Privacy Policy

1. Who is responsible

This website and the Cari Labs services are provided by Kevin Stefan Camargo Alonso (ABN 71 159 410 040), an individual trading under the business names “Cari Labs” and “Cari Group”. In this policy, “we” and “us” means Kevin Stefan Camargo Alonso.

This policy covers:

• The website gocarilabs.com and the content website marketingboutique.gocarilabs.com.
• The artificial intelligence agent “Cari” on WhatsApp.
• Diagnostic or audit requests, forms and appointments.
• Our relationship with our clients, and with people who contact our clients through an agent we set up (see section 14).

The internal “CARI Assistants” (gocarilabs.com/assistants) have their own policy and are not covered here.

Privacy contact: hola@gocari.com.au

Our commitment

We handle personal information in accordance with the Privacy Act 1988 (Australia) and the Australian Privacy Principles (APPs), although because of our size the law does not require us to meet all of its requirements. We also respect the data protection rules of people who write to us from other countries, as explained in sections 12 and 13.

2. What information we collect

If you complete a form, request a diagnostic or book an appointment

• Full name, your brand or company name, job title, email address.
• Phone number (optional, unless you choose to be contacted by phone call or WhatsApp).
• The service you are interested in, your preferred contact method and the message you write.
• The details requested by the booking calendar (name, email, phone and, if you add them, notes), and the date and time of the appointment.
• If you use the calculator on the site: the data you enter for the estimate.

If you talk to the agent on WhatsApp

• Your WhatsApp number and the profile name that WhatsApp shows us.
• The text of your messages and any information you give us (for example, name and email).
• The language and the service you are interested in.
• Appointment details: date and time.
• Internal notes that the agent or our team write about your conversation, and the stage it is at (for example, “interested” or “booked”).
• Technical records of each response: time, model used, tools used, errors and usage. These may include information you gave the agent.
• Your opt-out status, if you asked not to receive further messages.

Voice notes and images

For now the agent only handles text. If you send an audio file or an image, we do not process it and we ask you to write your question. WhatsApp and our WhatsApp provider may keep that file under their own policies.

If you visit the website

• Browser type, language, approximate country (inferred from your browser's time zone), referring page, pages viewed and performance metrics, using a 30-minute session cookie (see our Cookie Policy).
• Your IP address may be seen by the services that host or load content on the site (hosting, analytics, calendar, fonts).

If you are a client

Contact and billing details, the content and access you provide to set up your service, payment history and correspondence.

Data we ask you not to send

We do not ask you for card details, passwords or identity documents by message, and we ask you not to send them. We do not seek sensitive data (health, origin, beliefs, etc.). If you share it anyway, we use it only to respond to you.

How we obtain it

Directly from you (forms, WhatsApp, calendar), automatically when you visit the website, and from WhatsApp (your number and profile name). We do not buy contact lists.

3. What we use your information for, and on what basis

Marketing messages

Today we do not send marketing messages on our own initiative, and we do not make phone calls: the agent only replies to people who write to it. If we ever did, we would ask for your express permission first, identify ourselves, and give you a simple way to opt out.

We do not sell or share your personal information for advertising. We do not use your conversations to train AI models, and we do not allow our providers to do so.

We only use your information for the purpose for which we collected it, for related purposes you would reasonably expect, or with your consent or where required by law.

4. Artificial intelligence and automated decisions

“Cari” is an artificial intelligence agent. It presents itself as a virtual assistant and, if you ask whether it is an AI, it confirms that it is. It can make mistakes: please confirm important details with our team. Its replies are not a contract, an offer or professional advice.

What we send to the AI provider with each response

The recent messages in the conversation (up to 40), your name, your language, the service you are interested in, and whether we have a saved email address for you. We do not send your phone number. The content of your messages is sent exactly as you wrote it: if it includes personal information, that information is included.

What the agent decides on its own, using the information in your conversation

• Which appointment time to offer you, and which one.
• When to pass the conversation to a member of our team.
• When to stop replying (after you opt out, or because of limits against abuse).
• How to classify the stage of your conversation (for example, “interested” or “booked”).

These decisions do not affect your legal rights or your access to employment, credit, insurance, housing, health or essential services, and we do not make decisions of that kind using AI.

A member of our team can review and correct what the agent does. To speak with a person, write “persona”. If you believe a decision the agent made harmed you, write to hola@gocari.com.au and we will review it.

5. Who we share your information with

We share only what is necessary, with providers that act on our behalf:

Specific data that goes to Google

• Calendar: the event is called “Cita con Cari Labs”. If you gave us your email, Google sends you the invitation.
• Internal Chat (handover to a person): your name, the reason, an AI-written summary and a link to your WhatsApp number are posted.

How AI providers handle data

We send requests to providers with zero data retention and no use for training, and we ask OpenRouter not to store the content of conversations. OpenRouter keeps technical data about each request (for example, amount of text and response time). Each provider also has its own rules.

Other cases

We may disclose information where the law requires it (court order, competent authority), to protect our rights or the safety of people, or if the business is sold or transferred (in which case the new owner must respect this policy). We do not transfer your information to other people for them to use in their own marketing.

6. Sending information overseas

Several providers are located outside Australia, mainly in the United States, and process your information there or in other countries (for example, Ireland, Singapore or Colombia). Before sending information overseas we take reasonable steps to ensure the provider protects it in a manner consistent with this policy, and we remain accountable for those steps under Australian law. By using our services you understand that your information may be processed in those countries, which may have data protection laws different from Australia's.

7. How long we keep your information

We do not keep audio or images. Third-party providers have their own retention periods (see section 5). When we no longer need a piece of information, we delete it or anonymise it.

8. Security

We apply reasonable technical and organisational measures, such as:

• Encrypted connections.
• Access to the internal dashboard by user and role, and data-level access rules in the database.
• Keys and secrets kept out of browsers.
• Periodic deletion of technical copies of events.
• Logs that do not store the text of your messages.
• A procedure to delete a whole person's data on request.
• Access limited to those who need it for their work.

No system is completely secure and we cannot guarantee that a breach will never occur. If a breach occurs that is likely to cause you serious harm, we will notify you without unreasonable delay and notify authorities (for example, the OAIC) where the law requires it.

9. Cookies and trackers

Please see our Cookie and Tracker Policy.

10. Your rights

You can ask us at any time to:

• Access your information and obtain a copy in a commonly used format.
• Correct it if it is inaccurate or incomplete.
• Delete it, where the law allows.
• Stop receiving messages (reply STOP to the agent, or write to us).
• Withdraw consent you have given.
• Ask a person to review a decision the agent made.

Write to hola@gocari.com.au. We respond within a maximum of 30 days. We may ask you for information to confirm your identity. We do not normally charge for this; if the request is excessive, we will tell you about any cost before charging it.

When we delete your information, we remove it from our systems, including the calendar event in your name. Information that third parties already hold (for example, WhatsApp, Meta, YCloud, Google or AI providers) is governed by their policies and we cannot delete it on their behalf. If we refuse access or a correction, we will explain why in writing.

Complaints

Please write to us first: we acknowledge receipt within 5 business days and respond within a maximum of 30 days. If you are not satisfied, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC, www.oaic.gov.au) or with the data protection authority in your country.

11. Opting out

When you write “BAJA” (or “STOP”, “parar”, “detener” and equivalent expressions), the agent sends you a single confirmation and stops replying to you. We keep your number and the date of the opt-out to respect your decision, and we do not store the content of any messages you send afterwards. To speak with us again, write to hola@gocari.com.au.

12. If you are in Colombia

We handle your request in accordance with Law 1581 of 2012 and its regulatory decrees. You have the right to know, update, rectify and delete your information, to revoke your authorisation, to request proof of it, and to access your information free of charge. The responsible party is Kevin Stefan Camargo Alonso; the channel for exercising these rights is hola@gocari.com.au. You may lodge a complaint with the Superintendencia de Industria y Comercio (SIC).

13. If you are in the European Union, the European Economic Area or the United Kingdom

In addition to the above, you may ask us to restrict or object to processing, or to receive your information in a portable format, and you may lodge a complaint with your data protection authority. We process your information on the bases set out in section 3.

When we send information outside your region, we use the safeguards your law requires. We do not actively direct our services to those regions; if you contact us from there, we apply this section.

14. If you are a client's contact for an agent we set up for their business

When we operate an AI agent for a client's business, the people who write to that agent are the client's contacts. The client decides what their information is used for, and we process it on their behalf and according to their instructions, in order to provide the service, in accordance with the Terms of Service.

If you wrote to a business that uses our agent, you may also ask us for access or deletion at hola@gocari.com.au, and we will coordinate this with that business.

15. Children

Our services are not directed at people under 18 and we do not knowingly collect their information. If you believe a minor has written to us, let us know and we will delete it.

16. Links to other websites

Our website may link to third-party sites (for example, Instagram or WhatsApp). We do not control their privacy practices; please read their policies.

17. Changes

We may update this policy. We will publish the new version with its date and, if the change is significant, we will tell you by a reasonable means. Previous versions can be requested by email.

SMS & Voice Communication Consent

By providing your phone number, you consent to receive SMS and voice calls from Cari Group. Consent is not a condition of purchase. Message and data rates may apply.