Legal

Privacy Policy

Effective date: 18 September 2026 · Last updated: 28 October 2026

In short: we collect the account and billing information needed to run your subscription, and we process the operational data you put into 2Capacity (units, leads, contracts, payments) on your behalf as a processor, not as its owner. We don't sell personal data. Details on what we collect, why, who we share it with, and your rights are below.

1. Scope

This Privacy Policy explains how 2Capacity ("2Capacity," "we") collects, uses, and shares personal data in connection with our website and the 2Capacity platform ("Service"). It applies to visitors to our marketing site and to individuals whose data is processed through the Service.

2. Our Role: Controller vs. Processor

We act as a data controller for account, billing, and marketing-contact information relating to our customers (the self-storage operators who subscribe to 2Capacity) and for visitors to our website.

We act as a data processor (or "service provider," depending on applicable law) for personal data that our customers submit into the Service about their own tenants, leads, and prospects, such as names, phone numbers, unit assignments, and WhatsApp message content. We process that data only on our customers' documented instructions, as described in our Data Processing Agreement. If you are a tenant or lead of a self-storage facility that uses 2Capacity, please direct data requests to that facility operator in the first instance; we will assist them in responding as described in the DPA.

3. Information We Collect

Category	Examples	Source
Account & billing	Name, work email, phone, company name, billing address, payment method details (processed by our payment provider)	You, at signup
Demo & sales inquiries	Name, email, company, facility size, message content	You, via the "Request a demo" form
Customer Data (processor role)	Unit, lead, tenant, contract, and payment records you enter into the Service, including WhatsApp message content used for reply drafting	You and your authorized users
Usage & device data	Log data, IP address, browser type, pages viewed, feature usage, approximate location derived from IP	Automatically, via the Service and website
Cookies & local storage	Theme preference, session state; see Section 11	Automatically, via your browser

4. How We Use Information

Provide, maintain, and support the Service, including processing subscription payments;
Respond to demo requests and sales inquiries;
Send service notices, security alerts, and administrative messages;
With your consent or as permitted by law, send product updates and marketing communications, which you can opt out of at any time;
Monitor, secure, and improve the Service, including diagnosing technical issues;
Generate aggregated or anonymized analytics that do not identify you or your customers;
Comply with legal obligations and enforce our agreements.

5. Legal Bases for Processing

Where applicable data protection law requires a legal basis, we rely on: performance of a contract with you (providing the Service you subscribed to); our legitimate interests (securing and improving the Service, responding to inquiries, direct marketing to business contacts where permitted); your consent (for optional cookies or marketing where required); and compliance with legal obligations (e.g. tax and accounting records).

We do not sell personal data. We share personal data only with:

Sub-processors who help us run the Service, such as cloud hosting, email delivery, payment processing, and customer support tooling providers, bound by confidentiality and data protection obligations;
Third-party integrations you choose to connect, such as WhatsApp Business (Meta), Google Contacts, Google Drive, and DocuSign, which receive data directly as a result of the connection you authorize;
Professional advisors such as auditors and lawyers, under confidentiality obligations;
Authorities where required by law, regulation, or valid legal process; and
A successor entity in the event of a merger, acquisition, or asset sale, subject to this Policy or a materially similar one.

A current list of sub-processors for Service (processor-role) data is maintained in Annex III of the Data Processing Agreement.

7. International Transfers

We and our sub-processors may process data outside the country where you or your customers are located, including in the United Arab Emirates and other jurisdictions where our hosting and sub-processors operate. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses or equivalent mechanisms recognized under applicable data protection law.

8. Data Retention

We retain account and billing data for as long as your subscription is active and for a reasonable period afterward to meet legal, tax, and accounting requirements. Customer Data processed on your behalf is retained per your instructions and is available for export for 30 days following termination of your subscription, as described in the DPA, after which it is deleted or anonymized unless a longer period is required by law.

9. Security

We maintain administrative, technical, and physical safeguards designed to protect personal data against unauthorized access, loss, or misuse, including encryption in transit, access controls, and logging. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Our technical and organizational measures are further described in Annex II of the DPA.

10. Your Rights

Subject to applicable law, you may have the right to: access the personal data we hold about you; correct inaccurate data; request deletion; object to or restrict certain processing; request portability of data you provided; and withdraw consent where processing is based on consent. To exercise these rights, contact us at hello@2capacity.com. We may need to verify your identity before acting on a request. If you are a tenant or lead of a facility using 2Capacity, we will generally direct your request to the relevant facility operator, who controls that data.

11. Cookies & Tracking

Our website uses a small number of strictly necessary items of browser storage, such as a localStorage entry that remembers your light/dark theme preference and your cookie choice, and a sessionStorage entry that remembers which ad or campaign link brought you to the site so we can attribute a demo request to it.

With your consent, we also use Google Analytics 4 to understand how visitors use the site and Google Ads conversion tracking to measure which of our ads lead to demo requests. These services set cookies (such as _ga and _gcl_au) and are provided by Google LLC, which acts as our processor for analytics. Until you choose “Accept” in the cookie banner, these tags run in Google Consent Mode with analytics and advertising storage denied: no analytics or advertising cookies are set, and Google receives only cookieless signals without identifiers. You can change your choice at any time by clearing this site’s data in your browser, after which the banner will ask again. Learn more about how Google uses data at policies.google.com/technologies/partner-sites.

When you submit the “Book a demo” form, the details you enter are sent to our servers and our team is notified by email so we can arrange your demo. We use them only for that purpose and for related follow-up, as described in Section 4.

12. Children's Privacy

The Service is intended for business use and is not directed at individuals under 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

13. Changes to this Policy

We may update this Policy from time to time. For material changes, we will provide notice by email or in-product notice at least 15 days before they take effect. The "Last updated" date above reflects the most recent revision.

14. Contact Us

Questions or requests regarding this Policy can be sent to hello@2capacity.com.

This Privacy Policy is a professionally structured template prepared for 2Capacity and is provided for illustrative and drafting purposes. It should be reviewed by qualified legal/privacy counsel and adapted to the jurisdictions in which you actually operate (e.g. UAE PDPL, GDPR, or other applicable regimes) before being published as a binding policy.