Privacy Policy

1.1 Personal Information

• Phone number - Required for account verification and communication services
• Location data - Used to provide location-based services and comply with regional regulations
• Voice recordings - Collected during voice calls to provide transcription and AI assistant services
• SMS messages - Processed to enable unified inbox functionality
• Social media data from WhatsApp, Telegram, Instagram, and TikTok - Integrated to provide omnichannel communication management

1.2 Derived Information

• Transcripts of voice recordings - Generated to provide searchable records and AI-powered insights
• Communication analytics and patterns
• Customer relationship data derived from your interactions

1.3 Technical Information

• Device information (type, operating system, unique identifiers)
• IP address and approximate location
• Browser type and version
• Usage data (pages visited, features used, timestamps)

1.4 Carima POS Information

If you use Carima POS, our point-of-sale product, or you are a guest or staff member of a business that does, we also process:

• Merchant account and business details - Business name, locations, tax settings, and owner and manager contact details
• Staff records - Name, role and permissions, a sign-in PIN, shift and time-clock entries, and the actions a staff member performs at the register, such as sales, refunds, voids and cash drawer openings
• Order and sales records - Items, quantities, prices, taxes, tips, discounts, table or ticket references, and the time and location of each sale
• Payment records - Payment method, amount, status, card brand, last four digits and the payment provider's transaction reference. We never collect full card numbers, security codes or card PINs (see Section 16)
• Guest contact details - A name, phone number or email address, only where a guest provides it for an order, a digital receipt or a pickup notification
• POS device information - Device name and model, operating system and app version, connected printers and payment terminals, and synchronisation logs

2.1 Consent

• Voice recordings and transcription
• Marketing communications (if applicable)
• Non-essential cookies and tracking technologies
• Processing of sensitive personal information beyond what is necessary for service delivery

2.2 Contract Performance

• Providing AI-powered communication services
• Processing appointments and CRM data
• Account creation and management
• Customer support
• Operating the Carima POS point-of-sale service for merchants

2.3 Legitimate Interest

• Security and fraud prevention
• Service improvement and analytics
• Bug detection and fixing

2.4 Legal Obligation

• Compliance with telecommunications regulations
• Tax and accounting requirements
• Responding to lawful government requests

7.1 Types of Cookies We Use

• Essential Cookies - Required for the website and application to function properly
• Analytics Cookies - Help us understand how visitors use our services
• Functional Cookies - Remember your preferences and settings

10.1 EEA/UK Residents (GDPR)

If you are located in the European Economic Area or United Kingdom, you have the following rights under the General Data Protection Regulation:

• Right of access (Art. 15) - Obtain a copy of your personal data
• Right to rectification (Art. 16) - Correct inaccurate personal data
• Right to erasure (Art. 17) - Request deletion of your personal data
• Right to restrict processing (Art. 18) - Limit how we use your data
• Right to data portability (Art. 20) - Receive your data in a structured, machine-readable format
• Right to object (Art. 21) - Object to processing based on legitimate interests
• Right to withdraw consent - Withdraw consent at any time without affecting the lawfulness of prior processing
• Right to lodge a complaint - File a complaint with your local supervisory authority (e.g., ICO in the UK, CNIL in France, BfDI in Germany)

10.2 California Residents (CCPA/CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act and California Privacy Rights Act. This section also serves as our Notice at Collection.

• Categories of personal information collected: Identifiers (name, phone, email), audio/visual information (voice recordings), geolocation data, internet activity (usage data), inferences (AI-generated insights), and, for Carima POS merchants and their staff, commercial information (order and transaction records) and professional or employment-related information (staff roles, shifts and time-clock entries)
• Categories of sensitive personal information: Voice recordings, precise geolocation
• Purpose: To provide and improve our AI-powered communication services as described in this policy
• We do NOT sell or share your personal information for cross-context behavioral advertising
• Right to know - Request details about the personal information we collect and how it is used
• Right to delete - Request deletion of your personal information
• Right to correct - Request correction of inaccurate personal information
• Right to opt-out of sale/sharing - We do not sell your data, but you may submit a request at any time
• Right to limit use of sensitive personal information - Direct us to limit use of sensitive data to what is necessary for service delivery
• Right to non-discrimination - We will not discriminate against you for exercising your privacy rights
• Authorized agent - You may designate an authorized agent to make requests on your behalf with proper verification
• "Do Not Sell or Share My Personal Information" - Carima does not sell or share your personal information. To exercise any rights, contact support@carima.ai

10.3 Turkey Residents (KVKK)

Turkiye'de ikamet ediyorsaniz, 6698 sayili Kisisel Verilerin Korunmasi Kanunu (KVKK) kapsaminda asagidaki haklara sahipsiniz:

• Kisisel verilerinizin islenip islenmedigini ogrenme hakkı (learn whether your personal data is being processed)
• Kisisel verileriniz islenmisse buna iliskin bilgi talep etme hakkı (request information about processing if data has been processed)
• Kisisel verilerinizin islenme amacını ve bunların amacına uygun kullanılıp kullanılmadığını ogrenme hakkı (learn the purpose of processing and whether data is used accordingly)
• Yurt icinde veya yurt dısında kisisel verilerinizin aktarıldığı ucuncu kisileri bilme hakkı (know third parties to whom your data is transferred)
• Kisisel verilerinizin eksik veya yanlıs islenmis olması halinde bunların duzeltilmesini isteme hakkı (request correction of incomplete or inaccurate data)
• KVKK Madde 7 kapsamında kisisel verilerinizin silinmesini veya yok edilmesini isteme hakkı (request deletion or destruction under Art. 7)
• Islenen verilerin munhasıran otomatik sistemler vasıtasıyla analiz edilmesi suretiyle aleyhinize bir sonucun ortaya cıkmasına itiraz etme hakkı (object to a result arising from automated analysis)
• Kisisel verilerinizin kanuna aykırı olarak islenmesi sebebiyle zarara ugramanız halinde zararın giderilmesini talep etme hakkı (claim compensation for damages caused by unlawful processing)
• Veri Sorumlusu (Data Controller): AGENTIC LLC, trading as Carima, 1925 W River Rd Apt 11307, Tucson, AZ 85704, USA
• Sikayet hakkı: KVKK Kurulu'na basvuru hakkınız saklıdır (Right to apply to the Turkish Personal Data Protection Board)

16.1 Our Role

For information about a merchant's guests and staff, the merchant is the data controller (the "business" under US state privacy laws) and Carima acts as its processor or service provider: we handle that information only to provide Carima POS to the merchant and on its instructions. If you are a guest or a staff member of a merchant and want to exercise your privacy rights, please contact the merchant first; we will help the merchant respond. For the merchant's own account, billing and security information, Carima is the controller and this policy applies directly.

16.2 Card Payments

Carima POS does not process card payments itself. Each merchant connects its own account with a payment provider such as Helcim or Stripe, and the card is read by that provider's certified terminal or hosted payment page.

• Full card numbers, security codes and card PINs never reach Carima POS, our servers, our logs or our support tools
• We receive only the outcome of a payment: status, amount, time, card brand, last four digits and the provider's transaction reference
• The payment provider handles cardholder data under its own privacy policy and its agreement with the merchant. It acts for the merchant, not as our sub-processor
• We hold the merchant's connection credentials for the provider in encrypted form and use them only to send payment instructions and receive results for that merchant

16.3 Data on the Device

Carima POS keeps a working copy of recent activity on the device it runs on, so that a brief loss of connection does not lose work.

• In a web browser, that copy is a temporary cache. Staff PINs are verified on our servers and are never stored in the browser
• Repeated failed PIN attempts lock the PIN
• A device joins a merchant's account with a one-time code, and a lost or stolen device can be revoked from the back office
• The register app for tablets, which is in development, is designed to keep its on-device data encrypted and its credentials in the operating system's secure storage

16.4 Retention

Order, payment and staff records are business records of the merchant. We keep them for the life of the merchant's subscription and delete or return them when the agreement ends, unless the law requires us to keep something longer. Merchants are responsible for their own statutory record-keeping periods.

16.5 AI Features

Carima POS includes AI features: taking orders by voice, phone and chat, taking reservations, answering questions about sales, managing the menu, prices and stock, giving the owner insights, and agents that a merchant creates. To provide them, the POS data a task needs is processed by the AI and speech sub-processors listed in Section 6 and in our Data Processing Addendum.

• What is processed: the menu, orders, stock and sales figures the task needs and, for phone and chat orders or reservations, the conversation with the guest and the contact details the guest provides
• Guests who call or message a merchant are told when they are dealing with an AI assistant; our Participant Terms apply to those conversations
• Our agreements with AI providers do not permit them to use this data to train their models
• Card data is never sent to an AI provider, because it never reaches Carima POS
• AI features assist the merchant and its staff. Actions that touch money, such as price changes and refunds, wait for a person's approval