1. Introduction
Captivo Labs (“we,” “us,” or “our”) operates middleware software that connects RingCentral telephony with legal practice management software. This Privacy Policy explains how we collect, use, store, and protect information when you use our RingCentral App Connect integrations (“the Service”). We are committed to handling your information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). If you have questions about this policy, please contact us at privacy@captivolabs.com.2. Who This Policy Applies To
This policy applies to:- Users — individuals who install and use the Service (lawyers, paralegals, and other legal professionals)
- Firms — law firms and legal practices whose staff use the Service
3. Information We Collect
3.1 Information you provide directly
When connecting the Service to your accounts, we collect:- Your name and email address as provided by your practice management software
- Your RingCentral account and extension identifiers
- Authentication credentials (OAuth tokens) for RingCentral and your practice management software — stored encrypted, never stored as plaintext
3.2 Information collected automatically through the Service
When the Service is active, we process the following in order to provide its core functionality:- Call metadata — phone numbers, call direction (inbound/outbound), call duration, call timestamps, and call outcome
- Call recordings — recording URLs provided by RingCentral, and optionally the recording files themselves if your configuration stores them
- AI-generated content — call transcripts and summaries generated by RingCentral’s RingSense feature, where your RingCentral account is licensed for this
- Contact information — names, phone numbers, and matter/case identifiers retrieved from your practice management software in the course of matching calls to contacts
- Call notes — notes entered by users during or after calls
- Activity log identifiers — identifiers of activity records created in your practice management software
3.3 Information we do not collect
We do not collect:- The content of calls (audio) beyond what is stored in your RingCentral account
- Financial information — payment processing is handled entirely by Stripe and we do not see or store card details
- Information about your clients beyond what is necessary to match calls to contact records in your practice management software
4. How We Use Your Information
We use the information we collect solely to provide and improve the Service. Specifically: 4.1 Providing the Service- Matching inbound and outbound calls to contact records in your practice management software
- Creating and updating call activity logs in your practice management software
- Storing call notes, recordings, and AI summaries against the correct matter file
- Authenticating your accounts with RingCentral and your practice management software
- Managing your firm’s subscription and billing (via Stripe)
- Enforcing licence validity per user
- Responding to support requests
- Monitoring for unauthorised access or abnormal usage patterns
- Maintaining audit logs of system access
- Analysing aggregated, de-identified usage patterns to improve the Service
- Diagnosing and resolving technical issues
5. Legal Basis for Processing
We process your information on the following bases:- Contractual necessity — processing necessary to deliver the Service you have subscribed to
- Legitimate interests — security monitoring, fraud prevention, and service improvement, where these do not override your privacy interests
- Legal obligation — where we are required to process or retain information by Australian law
- Consent — where you have explicitly consented, such as enabling optional features
6. How We Store and Protect Your Information
6.1 Location All data is stored on servers located in Australia (Sydney region, AWS ap-southeast-2 and Supabase). We do not transfer your data outside of Australia without your explicit consent, except as described in Section 7 (Third Parties). 6.2 Security measures We implement the following security measures:- All authentication tokens are encrypted at rest using AES-256 encryption
- All data in transit is encrypted using TLS 1.2 or higher
- Database access is restricted to application services within a private network
- Access credentials are managed using secrets management services and are not stored in source code
- Access to production systems is restricted to authorised Captivo Labs personnel
- Active data is deleted within 30 days of termination request
- Backup data is purged within 90 days
- We may retain records required by law for longer periods where legally obligated to do so
7. Third Parties We Share Information With
We do not sell your data. We share information with third parties only to the extent necessary to provide the Service:| Third Party | Purpose | Data Shared | Location |
|---|---|---|---|
| Stripe | Payment processing and subscription management | Firm name, email, billing details | USA (covered by Stripe’s data processing agreement) |
| Supabase | Database hosting | All application data | Global |
| Fly.io | Application hosting | All application data processed in transit | Global |
| Cloudflare | Edge networking and DDoS protection | Request metadata | Global edge network |
| RingCentral | Telephony platform | Call metadata as required for the integration | As per RingCentral’s privacy policy |
| Your practice/contact management software (Filevine, Smokeball, etc) | Integration target | Call logs, contact lookups as required for the integration | As per each platform’s privacy policy |
8. Legal Professional Privilege and Confidentiality
We understand that law firms handle privileged and confidential client information. With respect to this:- We process client contact information and call metadata only to the extent necessary to match calls to matter files and log activities
- We do not analyse, mine, or use client information for any purpose beyond delivering the Service
- We do not disclose client information to third parties except as described in Section 7 or as required by law
- We recommend firms review their professional obligations under applicable legal profession rules before deploying the Service and satisfy themselves that use of the Service is consistent with those obligations