Privacy Policy

At Caju ("we", "our", or "us"), we are committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our autism support tools platform.

Data Controller

Caju is an individual project operated by Bruno Gomes (Évora, Portugal), acting as a natural person. There is no incorporated company; Bruno Gomes is the data controller responsible for your personal information under the GDPR. For any data protection question or to exercise your rights, contact privacy@trycaju.com.

1. Information We Collect

1.1 Information You Provide

• Account information (name, email address, password)
• Profile information (age, preferences, therapy goals)
• User-generated content (AAC boards, visual schedules, custom images, voice recordings)
• Communications with us (support requests, feedback)

1.2 Automatically Collected Information

• Device information (device type, operating system, browser type)
• Usage data (features used, time spent, interaction patterns)
• Log data (IP address, access times, pages viewed)
• Cookies and similar tracking technologies

1.3 Health-related data

Some of the information you can enter into Caju is data concerning health, a special category of personal data under Article 9 GDPR: the autism support level recorded on a profile, the support types, the challenges selected, and the notes written by professionals.

The legal basis for this processing is your explicit consent under Article 9(2)(a) GDPR, given at signup when you accept the Terms of Service and this Policy. We record the date and the version of the text you accepted. Without that consent, the features that depend on this information cannot be used.

Where the profile is for a child you are not the legal guardian of — the typical case for a therapist or an educator — the consent the law requires is the child's parent or legal guardian's. Whoever creates the profile declares, under section 2.1 of the Terms of Service, that they have already obtained it and keep documented proof. We store each profile's creation date and the version of the Terms in force at that moment.

This data is never sold or used for advertising, is hosted in the European Union (Ireland), and is not sent to our artificial-intelligence providers: automatically generated text receives only the child's first name and observable session metrics. You can withdraw your consent at any time at privacy@trycaju.com, without affecting the lawfulness of processing carried out beforehand.

2. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve our services
• Personalize your experience and support tools
• Send important updates and notifications
• Provide customer support and respond to inquiries
• Analyze usage patterns to enhance our platform
• Detect, prevent, and address security issues or fraud
• Attribute recommendations: if you sign up through someone's recommendation link, we record who referred you. That person only ever sees how many people signed up, never your identity
• Comply with legal obligations

3. Data Sharing and Disclosure

We do not sell your personal information. We may share your information only in the following circumstances:

• With your consent: When you explicitly authorize us to share specific information
• Service providers: Third-party vendors who help us operate our platform (e.g., cloud hosting, payment processing, analytics, sign-in)
• Advertising platforms: if you reached Caju through a Meta (Instagram, Facebook) or TikTok advertisement, that platform is told when the account is created, when a trial starts and when a payment is made, as described under "Advertising measurement". It never receives any information about a child
• Google sign-in: If you choose to sign in with your Google account, Google confirms your identity to us and we receive your name, your email address and an identifier for your Google account, which we store so we can recognise you next time. No information about a child is ever shared with Google, and this is optional: you can always use an email address and password instead
• Shared profiles: If you share a profile with other users (e.g., therapists, family members), they will have access to that profile's data
• Legal requirements: When required by law, regulation, or legal process
• Business transfers: In connection with a merger, acquisition, or sale of assets
• Protection: To protect the rights, property, or safety of Caju, our users, or others

4. Data Security

We implement industry-standard security measures to protect your personal information, including:

• Encryption of stored data at rest
• Secure HTTPS/TLS connections (encryption in transit)
• Regular security audits and assessments
• Access controls and authentication measures
• Secure data storage with AWS infrastructure in the EU (eu-west-1, Ireland)

However, no method of transmission over the internet is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

5. Your Rights and Choices

You have the following rights regarding your personal information:

• Access: Request a copy of the personal information we hold about you
• Correction: Update or correct inaccurate information
• Deletion: Request deletion of your personal information (subject to legal obligations)
• Export: Download your data in a portable format
• Opt-out: Unsubscribe from marketing communications
• Restrict processing: Limit how we use your information

To exercise these rights, please contact us at privacy@trycaju.com.

6. GDPR Compliance (European Users)

If you are located in the European Economic Area (EEA), you have additional rights under the General Data Protection Regulation (GDPR), including:

• The right to lodge a complaint with a supervisory authority (in Portugal, the CNPD, Comissão Nacional de Proteção de Dados)
• The right to object to processing based on legitimate interests
• The right to withdraw consent at any time

Our legal basis for processing your data includes consent, contractual necessity, legal obligations, and legitimate interests.

7. Children's Privacy

Caju is designed to support individuals with autism, including children. We take children's privacy seriously and comply with applicable child protection laws. Parents and legal guardians are responsible for creating accounts and managing profiles for children. We do not knowingly collect personal information from children without parental consent.

8. Data Retention

We retain your personal information for as long as necessary to provide our services and fulfill the purposes outlined in this policy. When you delete your account, we will delete or anonymize your personal information, except where we are required to retain it for legal or regulatory purposes.

9. Cookies and Tracking Technologies

We use three kinds of cookies and similar technologies, and we do not treat them the same way.

• Strictly necessary. Keeping you signed in, remembering your language, and keeping the app working. Caju cannot function without these. The sign-in and sign-up pages also load Google's sign-in component, which can read Google's own cookies so the button knows whether you are signed in to Google. It is only on those two pages, never inside the app.
• Product analytics. We measure which screens are opened and where people stop, using PostHog on European infrastructure. We never record the screen, never capture taps or typing, and never attach a child's profile to what we measure.
• Advertising measurement. When we run campaigns on Instagram, Facebook or TikTok, a Meta pixel and a TikTok pixel on our public pages tell us whether an advertisement led to an account being created. They send a page address and a device identifier to Meta and to TikTok, which act as joint controllers for that data and process it outside the European Union.

The pixels run only on our public website: the marketing pages and the signup page. They are never loaded once you are signed in. If you reached Caju through an advertisement, our servers also tell the platform that showed it, and only that one, when the account is created, when a trial starts and when a payment is made within 30 days of the click. That report carries only the click identifier the platform itself put on the link, an encrypted account code that does not say who you are, and the payment amount. It never carries a name, an email address, a therapy note, any information about a child, or anything you do inside Caju.

You can refuse advertising measurement by blocking third-party cookies in your browser, or by using a browser or extension that sends a Global Privacy Control signal, which we honour. Refusing it changes nothing about your use of Caju. You can also ask us to stop at any time by writing to privacy@trycaju.com.

10. International Data Transfers

All Caju user data is stored and processed in the European Union (eu-west-1, Ireland). Limited operational data may be transferred to sub-processors outside the EU under appropriate safeguards (Standard Contractual Clauses or adequacy decisions).

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last updated" date. We encourage you to review this Privacy Policy periodically.

12. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: