Privacy Policy

1. Information We Collect

Account information: When you create an account, we collect your email address and a display name. If you sign in via Google OAuth, we receive your email and profile name from Google.

Conversation data: Messages you exchange with Carla are stored to provide persistent memory and conversation continuity. This data is associated with your account.

Usage analytics: We use PostHog to collect anonymized usage events (page views, feature interactions) to improve the product. No conversation content is sent to analytics.

Payment information: Payments are processed by Buy Me a Coffee. We do not store your credit card details — only a transaction reference and purchased credit amount.

2. How We Use Your Data

• Provide and personalize your conversations with Carla
• Maintain conversation history and persistent memory across sessions
• Process credit purchases and manage your wallet balance
• Send transactional emails (verification, password resets)
• Improve product quality and fix issues using anonymized analytics

3. Data Storage & Security

Your data is stored on encrypted servers hosted in the EU. We use industry-standard security measures including encrypted connections (TLS), hashed passwords, and access controls. Conversation data is never shared with third parties for advertising or model training purposes.

4. Third-Party Services

We integrate with the following services, each with their own privacy policies:

• PostHog — anonymized product analytics
• Buy Me a Coffee — payment processing
• Google OAuth — optional sign-in provider
• Mailgun — transactional email delivery

5. Your Rights

You may request access to, correction of, or deletion of your personal data at any time. To exercise these rights, contact us at the email address below. Account deletion removes your profile, conversation history, and any remaining credits.

6. Cookies & Local Storage

We use a single HttpOnly authentication cookie for session management. A non-sensitive "had_session" flag in localStorage enables silent token refresh on page load. We do not use advertising cookies or cross-site tracking.

7. Age Requirement

Carla Kaas is intended for users aged 18 and over. We do not knowingly collect data from anyone under 18. If we learn that a minor has provided personal information, we will delete it promptly.

8. Changes to This Policy

We may update this policy from time to time. Material changes will be announced via the platform. Continued use after changes constitutes acceptance of the updated policy.

9. Contact

For privacy inquiries or data requests, email privacy@carlakaas.com.