Privacy policy

Capsaria ("we", "us") provides museum collection software sold to museums and similar organisations (a "museum" or "customer"). This policy covers two different kinds of information, because they are not the same thing.

Your museum's records

The objects, people, gifts and other records a museum enters into Capsaria belong to that museum. We hold and process them on the museum's behalf and do not read, use or share them except to provide the service, fix a problem the museum reports, or comply with the law. We do not sell this data, to anyone, ever.

A museum can export its complete collection at any time, in full, free, including the day it leaves. That promise is not new for this policy; it is how the product is built.

Staff account information

Signing in to Capsaria uses a magic link: we ask for a name and an email address for each staff or volunteer account a museum creates, and we send a one-time sign-in link to that address when asked. We keep a record of who signed in and when, and of who read or changed a sensitive record, because that log is a stated feature of the product, not analytics collected about you.

We do not run advertising trackers, third-party analytics scripts, or behavioural profiling of any kind on Capsaria or on this website.

We count public catalogue page and data responses, searches and download responses in aggregate. We do not keep visitor profiles, tracking identifiers, search text, IP histories or full referrers for these counts. Daily totals are kept for 90 days, then monthly totals for up to 13 calendar months. Traffic categories and popular-record counts are approximate.

We also count signed-in Help openings by broad work screen and UTC day for up to 90 days. For run briefings, we count refused save attempts, further attempts after a refusal in the same open page, and accepted saves after a reported return from Help. A tab-local Help marker expires after 30 minutes and contains only a fixed screen label and opening time; it is cleared after an accepted save. These best-effort signals do not establish completion of a particular task or a newly recorded fact. These counts contain no person, museum, session or record identifiers, page addresses or entered text. Authorized support staff use them to choose workflows to review; opening Help does not show whether work was completed.

What a person can see is not a setting anyone maintains. It is worked out on every request from the engagements a museum has recorded — an employment, a volunteer agreement, a board term — so it narrows the day one ends, without anyone having to remember to remove an account.

Who else sees it

Support replies are visible to the conversation's permitted participants and authorized Capsaria support staff.

A small number of infrastructure providers process data on our behalf so the service can run: server hosting and the database (Scaleway, in the EU), file and image storage and delivery (Bunny), and email delivery (Infobip). Emails that notify you of a support reply include the reply text, museum name and a conversation link that requires sign-in. We keep attachments and staff-only notes out of those emails. None of these providers may use museum data for their own purposes.

One recipient works only when a museum asks it to. A museum can switch on an authority and have Capsaria check its own record of a person against that authority's records; that check sends the names being matched, and nothing else, to the authority the museum chose. No authority is on by default, and a museum that switches none on sends no one's name anywhere.

If you contact us before signing up

If you write to us to ask about Capsaria before your museum has an account, we keep your name and email only to reply to you and, if you agree, to follow up about the product. You can ask us to delete that at any time.

The file you import from

A file you upload to bring your catalogue in is kept for 7 days, so an import that stopped part way can be run again without a second upload. After that it is deleted. Your records stay; the file they came from does not.

Keeping it safe

Sign-in is by a single-use, time-limited link rather than a password: the link is deleted the moment it is used, and an unused one stops working. Signing out ends that session immediately, and ending someone's engagement ends theirs. Traffic to Capsaria is encrypted in transit. Access to a sensitive record is logged against the person who read it, not a shared account.

Deleting your data

You can export everything at any time — objects, people, gifts and transactions — as spreadsheets and as machine-readable data. It is free, it is complete, and it does not depend on your account being in good standing.

We do not yet delete a museum's records automatically when an account ends. We would rather say so than name a timetable we do not keep. If you want your records removed, write to us.

A request from one person to be forgotten is a different thing, and it is built. We remove that person's own details and keep the shape of the record, so a gift stays counted without naming who gave it. Where the law requires us to keep something for a period — a tax receipt, for instance — the request is recorded and held until that period ends, and it comes back to us for completion on the day it does.

Changes to this policy

If this policy changes, we will update the date at the top of this page. We will not narrow a museum's rights over its own data without asking first.

Applicable law

Capsaria is operated by Rockieweb Industries Inc. from Red Deer, Alberta, Canada. Your personal information is protected under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and British Columbia's Personal Information Protection Act (PIPA), and our commercial electronic messages comply with Canada's Anti-Spam Legislation (CASL). Our hosting infrastructure is in the EU, so we also comply with the GDPR where it applies.

Contact

Rockieweb Industries Inc. (operating as Capsaria) · Red Deer, Alberta, Canada · Email: privacy@capsaria.com