Legal

Everything you would otherwise have to ask for.

Four documents, all public, all dated, none behind a form. The DPA is a download rather than a negotiation opener. Where a clause is not settled it is marked as not settled and the reason is given, which is the only honest way to publish a document that counsel has not finished.

Published in full: 4 documents
Linkable sections: 51 across the documents
Marked with counsel: 12 clauses, named in the body

Last revised 19 August 2026.

Find the clause you came for.

Twenty questions, each going straight to the section that answers it. The right-hand column is the document it lands in, so you can see what you are about to be reading before you open it.

The four documents

Each one leads with the reader it is for. If none of them is you, the questions above are a faster way in than any of these.

Terms of Service

You are close to signing up and want to know what you are agreeing to, what it costs you and how you get out.

Service, plans and entitlements, billing and the grace period, acceptable use, your data, and termination. Commercial clauses are with counsel.

12 sections. Published, with clauses pending counsel . Four clauses marked with counsel.
Privacy Policy

You, your data protection officer or one of your own employees want to know what happens to a person's record.

Roles, categories, retention, deletion as cryptographic erasure, export, consented access, rights and transfers.

15 sections. Published, with clauses pending counsel . Two clauses marked with counsel.
Data Processing Agreement

Your reviewer needs processor terms and a security annex, and needs them without a call or a signature first.

Processor obligations, sub-processor change notice, the security annex, breach notification, deletion and return of data.

15 sections. Published, with clauses pending counsel . Four clauses marked with counsel.
Sub-processor register

You have to name every third party that touches your people's data, and prove the list is current.

Who else touches your data, what reaches them, and where it rests. Includes the vendors admitted but not engaged.

9 sections. Published . Two clauses marked with counsel.

What is not settled, in one place.

Thirteen open items across the four documents, and eleven of them land on the clause in the document where a reader would look for it. Nothing here is a promise about when an item is filled. It is a statement of what a reviewer will find missing, published before they find it.

Terms of Service six open

Clause 1.1 The contracting legal entity, its registered address and its company number Counsel
Clause 6.2 The enumerated acceptable-use prohibitions Counsel
Clause 11 Warranties and disclaimers, limitation of liability, indemnities, governing law, jurisdiction and dispute resolution, and the licence to use the service Counsel
Clause 9.2 Published support response targets The business
Clause 9.3 Any availability, recovery-time or recovery-point commitment Engineering
Clause 12 How changes to these terms are notified, and how much notice is given Counsel

Privacy Policy two open

Lawful bases The per-activity lawful basis for the processing where Capstan is itself the controller Counsel
Jurisdiction rows The statutory clocks, rights and transfer positions for each jurisdiction Counsel

Data Processing Agreement four open

Clause 8.4 The objection remedy when a workspace objects to a new sub-processor Counsel
Clause 11.2 Audit rights: whether an on-site or third-party audit may be requested, at whose cost, and how often Counsel
Clause 12.3 The transfer mechanism relied on for any transfer out of a region Counsel
Clause 1.2 How this agreement is entered into, by whom, and how it relates to the Terms of Service Counsel

Sub-processor register one open

Notice channel The product notification that carries a sub-processor change notice Engineering

Where to write

Terms and legal notices: legal@usecapstan.com. Privacy, the DPA, sub-processors and anything about personal data: privacy@usecapstan.com. Security reviews and evidence requests: security@usecapstan.com. Grievances under India's Digital Personal Data Protection Act go to the named officer at clause 15.2 of the privacy policy.

If one of the open items above is blocking a real decision, say which one. Knowing which clause actually blocks a deal is how it gets prioritised, and it is more useful to us than a general ask for the documents to be finished.