Privacy Policy

What we collect

We collect the following information when you use Cari:

• Your phone number, used for account authentication and transactional SMS messages (such as one-time passcodes).
• Your first and last name, collected when you provide them during signup or in your profile. We use your name to personalise your experience and in email communications from us.
• A device identifier and device name for each device you sign in to Cari on. These are recorded to support multi-device access and to help you identify and manage trusted devices for security purposes.
• Your approximate geographic region at the country level, derived from your signup context. We collect this solely to determine which data-protection framework applies to your account (for example, GDPR for EU residents or CCPA for California residents).
• Conversation turns you have with Cari, if you have cross-device sync enabled. Without sync, conversations stay on your device only.
• Documents you create inside Cari, stored on our servers so they are accessible across devices.
• Meeting transcripts, if you use the meeting bot feature. Audio is processed and then discarded; the transcript text is stored in your account.
• Memory entries Cari extracts from your conversations -- people, goals, topics, and context you mention -- stored server-side so they persist across devices.
• Data from third-party services you choose to connect (Google Calendar, Gmail, Notion, Spotify, and others). We access only what each integration needs and only when you use a feature that requires it. Disconnecting an integration removes our access immediately.
• Usage events such as which features you open and how often. These events record actions, not content.

How we use your data

We use your data for the following purposes:

• Authentication: your phone number receives one-time passcodes via SMS to verify your identity. We use Twilio to deliver these messages.
• Cross-device sync: conversation and document data is transmitted encrypted so your account works on any device you sign in to.
• AI responses: conversation turns are sent to Anthropic (Claude) to generate Cari's replies. Anthropic does not use your data to train their models under our data processing agreement.
• Personalisation: your name is used to address you in the app and in email communications from us.
• Compliance routing: your approximate region is used to determine which data-protection framework governs your account and to apply the correct consent flows.
• Proactive notifications: if you have SMS or email notifications on, we use your phone number or name to send you reminders and, occasionally, product updates you have asked for. SMS messages are delivered via Twilio.

We do not train models on your data. We do not sell your data. We do not share your data with advertisers. We do not share your mobile number or your SMS opt-in with any third party for their own marketing purposes; mobile information is shared only with our SMS provider (Twilio) to deliver the messages you have requested.

Data storage

All data in transit is encrypted with TLS. Data at rest is encrypted using customer-managed encryption keys (CMEK) on Google Cloud infrastructure.

Meeting audio is stored temporarily in Google Cloud Storage for processing. On the free plan it is deleted within 24 hours. On Living Labs, you control retention yourself and can delete recordings at any time from your account.

You can delete all your data at any time from your account page.

Sub-processors

We share data with the following companies to operate the service. Each has a Data Processing Agreement (DPA) with us:

• Firebase (Google) — phone number authentication.
• Anthropic — AI responses. Conversation turns are processed under a zero-retention API agreement.
• Google Cloud — infrastructure, data storage, and speech synthesis.
• Twilio — SMS delivery for one-time passcodes and transactional notifications. Only your phone number is shared with Twilio.
• Stripe — payment processing. We never see your card details.

Your rights (GDPR, UK GDPR, LGPD)

If you are in the EU, UK, or Brazil, you have the following rights:

• Access — download a copy of your data from your account page.
• Rectification — correct inaccurate data by contacting us.
• Erasure — delete your account and all associated data from your account page.
• Portability — export your data as a JSON file from your account page.

Our lawful basis for processing is contract performance (providing the service you signed up for) and legitimate interest (usage analytics to improve the product).

Children's privacy

Cari is not intended for users under the age of 13. If you are located in the European Economic Area, the minimum age is 16. We do not knowingly collect personal data from anyone below the applicable minimum age. If you believe we have inadvertently collected such data, please contact us at hello@cari.global and we will delete it promptly.

Data retention

We keep your account data for as long as your account is active. When you delete your account, we remove your personal data within 30 days, including from backup systems. Stripe transaction records are retained for 7 years as required by financial regulations.

California privacy rights (CCPA / CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA) and its amendment, the California Privacy Rights Act (CPRA), give you the following rights:

• Right to know — you may request a copy of the personal information we have collected about you in the past 12 months, including the categories of data, the purposes for which it is used, and the categories of third parties with whom it is shared.
• Right to delete — you may request that we delete your personal information. You can do this directly from your account page at any time, or by contacting us.
• Right to correct — you may request that we correct inaccurate personal information we hold about you.
• Right to opt out of sale or sharing — we do not sell your personal information and we do not share it for cross-context behavioural advertising. You do not need to opt out, but you may contact us to confirm this at any time.
• Right to non-discrimination — we will not discriminate against you for exercising any of your CCPA rights.

To exercise your rights, contact Cari Finance, Inc. at hello@cari.global. We will respond within 45 days as required by law.

Contact

For rights requests, DPA inquiries, or breach notifications, contact our privacy team at privacy@cari.global.