Privacy Policy
1. Controller and contact
Emir Kaan Inan, trading as Carelto
Kaiserstraße 242
45699 Herten, Germany
Email: [email protected]
This notice concerns the Carelto website, account, AI workspace, API and support. Contact us to ask about processing or exercise your rights.
2. Website access and security
Requests to our infrastructure disclose your IP address, requested URL, request time and browser information. We process technical information to deliver the site and protect it from abuse. The intended legal basis is legitimate interests in reliable and secure operation (Article 6(1)(f) GDPR). Hosting location, service provider and access-log retention are pending confirmation.
3. Accounts and authentication
Account information includes your name, email address, authentication records, security settings and, for password accounts, a password hash. We use it to create and administer your account and secure access (Article 6(1)(b) GDPR, and Article 6(1)(f) for abuse prevention). Verification and transactional messages are sent through an email service; the code integrates Resend. The active provider and its processing agreement must be confirmed.
If you choose Google, GitHub or Discord sign-in, you are redirected to that provider and we receive account identifiers and permitted profile/email information. The provider processes your interaction under its own notice. Choosing OAuth is separate from allowing optional website visuals.
4. AI requests and workspace content
To perform a request, we process prompts, relevant conversation context, uploaded content, model choices and generated results. Requests can be sent through an upstream AI service to the selected model provider. The code integrates api.airforce. The active routing, recipients, processing locations, retention and any provider use for training must be confirmed before this notice is published. We do not claim that providers never retain or train on content.
The legal basis for supplying requested AI functionality is Article 6(1)(b) GDPR. Avoid submitting information about others unless you have a lawful basis. Chat and support history may also be stored in your browser; clearing that storage removes that local copy.
5. Credits, payments and usage
We process credit balances, request-usage records, payment references and transaction status to provide paid access, settle purchases and investigate discrepancies (Article 6(1)(b) GDPR). Records required by tax or accounting law are retained under Article 6(1)(c). The code supports Solana payments, including wallet addresses and public transaction identifiers. Blockchain records can be publicly accessible and cannot be erased by Carelto. Confirm the active payment processor/RPC services and statutory retention schedule before publication.
6. Support
We process messages and attachments you provide to address support requests, on Article 6(1)(b) or Article 6(1)(f) depending on the enquiry. Confirm whether automated support, external AI support processing or Discord forwarding is enabled and identify the recipients before publication.
7. Cookies, local storage and optional visuals
The Cookie Policy describes the identified storage. Optional Unsplash visuals are loaded only after your choice. This discloses technical request information, including your IP address, to the image service. Consent is the intended legal basis under Article 6(1)(a) GDPR where applicable. You can withdraw it through Cookie settings; withdrawal affects future processing, not processing already carried out.
The prepared frontend serves fonts locally. The reviewed frontend contains no identified advertising or audience-tracking integration; the live infrastructure and any externally injected tracking still require confirmation.
8. Recipients and international transfers
Recipients may include infrastructure and email processors, authentication providers you select, upstream AI providers and payment services. We may disclose information where legally required. Before publication, document the legal entities, processing roles, countries, agreements and applicable transfer safeguards for each active provider. No unverified adequacy decision or contractual safeguard is represented as being in place.
9. Retention
Sessions expire after seven days; OAuth state expires after ten minutes. Cookie choices expire after 365 days. Other browser records remain until deleted by the relevant feature or browser cleanup. Account, prompt, support, usage, security, backup and accounting retention schedules require confirmation. Account deletion does not automatically remove statutory financial records or public blockchain records.
10. Your rights
Depending on the applicable conditions, you can request access, correction, erasure, restriction and portability, object to processing based on legitimate interests, and withdraw consent. Contact [email protected]. You can also complain to a competent supervisory authority, including LDI NRW. We may need proportionate information to verify a request.
11. Required information and automated decisions
Some account and request information is needed to provide the service; without it we cannot supply the relevant function. Optional visuals are not required. Confirm whether any processing constitutes solely automated decision-making with legal or similarly significant effects before finalising this section.