Privacy Policy
Last updated: October 27, 2026
This Privacy Policy describes how Camarai processes the personal data of its users. Our scope of application is global, with a strict focus on compliance with the General Data Protection Regulation (GDPR) of the European Union (Regulation (EU) 2016/679) and Spanish Organic Law 3/2018 (LOPDGDD).
01.Identity and contact
The controller of your data is Camarai S.L.
02.Personal data we process
We process only the data that is necessary, adequate and relevant:
- Identification and contact: First name, surname, email, company/position and telephone number.
- Account and credentials: Username, password (hash) and SSO tokens.
- Usage and telemetry: IP address, device identifiers, activity logs.
- Service content: Prompts, messages, files and generated outputs.
- Billing: Tax ID (NIF/CIF), company name, address and purchase data (we do not store cards).
We do not proactively process special categories of data. If the user enters this type of data, they do so at their sole responsibility.
03.Purposes and legal basis
- Performance of a contract: Registration, provision of the service, billing and support.
- Legitimate interest: Security, fraud prevention, analytics and model improvement (with an opt-out option for B2C).
- Legal obligation: Tax compliance and requests from authorities.
- Consent: Marketing and newsletters (revocable at any time).
04.Source of the data
The data comes directly from the user or is generated by the system (activity logs). It may also come from third parties via SSO (Google, Apple), limited to email, name and avatar.
05.Automated decision-making
Camarai does not make decisions based solely on automated processing that produce legal effects. We always offer the option of human intervention.
06.Disclosure of data
We share data with Data Processors under contract:
- Meta Platforms Ireland Limited: To operate the WhatsApp/Messenger/Instagram API.
- Stripe: Secure payment gateway.
- Others: Infrastructure, hosting (EU/EEA), email and support.
07.International transfers
Primary hosting in the EU. Transfers to the US are limited to providers certified under the EU-US Data Privacy Framework (DPF) or by means of Standard Contractual Clauses (SCC).
08.Retention periods
09.Data subject rights
You have the right of access, rectification, erasure, objection, restriction and portability.
10.Security
We apply encryption in transit and at rest, access control, 2FA, encrypted backups and vulnerability management.
11.AI and model improvement
- B2B accounts: We do not use your content to train AI without an explicit agreement.
- B2C accounts: We use metadata and minimized samples (legitimate interest) with an opt-out option.
12.Other aspects
- Minors: The Service is not directed at children under 14.
- Cookies: We use necessary cookies. Analytics/advertising are subject to consent.