Privacy Policy

Capacity is a product of Over Work, a professional development company. When this policy refers to "Capacity," "we," "us," or "our," it means Over Work and the Capacity platform at capacityworks.co.

Information you give us directly:

• •Your name and email address when you create an account
• •Your role, goals, learning preferences, and professional challenges from onboarding
• •Context documents you choose to upload (resume, bio, job description, goals, frameworks)
• •Content you submit for processing (articles, audio files, PDFs, text)
• •Payment information (processed securely by Stripe — we never see or store your full card details)

Information we collect automatically:

• •How you use the platform (pages visited, features used, content processed) via PostHog analytics
• •Your device type and browser for performance optimization
• •Your IP address and general location for security purposes

Information we do not collect:

• •Your precise location
• •Your contacts or address book
• •Any data from your device beyond what is listed above

We use your information for one purpose: to make Capacity work better for you.

• •To personalize your summaries, digests, and recommendations based on your role and goals
• •To deliver your content processing results and digest emails
• •To manage your subscription and process payments
• •To send you product updates and learning tips (you can opt out anytime)
• •To improve platform performance and fix bugs
• •To comply with legal obligations

We do not use your information to train AI models. Every piece of content you submit is processed to generate your results and then stored for your access. It is not fed into any model training pipeline — ours or anyone else's.

We do not sell your data. We do not share your data with advertisers. We share your information only with the service providers who help us operate Capacity:

All providers are contractually required to protect your data and may not use it for their own purposes. We may also share your information if required by law, to protect the safety of our users, or in connection with a business transfer (in which case we will notify you).

Your data is yours. We are a processing tool, not a data owner.

• •We process your content to generate summaries and insights for you
• •We do not claim ownership of your content or your results
• •We do not use your content to improve our AI models or anyone else's
• •We do not analyze your content for advertising purposes
• •Enterprise customers may enable Data Sovereignty Mode, which adds additional contractual protections and a Data Processing Agreement

• •Your account data is retained as long as your account is active
• •If you cancel your account, your data is deleted within 30 days
• •You can request deletion of specific content at any time from your account settings
• •Backup copies may persist for up to 90 days after deletion for disaster recovery purposes, after which they are permanently purged
• •We will confirm deletion in writing upon request

We take security seriously because your professional information deserves protection.

• •All data is encrypted at rest and in transit using industry-standard encryption
• •Authentication is handled by Supabase with optional multi-factor authentication
• •We conduct regular security reviews
• •We are pursuing SOC 2 Type 1 certification (target: early 2027)
• •In the event of a data breach affecting your information, we will notify you within 72 hours

Depending on where you live, you may have the right to:

• •Access the personal information we hold about you
• •Correct inaccurate information
• •Delete your account and all associated data
• •Export your data in a portable format
• •Opt out of marketing communications
• •Withdraw consent for data processing

To exercise any of these rights, contact us at capacity@overworkonline.com. We will respond within 30 days.

If you are located in the United Kingdom or European Union, you have additional rights under the GDPR or UK GDPR.

Legal basis for processing:

• •Contract: Processing necessary to provide the Capacity service you have subscribed to
• •Legitimate interests: Analytics and platform improvement, where your interests do not override ours
• •Consent: Marketing communications, which you may withdraw at any time
• •Legal obligation: Where we are required to process data by law

Your GDPR rights:

• •Right of access: Request a copy of all personal data we hold about you
• •Right to rectification: Correct any inaccurate or incomplete data
• •Right to erasure: Request deletion of your personal data (“right to be forgotten”)
• •Right to restriction: Request that we limit how we use your data
• •Right to data portability: Receive your data in a structured, machine-readable format
• •Right to object: Object to processing based on legitimate interests
• •Right not to be subject to automated decision-making: We do not make solely automated decisions that significantly affect you

Data transfers: When your data is transferred outside the UK or EU, we ensure appropriate safeguards are in place, including Standard Contractual Clauses where required.

Data Protection Officer: We do not currently have a designated DPO as we do not meet the threshold requiring one. Questions about data protection can be directed to capacity@overworkonline.com.

Supervisory authority: You have the right to lodge a complaint with your local data protection authority. In the UK this is the Information Commissioner's Office (ico.org.uk). In the EU, contact your national supervisory authority.

Response time: We will respond to all GDPR rights requests within 30 days. Complex requests may take up to 90 days with notice.

If you are a California resident, you have additional rights under the CCPA and CPRA.

Your CCPA rights:

• •Right to know: Request disclosure of the categories and specific pieces of personal information we have collected about you in the past 12 months
• •Right to delete: Request deletion of personal information we have collected, subject to certain exceptions
• •Right to correct: Request correction of inaccurate personal information
• •Right to opt out of sale: We do not sell your personal information. We do not share your personal information for cross-context behavioral advertising.
• •Right to limit use of sensitive personal information: We collect sensitive personal information only as necessary to provide the Capacity service
• •Right to non-discrimination: We will not discriminate against you for exercising your CCPA rights

Categories of personal information collected:

• •Identifiers (name, email address)
• •Professional or employment-related information (role, goals, career information)
• •Internet or electronic network activity (usage data, content processed)
• •Inferences drawn from the above to create a profile about your learning preferences

To submit a request, email capacity@overworkonline.com with the subject line "California Privacy Request." We will verify your identity before processing your request and respond within 45 days. You may designate an authorized agent to submit requests on your behalf.

We use minimal cookies — only what is necessary to keep you logged in and to understand how the platform is being used. We do not use advertising cookies or third-party tracking cookies.

Capacity is designed for working professionals and is not intended for anyone under the age of 18. We do not knowingly collect data from minors. If you believe a minor has created an account, please contact us immediately.

When we make material changes to this policy, we will notify you by email and display a notice on the platform. Continued use of Capacity after changes take effect constitutes acceptance of the updated policy.

Questions about this policy or how we handle your data:

• Email: capacity@overworkonline.com
• Company: Over Work
• Website: capacityworks.co