CapVM
CapVM Privacy Policy
Written for the Swiss Federal Act on Data Protection (revFADP, in force since 1 September 2023) and, where it applies (Art. 3(2) GDPR, when we offer services to people in the EU), the EU GDPR. Effective date: 24 October 2026. Last updated: 24 October 2026.
Controller
MAKERSCLUB Molina (sole proprietorship, owner Xavier Molina, UID CHE-464.283.334), Thunstrasse 124, 3074 Muri bei Bern, Switzerland. Contact: hello@capvm.com. This policy covers data we process as controller. For personal data that you put on your machines we act as your processor under the Data Processing Agreement.
What we collect
- Account: name, business email, company name, VAT ID (optional), country.
- Payments: handled by Stripe. We receive the payment status, the last 4 card digits, the country and the amount, never the full card number.
- Usage: API calls, machine IDs, start and stop times, machine type, cost, IP addresses, key IDs and the agent's user-agent string.
- Security logs: request logs, abuse signals and network metadata, and metadata about commands sent to machines through the API or MCP exec function (time, duration and exit code, not the command text).
- Website: capvm.com sets no cookies and uses no analytics. Your light or dark theme choice is stored only in your own browser and is never sent to us. Fonts and styling are served from our own hosting, so no third party receives your visit. Our hosting provider (AWS CloudFront) processes your IP address briefly to deliver the page.
- Waitlist: your email address, the time you signed up, your browser's user-agent string and the referring page. We do not store your IP address with your signup. Waitlist data is stored in AWS DynamoDB in Zurich (eu-central-2).
- Machine contents: stored only on your temporary machine and deleted when it is destroyed. We don't read them in normal operation.
Why we use it (purpose and legal basis)
- To provide the service and bill you (contract; Art. 6(1)(b) GDPR).
- To prevent fraud and abuse, and secure the service (legitimate interest; Art. 6(1)(f) GDPR).
- To meet tax and bookkeeping rules, which require us to keep invoices and ledger records for 10 years (legal obligation; Art. 958f CO; Art. 6(1)(c) GDPR).
- To send service emails (contract). Marketing emails only with your consent (Art. 6(1)(a) GDPR), and you can unsubscribe anytime.
Under the Swiss FADP no legal basis is required, but we process data only in line with its principles (Art. 6 FADP).
Automated decisions: payments are screened by Stripe's fraud tools, and accounts may be limited automatically when abuse signals are detected. If such a decision affects you, you can ask for a review by a person and give your view (Art. 21 FADP; Art. 22 GDPR).
Who receives it (processors)
- Amazon Web Services EMEA SARL: hosting in Zurich (eu-central-2).
- Stripe Payments Europe: payments and VAT calculation. For some purposes (for example fraud prevention and meeting financial regulation) Stripe acts as an independent controller; see Stripe's privacy policy.
- Amazon Web Services (Amazon SES, Ireland, eu-west-1): sending and receiving email. Incoming mail to our addresses is kept for 90 days, then deleted.
- Authorities, if the law requires it. Some recipients are in, or may access data from, the EU/EEA and the United States. The EU/EEA has an adequate level of protection recognised by the Swiss Federal Council. For the US, we rely on the Swiss-U.S. Data Privacy Framework where the recipient is certified, and otherwise on the EU standard contractual clauses as recognised by the FDPIC, with the Swiss amendments (Art. 16 para. 2 let. d FADP).
How long we keep it
- Account data: while the account exists, plus 1 year.
- Invoices and ledger: 10 years.
- Security logs (including exec metadata): 12 months, longer only where needed for a specific abuse case or legal claim.
- Machine contents: deleted when the machine is destroyed.
Your rights
You can ask for access, correction, deletion, data portability or restriction, and you can object, by writing to hello@capvm.com. We reply within 30 days. You may complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC, www.edoeb.admin.ch), or, if the GDPR applies, to the supervisory authority in your EU country.
Security
Encryption in transit, isolated machines, scoped access keys and an append-only billing ledger. We will notify the FDPIC and affected users of breaches as the law requires.