Privacy Policy

At Caju ("we", "our", or "us"), we are committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our autism support tools platform.

Data Controller

Caju is an individual project operated by Bruno Gomes (Évora, Portugal), acting as a natural person. There is no incorporated company; Bruno Gomes is the data controller responsible for your personal information under the GDPR. For any data protection question or to exercise your rights, contact privacy@trycaju.com.

1. Information We Collect

1.1 Information You Provide

• Account information (name, email address, password)
• Profile information (age, preferences, therapy goals)
• User-generated content (AAC boards, visual schedules, custom images)
• Communications with us (support requests, feedback)

1.2 Automatically Collected Information

• Device information (device type, operating system, browser type)
• Usage data (features used, time spent, interaction patterns)
• Log data (IP address, access times, pages viewed)
• Cookies and similar tracking technologies

1.3 Health-related data

Some of the information you can enter into Caju is data concerning health, a special category of personal data under Article 9 GDPR: the autism support level recorded on a profile, the support types, the challenges selected, and the notes written by professionals.

The legal basis for this processing is your explicit consent under Article 9(2)(a) GDPR, given at signup when you accept the Terms of Service and this Policy. We record the date and the version of the text you accepted. Without that consent, the features that depend on this information cannot be used.

Where the profile is for a child you are not the legal guardian of — the typical case for a therapist or an educator — the consent the law requires is the child's parent or legal guardian's. Whoever creates the profile declares, under section 2.1 of the Terms of Service, that they have already obtained it and keep documented proof. We store each profile's creation date and the version of the Terms in force at that moment.

This data is never sold or used for advertising, is hosted in the European Union (Ireland), and is not sent to our artificial-intelligence providers: automatically generated text receives only the child's first name and observable session metrics. You can withdraw your consent at any time at privacy@trycaju.com, without affecting the lawfulness of processing carried out beforehand.

2. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve our services
• Personalize your experience and support tools
• Send important updates and notifications
• Provide customer support and respond to inquiries
• Analyze usage patterns to enhance our platform
• Detect, prevent, and address security issues or fraud
• Attribute recommendations: if you sign up through someone's recommendation link, we record who referred you. That person only ever sees how many people signed up, never your identity
• Comply with legal obligations

3. Data Sharing and Disclosure

We do not sell your personal information. We may share your information only in the following circumstances:

• With your consent: When you explicitly authorize us to share specific information
• Service providers: Third-party vendors who help us operate our platform (e.g., cloud hosting, payment processing, analytics)
• Shared profiles: If you share a profile with other users (e.g., therapists, family members), they will have access to that profile's data
• Legal requirements: When required by law, regulation, or legal process
• Business transfers: In connection with a merger, acquisition, or sale of assets
• Protection: To protect the rights, property, or safety of Caju, our users, or others

4. Data Security

We implement industry-standard security measures to protect your personal information, including:

• Encryption of stored data at rest
• Secure HTTPS/TLS connections (encryption in transit)
• Regular security audits and assessments
• Access controls and authentication measures
• Secure data storage with AWS infrastructure in the EU (eu-west-1, Ireland)

However, no method of transmission over the internet is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

5. Your Rights and Choices

You have the following rights regarding your personal information:

• Access: Request a copy of the personal information we hold about you
• Correction: Update or correct inaccurate information
• Deletion: Request deletion of your personal information (subject to legal obligations)
• Export: Download your data in a portable format
• Opt-out: Unsubscribe from marketing communications
• Restrict processing: Limit how we use your information

To exercise these rights, please contact us at privacy@trycaju.com.

6. GDPR Compliance (European Users)

If you are located in the European Economic Area (EEA), you have additional rights under the General Data Protection Regulation (GDPR), including:

• The right to lodge a complaint with a supervisory authority (in Portugal, the CNPD, Comissão Nacional de Proteção de Dados)
• The right to object to processing based on legitimate interests
• The right to withdraw consent at any time

Our legal basis for processing your data includes consent, contractual necessity, legal obligations, and legitimate interests.

7. Children's Privacy

Caju is designed to support individuals with autism, including children. We take children's privacy seriously and comply with applicable child protection laws. Parents and legal guardians are responsible for creating accounts and managing profiles for children. We do not knowingly collect personal information from children without parental consent.

8. Data Retention

We retain your personal information for as long as necessary to provide our services and fulfill the purposes outlined in this policy. When you delete your account, we will delete or anonymize your personal information, except where we are required to retain it for legal or regulatory purposes.

9. Cookies and Tracking Technologies

We use cookies and similar technologies to enhance your experience, analyze usage, and provide personalized content. You can control cookies through your browser settings, but disabling cookies may affect some features of our platform.

10. International Data Transfers

All Caju user data is stored and processed in the European Union (eu-west-1, Ireland). Limited operational data may be transferred to sub-processors outside the EU under appropriate safeguards (Standard Contractual Clauses or adequacy decisions).

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last updated" date. We encourage you to review this Privacy Policy periodically.

12. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: