Privacy policy

Who we are

Caspian BV ("we") operates Caspian and getcaspian.io. We are a Belgian company, registered under number 1042.322.507, at Brusselsesteenweg 6, bus 104, 9050 Gent (Gentbrugge), Belgium. For privacy questions or deletion requests, write to hello@getcaspian.io.

We act as controller for our website, business correspondence and account administration. When we synchronize an organization's Google Workspace data, we process that data on the organization's behalf to provide its Caspian workspace. The organization controls who connects the integration and who may access its workspace data.

Website data we collect, and why

The work email you leave on the start page. We use it to contact you about setting up Caspian — that first conversation is the whole purpose of the form. The legal basis is your consent, given by submitting the form; withdraw it at any time: tell us, and we delete the address.

When you sign up, we send you a welcome email, and we look up your name, job title, company and work phone number in Apollo.io, a business contact database, so we can reach you about the setup you started. The legal basis for the lookup is our legitimate interest in following up on your signup. You can object at any time: tell us, and we delete what the lookup added.

When you create a workspace, we record in Attio, our CRM, your name and work email, the workspace name, and how far setup has got: the dates the workspace was created, your identity provider was connected, the first sync finished and the first item was opened. We use this to help you finish setting up and to follow up on your trial. The legal basis is our legitimate interest in following up on your signup; you can object at any time.

If you sign up with a company address, we use it once more to send you a Slack Connect invite to a channel shared between your company's Slack workspace and ours. Only people from your company and Caspian are let into that channel. Picking Microsoft Teams opens a chat on your side; we send nothing extra.

If you book a demo, Calendly handles the booking under its own privacy policy, and we receive the details you enter there.

Email you send us, which we keep as ordinary correspondence.

Technical server logs (IP address, request, user agent) that our hosting provider keeps for a short period to run and secure the site. We also count visits per page from these logs, in totals only, without identifying anyone. The legal basis is our legitimate interest in operating and improving the site.

Website tracking

This site sets no analytics, advertising or tracking cookies. It runs one third-party script, Snitcher (Netherlands), in cookieless mode: Snitcher looks up which company an IP address belongs to, so we can see which companies visit. It tells us the company and the pages viewed, never who you are, and stores nothing on your device. The legal basis is our legitimate interest in knowing which companies show interest in Caspian. You can object at any time by emailing us. There is no consent banner because nothing is stored on your device.

When you download the Caspian app from a link with campaign tags (for example utm_source=linkedin), we keep a one-way hash of your IP address together with those tags for 7 days. We never keep the IP address itself. The only use is to learn which campaign led to a new Caspian account: if a workspace is created from the same address within 7 days, it takes the tags and the hash is deleted. Downloads without campaign tags keep nothing. The legal basis is our legitimate interest in knowing which campaigns work. You can object at any time by emailing us.

Website service providers

Form submissions land in Attio, our CRM, and a notification with your email reaches our team's Slack workspace. Resend sends our welcome email from the EU, and Apollo.io (USA) provides the contact lookup, and Snitcher (Netherlands) identifies visiting companies. The site is hosted on Amazon Web Services in the EU; our email runs on Google Workspace. These providers process data on our behalf under data processing agreements, and transfers outside the EEA are covered by the European Commission's standard contractual clauses. We never sell personal data, and nobody else receives it.

Website retention

A lead's email stays in our CRM while the conversation is live. If nothing comes of it, we delete it within 24 months of last contact — sooner if you ask. Server logs rotate away within 90 days.

Connecting Google Workspace

An authorized Google Workspace administrator connects Caspian Connector through Google's OAuth consent screen. Google supplies the administrator's sign-in identity, email and profile information. We use these to identify the connecting account and organization. Connector credentials let us synchronize the authorized organization without requiring a new sign-in for every sync.

The integration serves IT administrators: it brings employees, groups, company email domains, connected applications, their permissions and available audit history into one organizational inventory. Google directory and audit data can identify individual employees and actors. They are not anonymous device telemetry.

Google employee directory

With admin.directory.user.readonly, we read employee identifiers, names, business email addresses and available directory attributes, such as organization information and account status. We use these to populate the Users inventory, identify the connected organization, check the consenting administrator and associate application authorizations with the right employee.

Google groups and memberships

With admin.directory.group.readonly, we read group identifiers, names, email addresses, members and membership roles. We show a user's group memberships as organizational context in the user details. Group membership by itself does not prove that someone has access to a third-party application.

Application authorizations and permissions

With admin.directory.user.security, we read which applications users have authorized, their application identifiers and the OAuth permissions they received. We show these in Connected apps and application details so IT can understand which applications may access company Google data. Where an authorized administrator requests supported remediation, this permission also permits revoking the selected application authorization. It does not mean we change permissions automatically during inventory sync.

Google does not offer a narrower read-only scope for the API endpoint listing these authorizations. Permissions shown for another application belong to that application's Google authorization. They do not give Caspian access to that application's data or establish an administrator-managed application assignment.

Company email domains

With admin.directory.domain.readonly, we read the connected Google organization's domains and domain aliases. We show company email domains in workspace settings and use them to distinguish company email domains from external domains. Google's consent wording about customer domains refers to the connected Google Workspace organization, not to a list of that company's customers.

Google audit history

With admin.reports.audit.readonly, we read available OAuth authorization and revocation events, Google login events and SAML events. Records may include event identifiers, timestamps, actors, application information and technical parameters supplied by Google, including IP addresses, user agents or event status when present. We use these for application discovery, relevant observed activity and dated authorization history in application timelines.

An authorization event means that a user granted an application permissions. It is not proof of using that application. We do not turn authorization dates into a Last used value. We do not request Gmail message-content or Google Drive file-content permissions for this connector.

Google data storage and security

We store source records and derived inventory and history records associated with the connected Caspian workspace. Connector refresh credentials are encrypted when stored. Access through product features is subject to workspace access controls. We use this data to provide the features described above, not to advertise to employees, sell their data or assess their creditworthiness.

Product service providers and AI

Our product uses Amazon Web Services for hosting, storage, backups, authentication (self-hosted in AWS) and Amazon Bedrock AI processing. Cloudflare provides DNS only; no product traffic or customer data passes through it. Google Workspace supports our business email and support correspondence. Our public trust center lists these subprocessors and their processing locations. Product hosting, authentication and Bedrock run in the EU (AWS Frankfurt); Google Workspace may process data in the EU and the USA. The website provider list above is not a list of recipients of synchronized Google product data.

When you use Caspian's AI chat, your messages and relevant workspace data returned by authorized tools may be processed by Amazon Bedrock to answer your request. This can include Google-derived inventory or audit information available to you. We do not use Google API data to train general-purpose AI models. AI processing is for the user-facing product feature, not an unrelated use of your Google data.

We share Google-derived data only as necessary for the user-facing features you authorize, to protect security, to comply with applicable law, or in another circumstance allowed by Google's Limited Use requirements. Human access is limited to those requirements, including your explicit consent for particular data, security investigation, legal obligations, or permitted internal operations using aggregated and anonymized data.

Caspian subprocessors and processing locations

Disconnecting and deleting Google data

Disconnecting Google Workspace in Caspian removes the locally stored refresh credential and stops future connector synchronization. It does not itself revoke Caspian's authorization at Google or erase previously synchronized inventory and audit history. You can also remove Caspian's authorization through Google's account or Workspace administrator controls.

Synchronized records are retained to provide your workspace inventory and history until the organization requests deletion or the applicable customer agreement requires their removal. The audit collection lookback window is not an automatic deletion deadline. To request deletion of stored Google data, contact hello@getcaspian.io and identify the relevant organization. We verify your authority before handling organizational data requests.

Deletion of active workspace records and expiry of protected backup copies are separate processes. Backup copies can remain until the applicable backup lifecycle expires. Where a legal obligation requires retention, that obligation can limit deletion. Disconnecting or removing authorization at Google does not replace a request to delete data already stored by Caspian.

Anonymous statistics and the software catalogue

From the data in customer workspaces we build two things that contain no personal data: a shared catalogue of software applications (their names, domains and vendors, with nothing about people) and statistics about software use, such as how many organizations use an application. We publish or use a figure only when at least five different customers contribute to it, and never a figure about a single customer.

We decide why and how this is done, so we are the controller for it. We process workspace data for this only as far as needed to produce the anonymous result. We do not sell the catalogue or the statistics, and we do not try to identify any person or customer from them. Information received from Google APIs is used for this only as the Limited Use requirements below allow. The data processing agreement describes the same commitment in section 3.4.

Google API Limited Use

Caspian's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Google API Services User Data Policy

Your rights

Under the GDPR you can ask for access to, correction of, deletion of, or a copy of your personal data, restrict or object to its processing, and withdraw consent at any time. One email to hello@getcaspian.io does it. You can also complain to your data protection authority, though we’d rather hear from you first.

For data your employer or another organization controls in its Caspian workspace, you can also contact that organization directly. We assist its authorized instructions for data-subject requests. Removing OAuth authorization stops future authorized Google API access; it does not automatically delete stored records.

Changes

When this policy changes, the date above changes with it. A material change to what we collect will be visible on this page before it applies.