Privacy Policy

This Policy applies to personal information we collect through the Service, our marketing sites, and communications related to Caite. It does not cover third-party websites, model providers, or payment processors except as described below. If we process data on behalf of a business customer under a separate agreement, that agreement controls for that processing.

We collect information in three main ways:

Information you provide. Account and profile details (such as name, email, password or auth provider identifiers), billing and plan information, support messages, and survey or waitlist submissions.

User content. Prompts, settings, uploads, references, avatars, project graphs, and media you generate or store in the Service, plus associated metadata (for example timestamps, model choice, and job status).

Information collected automatically. Device and log data such as IP address, browser or app version, OS, approximate location derived from IP, pages viewed, referring URLs, and diagnostic events. We and our vendors may use cookies, local storage, and similar technologies for authentication, preferences, analytics, and security.

Information from others. If you sign in with a third-party identity provider (for example Google), we receive the profile information you authorize. Payment processors share limited billing status with us so we can keep your plan in sync — we do not receive full card numbers.

We use personal information to:

• Provide, operate, secure, and improve the Service
• Run generation jobs you request and store results in your Media Library
• Process subscriptions, credits, invoices, and account changes
• Communicate about the Service, security alerts, and (with consent where required) product updates
• Detect abuse, debug issues, and enforce our Terms
• Comply with law and respond to lawful requests

Where GDPR or similar laws apply, we rely on one or more of: performance of a contract, legitimate interests (for example securing the Service and understanding product usage in aggregate), consent (where we ask for it), and legal obligation.

Caite routes generation to third-party model and infrastructure providers you select or that power a given feature. When you run a job, the prompt, parameters, and any attached reference media needed for that job are sent to the relevant provider so they can return an output. Providers process that data under their own terms and privacy policies. We do not sell your personal information to them for advertising.

We also use service providers for hosting, storage, privacy-friendly web analytics and performance monitoring (including our hosting provider), email, customer support, and payments (including Stripe). They may process personal information only to perform services for us and under appropriate contractual safeguards.

We do not train Caite’s models (or allow providers to train theirs via Caite) on your private prompts, uploads, or generations for advertising or model improvement, except where a provider’s own terms apply to data you send them for a job — and we configure enterprise / zero-retention options where a provider offers them and your plan enables them.

We do not sell your personal information. If — and only if — you accept marketing cookies, we measure whether our own ads led to your sign-up or purchase by sharing limited data with Meta (see Cookies and ad measurement). We do not share your prompts, uploads, or generations with advertisers.

Essential. Sign-in session cookies, security tokens, and preferences such as theme and language. These are needed for the Service to work and are always on.

Analytics and support (web app). With your consent in the web app, Mixpanel (product analytics, without session replay) and Intercom (support messenger) set cookies or local storage. On caite.app, analytics run only with your consent, as described below.

Analytics and marketing (Google Tag Manager and Mixpanel). On caite.app and in the web app we use Google Tag Manager, which loads the measurement and advertising tags we configure in it. Google Tag Manager itself loads on every visit, but with all cookies and similar storage switched off (Google Consent Mode) until you accept; only with your consent may it and the tags it loads store or read identifiers on your device. With your consent we also load Mixpanel (product analytics, data stored in the EU), which records the pages you view, the buttons you click, and the campaign parameters (utm_*) and ad click identifiers of the link you arrived through. Mixpanel sets one cookie for caite.app and its subdomains, so a visit to this site and a later sign-up in the web app count as one journey; when you have an account and have consented, our servers also report account events such as sign-up, subscriptions and purchases to Mixpanel. Without consent Mixpanel is not loaded and nothing is sent to it. Google Ireland Ltd. and Mixpanel, Inc. process this data as described in their own privacy policies; transfers to the US rely on the EU–US Data Privacy Framework.

You can change your choice at any time by clearing this site's storage in your browser, which shows the cookie banner again. Legal basis: your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG).

Quiz at caite.app/start.While you take the quiz, your answers are kept in your browser's session storage so that going back or reloading does not lose them; they are removed when you close the tab. If you create an account at the end, the answers and the plan we suggested are saved to that account so the app can show you a matching offer. To see where visitors leave the quiz, we also record each step and the option chosen under a random identifier that exists only in the open page's memory, together with the page language and the campaign parameters (utm_*) of the link you arrived through. This record contains no IP address, name or email address, is not stored on your device, and is not linked to your account. Legal basis: providing the quiz you asked for (§ 25(2) no. 2 TDDDG, Art. 6(1)(b) GDPR) and, for the step record, our legitimate interest in improving the page (Art. 6(1)(f) GDPR).

Some of our ads on Facebook and Instagram open a Meta lead form instead of our website. If you submit one, we receive what you entered: your name, work email address, phone number, company, team size and your answers to the form's questions. Meta Platforms Ireland Ltd. hosts the form and passes your entries to us.

We use this information only to contact you by phone or email about Caite — to arrange and hold a demo, answer your questions, and send you a link to sign up. We call you only if you agreed to be called when you submitted the form. Legal basis: steps you asked for before a possible contract (Art. 6(1)(b) GDPR) and, for phone calls, your consent (Art. 6(1)(a) GDPR, § 7 UWG).

Your entries are kept in Meta's Leads Center and in the email and contact tools we use to follow up. If you do not become a customer, we delete them 12 months after our last contact, or sooner if you ask. You can withdraw your consent to calls, or ask us to stop contacting you, at any time by emailing privacy@caite.app; this does not affect contact that already took place. We do not sell lead information or use it for anything else.

Separately, Meta may record that you submitted a lead form and use that to measure and deliver our ads, as described in Meta's privacy policy. Transfers to the US rely on the EU–US Data Privacy Framework.

We disclose personal information only:

• To service providers and model providers as needed to run the Service
• To payment processors for billing
• If you choose to share or publish content
• In connection with a merger, acquisition, or asset sale, subject to appropriate protections
• When required by law, to protect rights and safety, or to enforce our Terms
• With your direction or consent

We keep account data and library media for as long as your account is active and as needed to provide the Service. After you delete content or your account, we remove it from active systems within a commercially reasonable period, subject to backups, legal holds, and fraud-prevention records. Billing records may be retained as required by tax and accounting rules.

We use administrative, technical, and organizational measures designed to protect personal information — including encryption in transit, access controls, and monitoring. No method of transmission or storage is completely secure; please use a strong unique password and protect your devices.

Caite may process information in the United States and other countries where we or our providers operate. Where we transfer personal information from the EEA, UK, or Switzerland, we use appropriate safeguards such as Standard Contractual Clauses or an adequacy decision, unless another lawful transfer mechanism applies.

Depending on where you live, you may have rights to access, correct, delete, or export personal information; object to or restrict certain processing; and withdraw consent. You may also opt out of marketing emails via the unsubscribe link.

To exercise privacy rights, email privacy@caite.app from the address on your account, or use in-product account controls where available. We may need to verify your request. You may have the right to lodge a complaint with a supervisory authority — for example the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit), or the authority where you live.

California residents may have additional rights under the CCPA/CPRA, including to know, delete, and correct personal information, and to not be discriminated against for exercising those rights. We do not sell personal information. The consent-based Meta ad measurement described in Cookies and ad measurement may count as “sharing” under the CPRA; you can opt out by declining or clearing marketing cookies.

The Service is not directed to children under 16 (or the minimum age required in your country). We do not knowingly collect personal information from children. If you believe we have, contact us and we will take appropriate steps to delete it.

Some features (for example avatars, voice, or face-driven generation) process photos, video, or audio you upload. We use that material to provide the feature you requested. We do not sell biometric identifiers. You are responsible for having the rights and consents needed to upload likenesses of real people.

We may update this Policy from time to time. We will post the revised version here and update the “Last updated” date. Material changes may also be communicated by email or in-product notice. Continued use of the Service after an update means you accept the revised Policy.

Privacy questions and requests: privacy@caite.app
General support: hello@caite.app
Or use our Contact page.

Controller responsible for processing (Art. 4(7) GDPR):
Maurice Hedfeld, Caite (sole proprietorship)
Donaustr. 44, 12043 Berlin, Germany
privacy@caite.app · Imprint