a welcome email, a check-in or an invitation |
| Billing data, only if the workspace buys a plan | the Customer's legal name, billing email address (the email of the workspace owner who started the purchase), billing address and tax ID (for example a VAT number), entered at Stripe Checkout or in the Stripe Customer Portal; the payment method, of which Stripe shows us only the type and, for a card, the brand, last 4 digits and expiry date, or, for a SEPA Direct Debit, the last 4 digits of the IBAN, the bank's country and code and the mandate reference; the SEPA Direct Debit mandate itself (the authorisation to debit the account, and when and how it was given), which Stripe collects on its own page and keeps; invoices and payments. Stored by Stripe. We store in our database the Stripe customer and subscription ids, the plan, the currency, the subscription's status and period dates, whether it is set to cancel, the date of a failed payment, and the version of the Terms of Service accepted at purchase and when; and, for 90 days, a record of each Stripe notification we processed (its id, type and the workspace id) | The workspace owner who buys or manages the plan, and Stripe |
| New-workspace notice | when a workspace is created: the signer's email address, user id, workspace id, plan, trial end and the time. No workspace name and nothing typed in the workspace | Created by the service and emailed to Capital AI (section 6) |
What we do not ask for. We do not ask for special categories of data (health, religion, union membership and so on) or for data about criminal offences. Please do not type them into a friction. See section 8 of the Terms.
Payments. We never receive or store a full card number, bank account number (IBAN) or security code: Stripe collects them on its own payment page. For a SEPA Direct Debit, Stripe also collects the mandate there and sends the notices of each debit that the SEPA rules require to the billing email address.
5. Why we use it, and the legal basis
Where we act as processor (workspace content), the legal basis is the customer's to establish; we process only on its instructions.
| Purpose | Data | Legal basis (GDPR Art. 6) |
|---|---|---|
| Creating and running your account and signing you in | account data | (b) contract, for the person who signs up for a workspace; (f) legitimate interest of Capital AI and of the customer in providing the service the customer uses, for people invited by it |
| Providing the service: storing workspace content, running the analysis, showing it to your workspace | workspace content, membership data | Processor on the customer's instructions (Art. 28) |
| Sending check-in emails about countermeasures you own | email address, friction titles | Processor on the customer's instructions; you can switch them off at any time |
| Sending an invitation email chosen by a workspace owner | invited address, inviter's address, workspace name | Processor on the customer's instructions |
| Sending sign-in links and the welcome email | email address | (b) contract |
| The free course and your private milestones | course progress, milestones | (b) contract: you asked for the feature |
| Selling a paid plan: taking payment, renewing it, invoices, changes of plan and cancellation, failed-payment handling | billing data | (b) contract, with the Customer that buys the plan; for the person who acts for it (the workspace owner), (f) legitimate interest in performing that contract |
| Keeping tax and accounting records of each sale | billing data, invoices | (c) legal obligation: Italian tax and accounting law |
| Preventing abuse: one free trial per account, invitation caps, rate limits, daily analysis ceilings | account data, invitation limits, counters, logs | (f) legitimate interest in keeping the service available and stopping spam and fraud |
| Security and troubleshooting | technical and security logs | (f) legitimate interest |
| Knowing who signs up, to watch the trial for abuse and to run the business | new-workspace notice | (f) legitimate interest |
| Measuring how the product is used, in aggregate | usage records, visitor events | (f) legitimate interest |
| Counting visits to our public pages with Google Analytics, and seeing how those pages are used with Microsoft Clarity, only if you accept | website analytics (section 11) | (a) consent, asked before anything loads, as Art. 122 of the Italian Privacy Code requires for cookies that are not strictly necessary |
| Answering your requests and complying with the law | whatever the request needs | (c) legal obligation |
We do not sell personal data. We do not use it for advertising. We make no decisions about people by automated means; the model suggests a waste category, questions and a countermeasure, and a person decides what to do with them. We do not use workspace content to train models.
6. Who receives it
We use these providers ("sub-processors") to run KaizenProof. The full list, with what each receives and where, is on our sub-processors page.
- Google Cloud and Firebase (Google): hosting, database, sign-in, sign-in link emails, logs.
- Google Workspace (Google): sends our other emails (welcome, check-in and invitation emails) from Capital AI's mailbox. It receives the recipient's address and the email's contents (friction titles; for invitations, the workspace name and the inviter's address).
- Anthropic: the Claude model that analyses what you type. It receives the friction text, the waste category, the why questions and your answers, the root cause and any rejected suggestions with your reasons; to suggest possible duplicates, the short titles of other frictions in the same workspace; for the weekly workspace summary, figures and labels only. It does not receive your name, email address, the workspace name or the workspace's brand or logo.
- Stripe (Stripe Payments Europe, Limited, Ireland): payments, subscriptions, SEPA Direct Debit mandates, invoices and the Customer Portal, only for workspaces that buy a plan. It receives the billing data in section 4 and the workspace's internal id and plan. It does not receive workspace content. Stripe processes this data for us, and also decides for itself how it uses payment data for its own purposes, such as fraud prevention and compliance with financial regulation, under the Stripe Privacy Policy.
- Google Analytics (Google) and Microsoft Clarity (Microsoft): website analytics on our public pages, only for visitors who click "Accept analytics", never inside the app and never once signed in (section 11).
Inside KaizenProof, everything in a workspace is visible to every member of that workspace: the board shows every friction, and anyone can open its whys, countermeasure, check-ins, "me too" names and thanks. Every member can also see the list of members with their names, email addresses, roles, the date they joined and the day each was last active, and the workspace's brand on templates, which is shown to nobody outside the workspace. Time figures added with a "me too" are shown only to the person who added them, the friction's owner and workspace owners. Your course progress and milestones are shown to no one but you.
Who we notify internally
Each time a workspace is created, the service emails Capital AI (vincent@capital-ai.eu) a short notice: the signer's email address, user id, workspace id, plan, trial end and the time. It never holds the workspace name or anything typed in the workspace. It stays in Capital AI's mailbox at Google Workspace.
Google sign-in is provided by Google under its own terms; Google decides how it handles your Google account.
We may disclose data where the law requires it, for example to a court or public authority.
7. International transfers
Our database is in Google Cloud's europe-west1 region (Belgium) and the application runs in europe-west4 (Netherlands). Not all data stays in the EU. Some providers process data outside the European Economic Area:
| Provider | Where | Transfer basis |
|---|---|---|
| Firebase Authentication (Google) | United States, according to Google | Google's data processing terms, which include the Standard Contractual Clauses; Google LLC is certified under the EU-US Data Privacy Framework |
| Google Workspace (Google), our email | Google's data centres, which may be outside the EEA | Google's data processing terms, which include the Standard Contractual Clauses; Google LLC is certified under the EU-US Data Privacy Framework |
| Google Cloud request logs | Stored in a log bucket with Google's "global" location, which is not limited to the EU | As for Google above |
| Anthropic | United States, for stored data and for the analysis itself (we restrict its processing to the United States) | Standard Contractual Clauses, which Anthropic's Data Processing Addendum incorporates |
| Stripe (only for workspaces that buy a plan) | Stripe Payments Europe, Limited is in Ireland; Stripe transfers data to Stripe, Inc. and others in its group in the United States | Stripe, Inc. is certified under the EU-US Data Privacy Framework; Stripe's Data Transfer Addendum adds the Standard Contractual Clauses in case the Data Privacy Framework cannot be relied on |
| Google Analytics (only if you accept) | United States, among other countries where Google processes data | Google LLC is certified under the EU-US Data Privacy Framework; Standard Contractual Clauses in Google's data processing terms |
| Microsoft Clarity (only if you accept) | United States | Microsoft Corporation is certified under the EU-US Data Privacy Framework |
You can ask us for a copy of the safeguards that apply (section 10).
8. How long we keep it
| Data | How long |
|---|---|
| Account data | Until you delete your account. Firebase then removes it from its live systems and backups within 180 days, according to Google. |
| Workspace content, including the brand on templates and its logo | Until a member with the right to do so deletes it, or until the workspace is deleted. Template files generated with the brand are made on request and are not stored. After a trial ends, the workspace stays readable and nothing is deleted automatically. We have not set a period after which an unused workspace is deleted; before we do, we will publish it here. |
| Content of a member who left | Stays with the workspace (section 9). |
| Invitations | Valid for 7 days from the last send. Pending invitations stay until revoked, accepted, the workspace is deleted or the invited person deletes their account. When a member leaves, the address is removed from the invitation they accepted. |
| Invitation limits (hashed address) | Deleted automatically 7 days after the last invitation to that address. |
| Usage records inside a workspace | Deleted automatically after 90 days. |
| Visitor events | Deleted automatically after 30 days. |
| Google Analytics data | 2 months, the shortest retention Google Analytics offers. The _ga cookies: section 11. |
| Microsoft Clarity data | Recordings 30 days; heatmaps and other aggregate data 13 months, according to Microsoft. The _clck and _clsk cookies: section 11. |
| Course progress and milestones | Until you delete your account. |
| Billing data in our database | Until the workspace is deleted. Records of Stripe notifications: 90 days. |
| Invoices and payment records | 10 years, as Italian law requires accounting records to be kept (Art. 2220 of the Civil Code). They are kept at Stripe and in our accounting records, also after the workspace is deleted. Stripe keeps other payment data for as long as its own legal obligations require, under its privacy policy. |
| Google Cloud request logs | 30 days. |
| Firebase Authentication IP logs | "A few weeks", according to Google. |
| Content sent to Anthropic | Deleted by Anthropic within 30 days, according to Anthropic. If its automated systems flag a request under its usage policy, up to 2 years, and safety scores up to 7 years. |
| Emails we send | A copy stays in the sent mail of Capital AI's mailbox at Google Workspace. We use it only to answer questions about delivery. |
| New-workspace notices | In Capital AI's mailbox at Google Workspace, until we delete them. |
| Items stored in your browser | See section 11. |
No backups. We do not keep backups of the KaizenProof database. When something is deleted, we cannot restore it. Google removes deleted data from its own storage systems on its own schedule, which Google states is at most about 180 days.
9. Leaving a workspace, and deleting your account
If a workspace owner removes you, you lose access at your next action. Your account remains. What you wrote stays in the workspace (see below), and frictions you owned are handed to a workspace owner. Your email address is removed from the invitation you accepted.
If you delete your account (Workspace screen, "Delete my account"; you must have signed in within the last 5 minutes and type your email address):
- Your sign-in account, your user record, your email preference, your course progress, your milestones and any invitations addressed to your email are deleted.
- If you are the only member of your workspace, the whole workspace is deleted too.
- If you are the last owner and others remain, deletion is refused until you make someone else an owner or delete the workspace.
- Otherwise you leave the workspace, and everything you wrote there stays: frictions you reported, your answers, countermeasures, check-in answers, "me too" entries, thanks, standards and the invitations you sent. It is kept under a random internal identifier (a pseudonymous key). After deletion, nothing in our systems links that identifier to your name or email address. Your colleagues see "Former member" where your name was.
- The text itself is not changed. If you typed your own name, or something that identifies you, into a friction, it stays there. Ask a workspace owner to delete that friction, or ask us and we will pass the request on.
Why content stays. The workspace describes how the customer's team works, and the customer, not the individual, is its controller (section 3). Erasure of that content is decided by the customer.
Deleting a workspace (any workspace owner) deletes everything in it at once: frictions and their history, countermeasures, check-ins, standards, thanks and credits, members, invitations, the brand on templates with its logo, and usage records. It cannot be undone. Before deleting, a workspace owner can download all workspace data as a file, which includes the brand and the logo. A paid subscription is cancelled at the same time; invoices and payment records are kept for the period in section 8.
10. Your rights
Under the GDPR you can ask us to:
- give you access to your personal data and a copy of it;
- correct it;
- erase it;
- restrict how we use it;
- give it to you in a portable format;
- stop using it where we rely on legitimate interest (you can object).
You can withdraw consent where we rely on it (only website analytics): use "Cookie settings" at the foot of any public page and choose "Reject".
How. Email vincent@capital-ai.eu from the address on your account. We may ask you to confirm the request from that address. We answer within one month, which can be extended in the cases the GDPR allows. Many things you can do yourself: switch off check-in emails, delete frictions you reported (unless they have become a workspace standard), remove your name from a credit, and delete your account.
Workspace content. For content your organisation controls, we will refer your request to the workspace owners and help them answer it.
Complaints. You have the right to complain to the Italian data protection authority, the Garante per la protezione dei dati personali (garanteprivacy.it; Piazza Venezia 11, 00187 Roma; protocollo@pec.gpdp.it), or to the authority where you live or work. We would like the chance to fix the problem first, but you do not have to come to us first.
11. Cookies and browser storage
KaizenProof runs no advertising or tracking scripts, and no analytics inside the app. Its emails contain no tracking pixel.
Cookies without consent. KaizenProof sets one cookie when you choose a language or open a page in another language, and one when you choose a currency for prices:
| Cookie | Set by | What it holds | Why | When it goes |
|---|---|---|---|---|
kp_locale | KaizenProof (first party) | the language code, for example en or it | to show pages in the language you chose | after 12 months |
kp_currency | KaizenProof (first party), only when you pick USD, EUR or GBP on a page with prices | the currency code: usd, eur or gbp | to show prices in the currency you chose | after 12 months |
Until you pick a currency, prices are shown in one your browser suggests: the page reads your device's time zone (for example "Europe/London") in your browser to choose GBP, EUR or USD. The time zone is not stored and is not sent to us or anyone else.
Analytics, only if you accept. A banner on the public pages (the home page for visitors, pricing, the about page, the guides, the comparison pages, the reference pages about Kaizen and Lean with their reading list, the course, the templates and the legal pages) asks whether we may use Google Analytics and Microsoft Clarity. One answer covers both. The two choices, "Accept analytics" and "Reject", are equal. Until you click "Accept analytics", no Google or Microsoft script loads and no request goes to either; ignoring the banner is not consent. Neither ever runs inside the app, and neither runs once you are signed in, on any page. You can change your answer at any time with "Cookie settings" at the foot of every public page; choosing "Reject" stops both and removes their cookies from our domain.
- Google Analytics counts page views and the events "landing viewed", "intake viewed", "pricing viewed" and "template downloaded" (with the template and file format). Google signals, advertising storage, ad personalisation and data sharing with Google are switched off, and Google keeps the data for 2 months. It receives the page address without anything after "?" or "#", the page title, a random browser identifier, the browser and device type, screen size, language, the referring page and an approximate location from the IP address.
- Microsoft Clarity shows us heatmaps and recordings of how a visit moves through a public page: clicks, scrolling, pointer movement and the layout of the page. It runs with Clarity's strictest masking, so all text on the page and everything typed into a field is hidden before it leaves your browser; every input box is also marked to be masked. It receives the page address, a random browser identifier, the browser and device type, screen size, the referring page and an approximate location from the IP address. Microsoft keeps recordings for 30 days and heatmaps for 13 months, according to Microsoft.
Neither receives your name, email, user id, workspace or anything you type. These cookies are set:
| Cookie | Set by | What it holds | Why | When it goes |
|---|---|---|---|---|
kp_consent | KaizenProof (first party) | analytics=granted or analytics=denied | to remember your answer, so we do not ask on every page | after 6 months, when we ask again |
_ga | Google Analytics, on our domain, only after "Accept analytics" | a random browser identifier | to tell one visitor's visits from another's in the counts | after 13 months, or at once if you choose "Reject" later |
_ga_<id> | Google Analytics, on our domain, only after "Accept analytics" | the current visit's number and time | to count visits | after 13 months, or at once if you choose "Reject" later |
_clck | Microsoft Clarity, on our domain, only after "Accept analytics" | a random browser identifier and Clarity settings | to tell one visitor's visits from another's | after 1 year, or at once if you choose "Reject" later |
_clsk | Microsoft Clarity, on our domain, only after "Accept analytics" | the current visit's identifier | to join the pages of one visit into one recording | after 1 day, or at once if you choose "Reject" later |
Once loaded, Clarity's script may also set Microsoft's own cookies on Microsoft's domains (such as clarity.ms), under Microsoft's privacy statement. We cannot read or remove those; your browser's settings can.
Browser storage. Your browser also keeps these items for KaizenProof:
| Item | What it holds | Why | When it goes |
|---|---|---|---|
kaizenproof.draft.v1 (local storage) | the text and numbers you typed in the report box, before they are saved | so that nothing is lost while you sign in | when the friction is saved. It stays in this browser if you sign out without saving it. Clear the box or your browser's site data to remove it |
kaizenproof.signinEmail (local storage) | the email address you asked a sign-in link for | to finish the sign-in when you open the link | when the link is used |
kaizenproof.returnTo.v1 (local storage) | the check-in or invitation page to return to after sign-in | to bring you back to it | read once and removed; ignored after one hour |
kaizenproof.rail (local storage) | the value "1" | page layout for signed-in users | at sign-out |
kaizenproof.newStandardDismissed (local storage) | the id of the last "new standard" notice you closed | so that the notice does not come back | when you clear your browser's site data |
| Firebase Authentication session (IndexedDB) | your sign-in tokens, user id, email, name and photo address | to keep you signed in | at sign-out |
Signing in with Google opens Google's own sign-in pages, which use Google's cookies under Google's policy.
The kp_locale cookie, the kp_currency cookie, the kp_consent cookie and the browser storage items are needed for a feature you asked for (or to remember your choice about cookies), so we do not ask for consent for them. The Google Analytics and Microsoft Clarity cookies are not; they are set only with your consent, as above.
12. Children
KaizenProof is a tool for organisations and their staff. It is not intended for children, and we do not knowingly collect children's data.
13. Security
What we do today: each workspace's data is separated from every other on the server, and the browser has no direct access to the database. Data is encrypted in transit and at rest by Google Cloud's defaults. Deleting an account or a workspace requires a recent sign-in. Our logs hold ids and counts, not your text or email. No system is perfectly secure; if a breach affects your data, we will act as the GDPR requires. We hold no security certification.
14. Changes
We will publish changes here with a new date and version.
15. Contact
Capital AI Srl, P.IVA 13856590966: vincent@capital-ai.eu.