Privacy, without the fog.

1. At a glance

• Local scans, recognized text, and supported Apple Intelligence results stay in Kapier's storage on your iPhone unless you choose a connected feature. Manual folders and Smart views work locally.
• Creating an account sends account information to our authentication provider. It does not upload your local archive by itself.
• When document chat is available, sending a question shares the question, recent conversation, and relevant passages from already processed cloud letters with our AI services. Chat does not upload local-only letters or include documents stored only as backups.
• Cloud backup stores selected files and text encrypted at rest. To create its search index, it also sends readable text chunks to Cloudflare Workers AI and stores the resulting vectors separately. The design is server-readable, not zero-knowledge storage.
• Cloud intelligence sends selected document pages for OCR and sends recognized text to an AI model for an informational summary. If you enable it by default, each new scan is processed online instead of using on-device OCR or generation until you turn that setting off.
• Pro automatic organization is on by default and can be disabled. Folder and Smart-view metadata is synchronized only for documents already connected through backup or Cloud intelligence.
• We do not sell personal data, serve behavioral advertising, or use Kapier data for cross-app tracking.

Cloud intelligence is not yet enabled for general production use. This policy describes the connected service chain prepared for the launch version, which will remain unavailable until launch checks are complete.

2. Who is responsible

The controller responsible for Kapier under the General Data Protection Regulation (GDPR) is:

3. Data we process

Local mode

Kapier stores captured page images, document titles, recognized text, summaries, possible action items, mentioned dates, and app settings locally on your device. It also keeps folder assignments, whether you manually locked a folder, supported deadline indexes, and open-action counts in a separate local archive index. Kapier does not receive that content in local mode. Your operating-system settings, including Apple device backups, may separately copy app data under Apple's terms.

Account and sign-in data

If you create an account, we process your email address, account ID, authentication records, session information, and any name you choose to provide. If you use Sign in with Apple, Apple supplies a unique identifier and, when you allow it, your name or email address.

Connected AI agents, when available

If you authorize an AI agent, it can read your current and future Cloud intelligence letters, extracted text, summaries and page previews. Local-only letters and documents stored only as backups are excluded. Vercel hosts the authorization and MCP service and transiently handles requested content; our Cloudflare Worker checks access and decrypts it. We store connection identifiers, consent, usage counters and access timestamps to enforce and revoke access. Your selected agent provider receives requested content under its own privacy and retention terms. Disconnecting stops future access but cannot remove copies already received by that provider. You can disconnect in Kapier Settings.

Connected document data

If you enable backup or Cloud intelligence, we may process the page images you select individually or capture while the default is on, document metadata, recognized text, language, page structure, and generated results. Results can include a title, summary, possible action items, dates, amounts, identifiers, warnings, uncertainty, and evidence references to the original pages.

For a document already connected through backup or Cloud intelligence, Kapier may synchronize its archive index. The folder, supported deadline list, and open-action count are stored with Kapier's application-layer encryption. Account and local document identifiers, assignment source, manual-lock state, taxonomy and classifier versions, encryption metadata, and timestamps remain service-readable so the Worker can enforce ownership, conflict, and synchronization rules. Purely local document organization is not uploaded.

Automatic organization uses Apple Foundation Models on supported devices for local-mode documents. Cloud-intelligence documents can receive an evidence-validated folder suggestion from the same model request used to create their summary; Kapier does not make a second cloud AI request just to choose a folder. Manual folder choices, including Unsorted, are locked against later AI changes.

The Cloud intelligence default is stored per signed-in account on the device. It applies only to documents captured after you affirmatively enable it and does not upload the existing local archive. While a cloud summary is generated, Kapier may send transient partial output to your device so you can see progress. The validated final result is stored under the retention rules below.

Backup is not passive storage-only. During a backup, Kapier's Cloudflare Worker sends each non-empty recognized-text chunk to Cloudflare Workers AI model BGE-M3 to create a search embedding. The text chunk is then stored with Kapier's application-layer encryption, while the resulting vector and a content hash are stored separately in Supabase. Those vectors remain personal data linked to your account and document.

Official documents can contain sensitive personal data about you or other people. Only use a connected feature for content you are entitled to process. The prepared Cloud intelligence path is not currently approved for special-category data under GDPR Article 9 or criminal-offence data under Article 10. Do not send those documents to Cloud intelligence unless Kapier later identifies the document class as supported. Local mode remains available.

People named in a selected document

A document you select may contain personal data about someone other than the account holder. Kapier receives that data from the user who chose the connected feature, not from the person named. We process it only for the same feature, recipients, and retention periods described in this policy. A person named in a document may contact us about their rights, subject to the account holder's rights and applicable legal exceptions.

Document chat, when available

Chat uses one processed cloud letter or relevant passages across your processed cloud archive. The first question can prepare those letters for search: readable text passages are sent to Cloudflare Workers AI BGE-M3, and search vectors, page offsets, source hashes, and account and document links are stored in Supabase separately from encrypted text. Questions and recent conversation context also pass through Workers AI to find relevant passages. The question, recent conversation, and selected passages are sent through Vercel AI Gateway to the existing GPT-5.6 Luna route to produce an answer with source references. Chat does not repeat OCR, add an external knowledge base, or give access to other users' documents. Replies appear progressively, and completed conversations are saved in encrypted, account-separated storage on your device. You can reopen or delete them from Chat history; they are not synced across devices. Kapier stores usage counters but no chat text in its server database or application logs. Opening an external link in a reply contacts that destination under its own privacy practices.

Purchases and entitlement data

Apple handles payment details. Kapier and RevenueCat receive purchase and subscription records, an app user identifier, entitlement status, transaction identifiers, and limited device or technical information needed to provide and restore paid access. They do not receive your document content for billing.

Operational and support data

Connected services process IP address, request timing, coarse device or app version, account and job identifiers, consent records, usage totals, error classes, and security events. Kapier's application logs and billing records are designed not to include document images, recognized text, document names, summaries, dates, amounts, or identifiers extracted from a document.

If you contact us, we process your email address, message, attachments, and the information needed to answer. Vercel hosts this website and processes ordinary request and security data such as IP address, user agent, requested URL, and timestamps to deliver and protect it. The website currently has no contact form, advertising, or marketing analytics.

4. Why we process data and our legal bases

You can refuse Cloud intelligence and continue using local mode, or turn off its default at any time for future scans. Turning the default off does not cancel or erase processing already started. Deleting the cloud result withdraws future use of the retained result, without affecting processing already completed lawfully. Kapier must establish an appropriate Article 9 or Article 10 condition and matching provider coverage before supporting documents that contain those protected categories in Cloud intelligence.

Manual folders and Smart views remain available without a paid plan. Automatic organization requires an active Pro plan and can be turned off for future documents. Existing assignments remain available if a subscription expires.

Kapier generates informational output but does not make decisions that produce legal or similarly significant effects about you. Summaries can be wrong and are not legal, tax, medical, or financial advice.

5. Service providers and international transfers

We disclose data only where needed to provide a feature you selected, operate and secure Kapier, comply with law, or handle a transaction. Our current providers and their precise roles are listed on the Kapier Subprocessors page.

Connected services use Cloudflare, Supabase, Mistral AI, Vercel AI Gateway, RevenueCat, and a downstream GPT-5.6 Luna inference host. Until that route is pinned, the possible hosts are OpenAI, Microsoft Azure, and Amazon Web Services. Google Workspace handles email sent to our contact address. Apple separately handles App Store purchases, device services, and Sign in with Apple under Apple's own terms.

Some processing takes place outside the European Economic Area, including the prepared AI summary route in the United States. Before such transfers are enabled for general production users, Kapier must confirm an applicable adequacy decision, Standard Contractual Clauses, or another lawful safeguard for the final provider chain. Kapier does not currently promise EU-only inference or zero data retention.

We may disclose the minimum necessary data when required by law, to protect users or the service, or as part of a corporate transaction with appropriate confidentiality and notice where legally required.

6. Retention and deletion

• Local content remains until you delete it or remove app data.
• Account and profile data remains while your account is active and for any limited period needed to complete deletion or meet law.
• Encrypted backups, linked search embeddings, and completed cloud results remain until you delete the relevant cloud copy, document, result, or account.
• Encrypted archive-index entries remain while a connected document copy exists. Deleting the last connected copy removes its remote index; the local folder remains until you delete the local document. Deleting a Cloud intelligence result clears its AI folder suggestion unless you manually chose a folder.
• Decrypted page bytes and raw provider responses are not intentionally stored by Kapier after the active processing step.
• Completed chat conversations are saved in encrypted storage on this device, separately for each account. You can reopen or delete them from Chat history. New chat and signing out preserve saved chats; another account cannot view them in the app. History does not sync across devices. Deleting your account from this device also removes its saved chats. Removing a source letter does not remove quotations already saved in a chat. Unfinished response drafts are temporary. Kapier does not save a server transcript. Search vectors and page offsets are removed when their source cloud result is deleted. Content-free chat quota counters remain while the account exists; provider retention rules still apply to requests already sent.
• Abandoned uploads and sources for cancelled or permanent failures are scheduled for deletion after 24 hours. Retryable-failure sources may remain for up to 30 days.
• Failed or cancelled attempt metadata remains for 30 days; content-free security and operational events remain for 12 months.
• Billing usage is retained for the applicable accounting period; Kapier's current engineering period is seven years.

User-triggered cloud deletion disappears from product reads immediately and is designed to finish durable cleanup within 24 hours. Providers may keep limited request content or security records under their own documented retention periods; the current AI chain is not configured for zero data retention.

7. How we protect connected data

We use transport encryption, access controls, private object storage, encryption at rest, server-side ownership checks, rate and spend limits, provider kill switches, and content-minimized operational logging. Connected document encryption is intentionally readable by authorized Kapier services when needed to provide the selected feature. No system is perfectly secure, and we do not describe this design as end-to-end or zero-knowledge encryption. Backup search vectors and their content hashes are stored separately from the encrypted text and are not covered by Kapier's application-layer document encryption.

8. Your choices and rights

Product controls

• Use local mode without an account.
• Keep backup disabled or disable it for a document.
• Move any document to a curated folder or Unsorted, and turn Pro automatic organization off for future scans.
• Decline Cloud intelligence for a document, or turn off its default for future scans in Settings.
• Delete a cloud result or cloud document copy.
• Manage or cancel subscriptions in your Apple account settings.
• Contact us to request account deletion or exercise a privacy right.

Data-protection rights

Depending on the law that applies, you may request access, correction, deletion, restriction, or portability of your personal data, and object to processing based on legitimate interests. Where processing relies on consent, you may withdraw it at any time for the future. We may need to verify your identity before acting on a request.

You may also complain to a supervisory authority. For our Berlin establishment, the competent authority is the Berliner Beauftragte für Datenschutz und Informationsfreiheit. You may instead contact the authority where you live or work.

9. Children

Kapier is not directed to children under 16. If you believe a child has created an account or sent personal data without appropriate authorization, contact us so we can investigate and delete it where required.

10. Changes to this policy

We will update this page when Kapier's data practices materially change and will revise the date at the top. When a change requires notice or renewed consent, we will provide it in the app or through an appropriate contact channel before the change applies.

11. Contact

For privacy questions, access or deletion requests, or concerns about a connected document, email contact@nestorcodecrafters.com. Please do not attach a sensitive document unless we specifically ask for it through an appropriate support process.