Privacy Policy

Last updated:

1. Introduction

This Privacy Policy describes how Cave ("we", "our", or "us") collects, uses, and protects your personal information when you use our service. Your privacy is important to us, and we are committed to protecting your personal data in accordance with applicable data protection laws, including the General Data Protection Regulation (GDPR).

2. Data Controller

Cave is the data controller responsible for your personal information. If you have questions about this Privacy Policy or our data practices, please contact us at [email protected].

3. Information We Collect

3.1 Information You Provide

We collect information that you provide directly to us, including:

  • Account Information: Name, email address, password, and username
  • Profile Information: Profile picture and any details you choose to share
  • Content: Messages, conversations, and interactions within cases

3.2 Automatically Collected Information

We automatically collect certain information when you use our service:

  • Usage Data: How you interact with our service, including features used and timestamps
  • Device Information: Device tokens for push notifications
  • Activity Data: Last active timestamps

4. Legal Basis for Processing

We process your personal data based on the following legal bases:

  • Consent: When you provide explicit consent for data processing and third-party sharing
  • Contract: To provide and maintain our services as agreed in our Terms and Conditions
  • Legitimate Interest: To improve our services, ensure security, and prevent fraud

5. How We Use Your Information

We use the information we collect to:

  • Provide, maintain, and improve our services
  • Process your registration and manage your account
  • Enable communication within cases and shared spaces
  • Generate AI-powered responses and suggestions using language models
  • Send you service-related notifications
  • Respond to your inquiries and provide customer support
  • Ensure security and prevent fraud

6. Data Processing and Third-Party Sharing

6.1 AI Service Provider

Our service uses Google's Gemini API to provide AI-powered functionality, including generating responses, summaries, embeddings, and images. When you use these features, the relevant content you submit (such as your messages, conversations, or images) is transmitted to Google's servers for processing.

Under our agreement with Google:

  • No model training on your data: Your prompts and the corresponding responses are not used to train or improve Google's AI models.
  • Limited retention for safety: Google logs a limited amount of data solely for detecting and preventing violations of its acceptable use policy and for complying with legal obligations.
  • No additional third-party AI providers: We do not share your content with any other third-party language model or AI provider.

For full details on Google's processing, see the Gemini API Additional Terms of Service.

6.2 Voice Input

When you use voice input in our iOS applications, your speech is transcribed locally on your device using Apple's built-in Speech framework. The audio recording itself is not transmitted to our servers or to any third party. Only the resulting text is sent to our service for processing in the same way as text you type.

6.3 Data Processing Agreements

We maintain a data processing agreement with Google to ensure that personal data transmitted in connection with the Gemini API is handled in accordance with applicable data protection laws, including the GDPR.

6.4 Marketing Attribution

To measure the effectiveness of our advertising and understand how users discover Cave, we use AppsFlyer (a mobile attribution provider) and Apple's SKAdNetwork. These services may receive your device's advertising identifier (IDFA), install timestamps, and campaign attribution information. The IDFA is only collected if you grant permission via the iOS App Tracking Transparency prompt. AppsFlyer's privacy practices are described in their Services Privacy Policy. You can disable tracking entirely by denying the App Tracking Transparency prompt or toggling tracking off in iOS Settings → Privacy & Security → Tracking. Apple's SKAdNetwork operates without collecting personally identifiable information.

6.5 Subscription Billing

Subscriptions purchased through Apple's App Store are processed by Apple. We receive transaction confirmations and entitlement data from Apple to provide access to paid features, but we do not receive your full payment method details. Apple's handling of your payment information is governed by their privacy policy.

7. Data Retention

We retain your personal data for as long as necessary to provide our services and comply with legal obligations:

  • Account Data: Retained until you delete your account
  • Deleted Accounts: Data is soft-deleted immediately and permanently deleted after a 30-day grace period
  • Conversations: Retained until you delete your account or specific conversations
  • Analytics Data: Retained for up to 30 days

After the retention period, your data will be permanently deleted from our systems. You can request deletion of your account at any time through your account settings.

8. Your Rights Under GDPR

As a data subject, you have the following rights:

  • Right of Access (Article 15): You can request a copy of all your personal data. You can download your data from your account settings.
  • Right to Rectification (Article 16): You can update your personal information through your account settings.
  • Right to Erasure (Article 17): You can delete your account at any time. Your data will be permanently deleted after a 30-day grace period.
  • Right to Restrict Processing (Article 18): You can request that we limit how we process your data.
  • Right to Data Portability (Article 20): You can download your data in a structured, machine-readable format.
  • Right to Object (Article 21): You can object to certain types of data processing.
  • Right to Withdraw Consent (Article 7): You can withdraw your consent at any time by contacting us or deleting your account.

To exercise any of these rights, please contact us at [email protected] or use the features available in your account settings.

9. Data Security

We implement appropriate technical and organizational measures to protect your personal information, including:

  • Encryption of data in transit using HTTPS
  • Secure password hashing
  • Access controls and authentication
  • Regular security assessments

However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials.

10. International Data Transfers

Your data may be transferred to and processed in countries outside the European Economic Area (EEA), including the United States, where our third-party providers operate. We ensure appropriate safeguards are in place for such transfers, including:

  • Standard Contractual Clauses (SCCs) with third-party providers
  • Verification that providers maintain adequate data protection measures

11. Data Breach Notification

In the event of a data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and inform affected users without undue delay.

12. Cookies and Tracking

Our website uses essential cookies necessary for the operation of our service. We do not use cross-site behavioural advertising cookies. Our mobile applications may collect the iOS Advertising Identifier (IDFA) for attribution purposes, but only with your explicit consent through the App Tracking Transparency prompt. See Section 6.4 for full details on marketing attribution.

13. Children's Privacy

Our service is not intended for children under the age of 16. We do not knowingly collect personal information from children under 16. If you believe we have collected information from a child under 16, please contact us immediately at [email protected].

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify users of significant changes by updating the "Last updated" date and, where required by law, obtaining renewed consent. Your continued use of the service after changes constitutes acceptance of the updated policy.

15. Contact Us

If you have any questions about this Privacy Policy, your personal data, or wish to exercise your rights, please contact us at [email protected].

For GDPR-related inquiries, you also have the right to lodge a complaint with your local data protection authority.