Capila Trip

GDPR overview

Implementation is specific and documented. Capila, s. r. o., Bottova 2/A, 811 09 Bratislava — Staré Mesto, claims compliance with Regulation (EU) 2016/679 and Slovak Act No. 18/2018 Z. z.; the three legal documents carry an effective date of 29 April 2026. No Data Protection Officer is appointed — the notice states the Article 37 obligation does not apply to it — and privacy requests go to info@capila.io. Rights under Articles 15 to 21 are enumerated, with a 30-day response window extendable by two months, and the supervisory authority named is the Úrad na ochranu osobných údajov SR in Bratislava. Transfers to Anthropic and Stripe rest on Article 46(2)(c) standard contractual clauses or the EU-US Data Privacy Framework (decision (EU) 2023/1795). Every paying customer signs a negotiable DPA aligned with the 2021 EU clauses; a RoPA, a transfer impact assessment and a retention policy sit in the Trust Centre.

Who owns the data?

The terms of service (art. 06) state that everything a customer or its users upload into Capila Trip — travel orders, expense reports, receipts, attachments and approval records — remains the customer's property. Capila, s. r. o. acts as a processor under Article 28 GDPR and handles that content on the customer's instructions. The privacy notice (art. 05) keeps the customer as controller of application data, so an employee asking about their own records goes to their employer first; Capila is controller only for site visitors, users, prospects and client contacts. Data can be exported in a structured, machine-readable format at any time, and on termination the export is free and prompt before deletion follows the published retention policy.

Reuse rights

Customers keep full reuse rights over their own content: a structured, machine-readable export is available at any time and needs no permission from the vendor. Capila's own processing is pinned to named legal bases (privacy art. 03): performance of the contract, Slovak accounting and VAT obligations under Acts 431/2002 and 222/2004, legitimate interests covering security, rate-limiting, the audit trail, the AI audit agent and product improvement, and consent for the newsletter and cookies. Receipt content is sent to Anthropic on an EU endpoint for structured extraction, and to Mindee in France as a fallback above €500 or on low confidence; the notice states that providers do not use the content for model training. Direct marketing is limited to existing customers about services already supplied. In the opposite direction, the terms (art. 03) forbid reusing the site's own content as LLM training data, invoking Article 4(3) of Directive (EU) 2019/790 and § 35(4) of the Slovak copyright act.

Data retention & training

Hosting summary

The data sits in the European Union. Database and file storage run on Supabase (Pro plan) in eu-central-1, Frankfurt; the application runtime, CDN and WAF are Cloudflare with EU placement, and the privacy notice also names Vercel for runtime. Error monitoring uses an EU-hosted Sentry project with personal-data scrubbing, transactional email goes through Resend in its EU region, and the marketing site is measured with cookieless Plausible in the EU. The site's FAQ sums this up as EU only, on Supabase Pro in eu-central-1. Two flows cross that perimeter under a transfer regime rather than staying inside it: receipt OCR runs on Anthropic's EU endpoint, with Mindee in Paris as the fallback above €500, and payments run through Stripe. Transfers outside the EEA are covered by standard contractual clauses or by the EU-US Data Privacy Framework. The full subprocessor list, with each party's role and location, is published in the Trust Centre, and the vendor commits to 30 days' notice and a customer right to object before adding or replacing any subprocessor.