Privacy Policy · Capibara

Last updated: October 3, 2026

Tena & Fura LLC (“Tena & Fura”, “we”, “us”) operates the CAPIBARA hardware NPI program management platform (the “Platform”), the website at capibaraai.com and its subdomains (the “Site”), and related services (together, the “Services”). This Privacy Policy explains what personal information we collect, how we use and share it, and the choices you have. It applies to visitors to our Site, users of the Platform (including users invited by our customers and their suppliers), people who contact us or attend our events, and anyone else whose personal information we handle in operating our business.

Customers and their data. Our customers use the Platform to manage their own NPI programs, and in doing so upload data that may include personal information about their employees, suppliers, and contacts (“Customer Data”). We process Customer Data on behalf of, and under the instructions of, the customer, as described in our Data Processing Agreement. If you are an employee or supplier of one of our customers and have questions about how that customer handles your information, please contact the customer directly. This Privacy Policy describes our own practices, including for the account and usage information we collect about Platform users.

1. Information We Collect

Information you provide to us

Account and profile information. Name, work email address, job title, company, phone number, and password or one-time passcode when you or your organization create an account or you are invited to the Platform.
Supplier portal information. If a customer invites you as a supplier user, we receive your name, work email, company, and the role you have been assigned, and we send you a one-time passcode to log in.
Customer Data. Content you or your organization upload to the Platform, such as NPI schedules, build trackers, bills of materials, supplier records, quality data, comments, and files. This may contain personal information about your colleagues and suppliers.
Communications. Information you provide when you contact us for support, respond to surveys, participate in feedback sessions, join our community (such as The NPI Room), or otherwise correspond with us.
Event and marketing information. Name, company, title, email, and phone number when you visit our booth at an event, scan a badge, sign up for a demo, subscribe to updates, or download content. If you consent, we may also capture photos or video of you at our events (see Section 9).
Billing information. Billing contact details and payment information. Payment card details are collected and processed by our payment processor; we do not store full card numbers.

Information we collect automatically

Usage and device information. When you use the Services we collect log data such as IP address, browser type, operating system, device identifiers, pages and features accessed, actions taken, timestamps, and referring URLs.
Cookies and similar technologies. We use cookies and similar technologies to keep you signed in, remember preferences, understand how the Services are used, and measure the effectiveness of our marketing. See Section 7.

Information from other sources

Business contact information from publicly available sources, professional networks, event organizers (including attendee lists for events we sponsor), and data providers, used to identify and contact potential customers.
Information from service providers such as analytics, security, and fraud-prevention vendors.

2. How We Use Information

We use personal information to:

provide, operate, maintain, and secure the Services, including authenticating users and delivering one-time passcodes;
process Customer Data as instructed by our customers, including through the Platform’s scheduling, optimization, and AI-assisted features;
provide onboarding, support, and advisory services and respond to your requests;
send transactional messages such as invitations, passcodes, notifications you or your organization configure, invoices, and service announcements;
send marketing communications about our products, events, and content, where permitted by law and subject to your right to opt out;
analyze usage to understand, improve, and develop the Services, including creating aggregated or de-identified data;
detect, investigate, and prevent fraud, abuse, security incidents, and violations of our terms;
comply with legal obligations and enforce our agreements;
for any other purpose described to you at the time of collection or with your consent.

AI-assisted features

The Platform uses machine-learning and large-language-model technology to generate schedules, recommendations, and summaries from Customer Data. Where we use third-party AI providers, we send them only the data needed to generate the output, under contracts that prohibit them from using it to train their models. We do not use Customer Data to train generalized models offered to other customers without the customer’s prior written consent.

3. How We Share Information

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We share personal information only as follows:

Within a customer’s workspace. Information you add to the Platform is visible to other users in your organization’s workspace and, where the customer configures it, to supplier users the customer invites, according to the permissions the customer sets.
Service providers. Vendors that help us operate the Services, such as cloud hosting (Amazon Web Services, in the United States), AI model providers, email and SMS delivery, payment processing, customer support, analytics, and security tooling. They may use personal information only to provide services to us. Our current list of subprocessors for Customer Data is in our Data Processing Agreement.
Professional advisors. Lawyers, accountants, insurers, and similar advisors, under confidentiality obligations.
Legal and safety. When required by law, subpoena, or legal process; to protect the rights, property, or safety of Tena & Fura, our customers, or others; or to enforce our agreements.
Business transfers. In connection with a merger, acquisition, financing, reorganization, or sale of all or part of our business, including the transfer of the CAPIBARA business to a successor entity, subject to this Privacy Policy.
With your direction or consent. For example, when you ask us to integrate with a third-party tool or agree to appear in a case study.

4. Data Retention

We keep personal information for as long as needed for the purposes described above. Account information is kept while the account is active and for a reasonable period afterward. Customer Data is retained as described in our customer agreements — generally exported or deleted within ninety (90) days after a subscription ends, except for backup copies deleted in the ordinary course. Marketing contact information is kept until you unsubscribe or we determine it is no longer current. We may retain information longer where required by law, to resolve disputes, or to enforce our agreements, and we may retain aggregated or de-identified data indefinitely.

5. Security

We use administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit and at rest, access controls, one-time passcode authentication for supplier users, logging, and vendor due diligence. No system is completely secure, and we cannot guarantee the security of information you transmit to us. If you believe your account has been compromised, please contact us immediately.

6. Your Choices and Rights

Account information. Platform users can review and update profile information in account settings, or by contacting their workspace administrator or us.
Marketing emails. You can opt out by using the unsubscribe link in any marketing email or by contacting us. You will continue to receive transactional messages related to your account.
Cookies. See Section 7.
Customer Data. If your personal information is in Customer Data, please direct requests to access, correct, or delete it to the customer that controls it. We will assist customers in responding as described in our Data Processing Agreement.

California residents

If you are a California resident, the California Consumer Privacy Act (CCPA), as amended, may give you the right to know what personal information we collect, use, and disclose about you; to request deletion or correction of it; to opt out of the sale or sharing of personal information (we do not sell or share personal information as those terms are defined in the CCPA); to limit use of sensitive personal information (we do not use it for purposes requiring that right); and not to be discriminated against for exercising these rights. To exercise these rights, contact us as described in Section 12. We will verify your request using information associated with your account or interactions with us. You may designate an authorized agent to make a request on your behalf, in which case we may require proof of the agent’s authority. The categories of personal information we have collected in the preceding twelve months are described in Section 1; the sources and purposes are described in Sections 1 and 2; and the categories of third parties with whom we disclose it for business purposes are described in Section 3.

Residents of the EEA, United Kingdom, and Switzerland

Where the GDPR or UK GDPR applies, our legal bases for processing are: performance of a contract (providing the Services to you or your organization); our legitimate interests (operating, securing, and improving the Services, and business-to-business marketing), balanced against your rights; compliance with legal obligations; and consent, where we ask for it. You may have the right to access, correct, delete, restrict, or object to our processing of your personal information, to data portability, and to withdraw consent, and to lodge a complaint with your supervisory authority. To the extent we act as a processor for Customer Data, please contact the customer. Because we are located in the United States, personal information will be transferred to and processed in the United States; where required, we rely on the European Commission’s Standard Contractual Clauses or other lawful transfer mechanisms.

Other jurisdictions

Residents of other U.S. states and other countries may have similar rights under applicable law. We will honor requests as required by the laws that apply to you. Contact us as described in Section 12.

7. Cookies and Analytics

We use: (a) strictly necessary cookies for authentication, security, and session management; (b) preference cookies to remember settings; and (c) analytics cookies and tools (HubSpot) to understand how the Site and Platform are used. Most browsers let you refuse or delete cookies; doing so may affect functionality. Where required by law, we will ask for your consent before setting non-essential cookies. We currently do not respond to browser “Do Not Track” signals, but we honor Global Privacy Control signals as an opt-out of sale or sharing where required by law.

8. Supplier Portal Users

If a customer invites you to the Platform as a supplier, you will receive an invitation and a one-time passcode by email or SMS to authenticate. We collect the information described in Section 1 to provide you access, and we log your activity in the Platform for security and support purposes. The customer that invited you controls what information you can see and what you upload; it is the controller of that Customer Data and we process it on its behalf. You can ask the customer to remove your access at any time.

9. Events, Photography, and Video

At events we host or sponsor, we may collect business contact information from you (including by badge scan or sign-up form) and, with your consent, capture photos or video that may include you, for use in our marketing and product demonstrations. We will provide a notice and consent form at the event. You may withdraw consent for future use by contacting us, although we may not be able to recall materials already published. Event organizers may also share attendee information with us as a sponsor under their own privacy policies.

10. Children

The Services are intended for business users and are not directed to children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us personal information, please contact us and we will delete it.

11. Changes to this Policy

We may update this Privacy Policy from time to time. We will post the updated version on the Site with a new “Last updated” date and, for material changes, notify Platform account administrators by email or in-Platform notice at least thirty (30) days before the changes take effect where practicable. Your continued use of the Services after the effective date means you accept the updated policy.

12. Contact Us

For questions, requests, or complaints about this Privacy Policy or our handling of personal information, contact:

Tena & Fura LLC
Attn: Privacy
6180 Tivoli Gardens Blvd
Orlando, FL 32829
Email: privacy@capibaraai.com

We will respond to verifiable requests within the time required by applicable law (generally 45 days under the CCPA, extendable once by a further 45 days with notice).