Privacy notice
This notice explains how Capifold processes personal data when you search, use a provisioned account or appear in publicly available directory information.
1. Controller and contact
The controller is Entwicklerherz GmbH, Am Hauptbahnhof 16, 60329 Frankfurt am Main, Germany, represented by managing director Elton Marku. Please use the email address below for privacy enquiries and to exercise your rights.
This notice covers Capifold. Linked services operated by other providers and their data processing are subject to their own privacy notices.
2. Visiting, searching and comparing
You can use the public directory without an account. Accessing our website or interfaces involves processing technically necessary connection data, including your IP address, time, requested URL, HTTP status, and browser and device information to the extent transmitted. Hosting and security services may create operational and security logs from this information.
Search terms and filters are sent to our API to answer your request. Search terms may also appear in the page address, browser history and technical access logs. Do not enter passwords, access keys or confidential personal data in the search. Opening a listing does not run the agent it describes.
The legal basis is Article 6(1)(f) GDPR. Our legitimate interests are providing a working search service, maintaining stability and detecting and preventing abuse. The connection data required to deliver the website must be processed for it to be accessible.
3. Publicly available directory information
Capifold imports descriptions and metadata from public MCP registries, A2A agent cards, OASF datasets, related repositories and manifests supplied by providers. The specific source and available version information are identified in the listing. This material may include names, business contact details, profile and repository addresses and other personal information published by the source.
We process this information to make capabilities discoverable and comparable and to explain their provenance. Listings, source information and version references are displayed publicly and made available through our search interfaces. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is a traceable, current directory of publicly offered capabilities.
Public availability does not permit unrestricted reuse of personal data. You can report incorrect information, request correction or erasure, and object on grounds relating to your particular situation. Please identify the listing. We also assess stored source versions and import histories; previous publication does not remove your rights.
4. Accounts, sign-in and passkeys
We use Supabase Auth for provisioned accounts. Data processed includes email address, user identifier, authentication information, sign-in and security metadata, and assigned organisations and roles. For password sign-in, Supabase processes the password for verification and stores a password hash. Capifold currently does not offer open self-registration.
Passkey sign-in processes a credential identifier, a public key and technical information about the authentication method. The private key remains with your authenticator or passkey provider. Fingerprint and facial data are not sent to Capifold. Any cross-device synchronisation by your passkey provider is governed by that provider’s terms.
The web application holds access and refresh tokens in memory only. It does not write them to cookies, localStorage or sessionStorage. Reloading the page therefore requires signing in again. Supabase also processes server-side session information.
The legal basis is Article 6(1)(b) GDPR where processing is necessary for an account agreed with you. For accounts on behalf of an organisation and for access security, we rely on Article 6(1)(f) GDPR; our legitimate interests are authorised collaboration and prevention of unauthorised access. We cannot provide personal access without the necessary account information.
5. Workspaces and explicitly requested actions
Where a workspace is provided to you, Capifold processes memberships, roles, publisher associations, licence and permission information, and actions you explicitly start. This may include job identifiers, status, version references, results, usage journals and technical information such as input length or an input hash. Access depends on workspace permissions.
Public search does not send jobs to third-party agents. When you explicitly start an execution enabled for your workspace, the necessary inputs are sent to the configured runtime or designated service. Submit only data you are authorised to process. Making Capifold publicly accessible does not automatically enable third-party runtimes.
The legal bases are Article 6(1)(b) GDPR for agreed services and Article 6(1)(f) GDPR for access control, accountability and security. Where Capifold processes personal content solely on an organisation’s instructions, that processing and the parties’ respective roles are additionally governed by the agreement required for that purpose.
6. Browser preferences and audience measurement
When you select a language or colour theme, Capifold saves that choice locally in your browser as capifold.language or capifold.theme. These values serve only your chosen presentation. Without an explicit selection, the application does not persist these preferences.
Storing and reading a presentation you request is based on section 25(2), point 2, TDDDG. Where personal data is involved, Article 6(1)(f) GDPR applies, with the legitimate interest of providing your chosen presentation. You can remove these values through your browser’s site-data settings. See our cookies and browser storage notice for details.
Capifold currently includes no advertising pixels or services for tracking audiences across visits. Interface fonts and images are served through our website. Operational and security logs generated by our hosting services are separate from this.
7. Contacting us
When you contact us, we process your sender details, message and any attachments to handle your enquiry. Please avoid unnecessary confidential information. The legal basis is Article 6(1)(b) GDPR for contractual enquiries, Article 6(1)(c) GDPR for legal duties, particularly data subject requests, and otherwise Article 6(1)(f) GDPR, with the legitimate interest of handling communications appropriately.
8. Recipients, hosting and international processing
Vercel Inc., United States, provides hosting, delivery and technical infrastructure. Supabase provides the database and authentication. Our Supabase instance uses Frankfurt as its primary project region. According to Supabase, for our Vercel Marketplace integration the primary contracting entity is Supabase Inc., United States, supported in operations and support by Supabase Pte. Ltd., Singapore.
A European database region does not mean exclusively European processing. Global delivery, operational metadata, support and subprocessors in particular may involve processing outside the European Economic Area. The providers describe safeguards including EU Standard Contractual Clauses under Article 46 GDPR. You can request information and a copy of the applicable safeguards from us; the provider documents below explain their mechanisms.
Other recipients may include authorised members of your workspace, service providers involved in handling your enquiry, and authorities or legal advisers where necessary to comply with legal duties or establish, exercise or defend legal claims. Public directory information is also visible to other visitors and API users.
Vercel: privacy and international processing
Vercel: data processing and Standard Contractual Clauses
9. Retention
Retention depends on the purpose and any statutory retention duties. Account data is needed while access remains active; after access ends, we assess erasure or restriction unless legal duties, outstanding matters or legitimate claims require retention. For public directory data, the relevant criteria are accuracy, an ongoing connection to the source and the need for version history; valid erasure requests and objections are also assessed for earlier versions.
Operational and security data is processed for troubleshooting, abuse prevention and investigation of specific incidents. Duration depends on the active logging and backup settings of the service used and the incident concerned. There is currently no single automatic deletion period for all Capifold data. You can contact us with a request at any time.
Correspondence is kept until the matter is resolved and, where necessary, for statutory retention or limitation periods. Restricted backup copies are replaced through the applicable backup cycles; they are for recovery, not ordinary use. Local language and theme preferences remain in your browser until changed or removed through its site-data settings.
10. Your rights
Subject to the statutory conditions, you have the following rights. Contact us to exercise them. Where we have reasonable doubts about identity, we may request proportionate verification to protect your data against unauthorised disclosure.
- Access to and a copy of your personal data (Article 15 GDPR).
- Correction of inaccurate data and completion of incomplete data (Article 16 GDPR).
- Erasure and restriction of processing (Articles 17 and 18 GDPR).
- Data portability for automated processing based on consent or contract (Article 20 GDPR).
- Withdrawal of consent at any time for the future, without affecting the lawfulness of processing before withdrawal (Article 7(3) GDPR).
- A complaint to a supervisory authority, particularly in the country of your habitual residence, place of work or the alleged infringement (Article 77 GDPR). The authority for our registered office is the Hessian Commissioner for Data Protection and Freedom of Information.
11. Your right to object
You may object at any time, on grounds relating to your particular situation, to processing based on Article 6(1)(f) GDPR (Article 21 GDPR). This applies in particular to personal information in directory listings. We will stop processing the data concerned unless we demonstrate compelling legitimate grounds overriding your interests, rights and freedoms, or processing is necessary to establish, exercise or defend legal claims.
12. Automated decisions and changes
Capifold does not make decisions about people based solely on automated processing that produce legal or similarly significant effects within the meaning of Article 22 GDPR. Search ranking technically assesses the relevance of directory entries to a query.
We update this notice when processing changes. The date above identifies the current version. Updating this text does not replace any consent that may be required.