In short. You can read the register without telling us anything. If you create an account we store your email address, your plan and your alert settings. Card details go to Stripe, never to us. There are no advertising or tracking cookies, and we do not sell or rent personal data.
1. Who is responsible
CapExempt is an independent project operated from France by its founder, an independent publisher, who is the data controller. Because the operator is established in the European Union, the General Data Protection Regulation (GDPR) applies to everything described here, wherever you live. Contact for any privacy question or request: [email protected].
2. What we collect
| When | What |
|---|---|
| You browse the site | Nothing that identifies you is stored by us. Our hosting provider processes your IP address and browser details to deliver the pages and protect the site, as any web host does. |
| You create an account or sign in | Your email address, the date the account was created, a random referral code, and a session identifier kept in a cookie for 30 days. Sign-in links are stored for 15 minutes. |
| You subscribe | Your plan, its status and renewal date, and the Stripe customer and subscription identifiers that link your account to your payments. Your card number, billing address and tax details are collected and held by Stripe; we never receive the card number. |
| You set an email alert | Your alert preferences (role types, states, keyword, on or off) and, for two days, the date of the last alert sent to you. |
| You use a referral link | The referral code, and for the person who invited you, the fact that a credit was earned (your address appears in the description of their credit in Stripe). |
| You join the waiting list | Your email address, the plan you were interested in, the time, and your browser’s user-agent string. |
| You send a correction request | What you wrote: your role, your email address, the employer concerned, the description of the error and any link you provided. |
| You send forms or sign-in requests | Your IP address is used as a key for rate-limit counters (how many requests came from one connection in the last hour), so that forms cannot be abused. The counters expire after about an hour and are not linked to your account. |
| You write to us | Your message and address, in our mailbox. |
We do not ask for, and do not want, information about your immigration status, nationality, health or any other sensitive matter. Please do not put it in a correction request or an email. We do not build profiles, and no decision about you is made by automated means.
The register itself is about organisations, not people. It is compiled from public government datasets and employers’ public pages.
3. Cookies, local storage and analytics
- No tracking cookies. There are no advertising, social-media or cross-site tracking cookies or pixels on this site.
- Two strictly necessary cookies, set only when you sign in:
ce_s(your session, unreadable by scripts, 30 days) andce_li(a flag that tells the pages you are signed in, 30 days). Signing out deletes both. - Browser storage, which stays on your device: the referral code from a link you followed, a short-lived copy of your account state so that pages load faster, and the fact that you ticked the renewal box during checkout.
- Analytics. Aggregate traffic figures (pages viewed, referring sites, countries) come from Cloudflare Web Analytics, which uses no cookies, does not fingerprint visitors and does not follow them across sites.
- Fonts. The typefaces are loaded from Google Fonts, so your browser contacts Google’s servers and Google receives your IP address when a page loads. No cookie is set.
- The Stripe checkout and billing pages are Stripe’s own and use Stripe’s cookies, described in Stripe’s privacy policy.
Because only strictly necessary cookies are used, there is no cookie banner.
4. Why we use it, and on what legal basis
- To provide the account and the paid plan you asked for (sign-in, access to same-day openings, alerts, billing, referral credits): performance of our contract with you.
- To send the emails you asked for: sign-in links, alert emails (each with a one-click unsubscribe link), and the single message promised to the waiting list. Contract, and for the waiting list your consent, which you can withdraw at any time.
- To keep the site secure and working (rate limits, abuse prevention, aggregate statistics) and to handle correction requests: our legitimate interest in running a reliable and accurate register.
- To keep accounting records of payments: legal obligation.
We send no marketing email. Service messages about your subscription (a receipt, a failed payment, a change to the terms) are sent when needed.
5. Who else handles it
We do not sell, rent or trade personal data, and we share it only with the service providers that run the site for us:
| Provider | Role | What it handles |
|---|---|---|
| Cloudflare | Hosting, network, database, analytics | Serves every page; stores accounts, sessions, alert settings, the waiting list and correction requests; processes IP addresses. |
| Stripe | Payments | Your email address, card and billing details, invoices, subscription and referral credits. Stripe also acts on its own responsibility for fraud prevention and its legal obligations. |
| Resend | Email delivery | Your email address and the content of the messages we send you (sign-in links, alerts). |
| GitHub | Source code and the nightly collection job | The register and the job data. No account or customer data is stored there; it only triggers the alert job. |
| Google (Fonts) | Typeface delivery | Your IP address, when your browser downloads the fonts. |
These providers are based in, or have affiliates in, the United States, so your data may be processed outside the European Economic Area. Transfers rely on the European Commission’s adequacy decision for the EU-US Data Privacy Framework where the provider is certified, and otherwise on the Commission’s standard contractual clauses. We may also disclose data when the law requires it.
6. How long we keep it
| Data | Kept for |
|---|---|
| Account (email, plan, Stripe identifiers, referral code, alert preferences) | As long as the account exists. Deleted within 30 days of your request. |
| Sessions | 30 days, or until you sign out |
| Sign-in links | 15 minutes |
| Rate-limit counters (keyed by IP address or email) | About one hour |
| Record of the last alert sent | 2 days |
| Payment event identifiers | 7 days |
| Waiting-list entries | Until the plans open and the one message is sent, at most 12 months |
| Correction requests | Up to 3 years, to keep track of why an entry was changed |
| Invoices and payment records (held by Stripe) | 10 years, as French accounting law requires |
| Email correspondence | Up to 3 years after the last exchange |
7. Your rights
Under the GDPR you can, at any time and free of charge:
- access the data we hold about you and receive a copy;
- have it corrected;
- have it erased (we delete the account and ask Stripe to delete the customer; invoices that the law requires us to keep are retained);
- restrict or object to processing based on our legitimate interest;
- receive the data you gave us in a portable format;
- withdraw consent where processing relies on it, and unsubscribe from alert emails with one click.
Write to [email protected] from the address concerned. We answer within one month. If you are not satisfied you can complain to a data-protection authority: in France, the CNIL (cnil.fr), or the authority of the country where you live.
The site is not intended for children under 16, and we do not knowingly collect their data.
8. California residents
We do not sell personal information and do not share it for cross-context behavioural advertising, so there is nothing to opt out of. Whether or not the California Consumer Privacy Act applies to a project of this size, California residents can use the same rights as everyone else (to know, to correct, to delete), by the same email address, and will not be treated differently for doing so.
9. Contact and changes
Questions and requests: [email protected]. If we change what we collect or who handles it, this page is updated and the date at the top changes; a significant change is also emailed to account holders.
See also the terms of service and the refund policy.