Privacy Policy

1. Who we are and what this policy covers #

Itaimi Global Inc. (이타이미글로벌 주식회사), Unit A-054, Room 205, 2F, Bokjeong Building, 54 Maehwa-ro, Bundang-gu, Seongnam-si, Gyeonggi-do, Republic of Korea ("we", "us"), operates Cara Web at chat.caraaichat.com (the "Service"). We decide how and why your personal information is processed, so we are its controller (in Korean law, the personal information controller).

This policy covers the Service only. The Cara mobile app is a separate product with separate accounts and data, and its own privacy policy. Nothing you do in Cara Web is shared with the app, and the reverse.

Privacy questions and requests: support@karakoa.io. Our privacy officer is listed in section 15.

2. Summary #

• You sign in with Google. We receive your name, email address, profile photo and Google account identifier.
• You confirm that you are 16 or older to use the Service, and 18 or older to open mature characters or create images. We also ask for your birth year (not your full date of birth) and gender.
• We store your conversations so you can see your history and so characters can remember earlier parts of the conversation. You can delete conversations and your account at any time.
• Your messages are processed by AI models on Google Cloud Vertex AI to generate replies: Google Gemini by default, or a third-party model such as DeepSeek that Google hosts for us, if you choose it. The model's developer does not receive your messages.
• If you ask for an image, an image description written from the conversation is sent to ModelsLab, an image generation provider in the United States that is not part of Google Cloud. The image is stored in our storage and shown only to you.
• If you play a reply aloud, the reply text is sent to xAI in the United States, which turns it into speech. We do not store the audio.
• Our systems run on Google Cloud in the United States (region us-central1). Section 8 explains these international transfers, including those to ModelsLab and xAI.
• Authorized staff look at a conversation only when it is reported or when we must investigate abuse or a legal issue. Every such view is logged.
• Google Analytics runs only if you allow it. We never send your messages, other text you type, your name, email or profile details to analytics.
• If you send feedback from Settings, we keep your text and any screenshot you attach until you delete your account.
• If you subscribe to Cara Plus, you pay on TagadaPay's checkout page. Your card details go to TagadaPay, not to us. We keep only TagadaPay's customer and subscription ids, your plan, its status and when the current period ends.
• Unless you turn it off in Settings, we may use your conversations, with account details removed, to improve the Service, including evaluating and tuning AI models. Section 6 explains how.
• We do not sell your personal information and we do not use it for targeted advertising.

3. Information we collect #

When you subscribe to Cara Plus, you enter your card details on TagadaPay's checkout page, not on our site. TagadaPay receives your card details, your email address and your name to take the payment and manage the subscription. These card details never reach our servers, and we do not store them.

4. How we use your information and our legal bases #

We use personal information only for the purposes below. If we want to use it for a new purpose, we will update this policy and ask for your consent where the law requires.

You must provide your Google account information, your nickname, birth year and gender (or "Prefer not to say"), and your messages to use the Service: we need the birth year to check the age requirement, and characters use your nickname, age and gender to address you. Analytics, feedback, voice and the use of conversations to improve the Service are optional; not using them does not affect the rest of the Service.

We do not send marketing emails or advertising messages without your separate consent. We do not sell your information or use it for targeted advertising.

5. AI models, images and voice #

To generate a reply, the Service sends the AI model your new message together with the recent conversation, the character memory and the character's instructions. It also receives your nickname, your birth year (and the age calculated from it) and your gender, unless you chose "Prefer not to say", so characters can address you. Your Google account name, email and photo are not sent, unless you write them in a message.

• All text AI models run on Google Cloud Vertex AI in the United States, operated by Google LLC as our service provider. Under Google Cloud's terms, Google does not use this data to train its own models.
• The default model is Google Gemini.
• Where we offer them, you can choose third-party models for a conversation, such as DeepSeek. We use these models as hosted by Google on Vertex AI, so your messages stay within Google Cloud and are not sent to the company that developed the model.

Images. Image generation runs outside Google Cloud:

• When you ask for an image, a Gemini model on Vertex AI first writes a short image description from the recent conversation and the character. The description can include details from the conversation, and your nickname or gender if they are relevant.
• We send that description, the character's image settings and the options you chose to ModelsLab (M Studio AI, Inc., United States), which creates the image. We do not send your name, email, photo, account identifiers or the full conversation.
• We copy the finished image into our own storage on Google Cloud (Firebase Storage, us-central1). It is private: only you can see it, through a signed-in link that expires. Staff can see it only as part of a reported conversation (section 6).
• ModelsLab processes the description and image under its own terms and privacy policy. Section 8 lists what ModelsLab publishes about where and how long it keeps data.

Voice. Voice replies also run outside Google Cloud:

• When you play a reply aloud, we send the spoken part of that AI reply and the character's voice setting to xAI (X.AI LLC, United States). An xAI model first adds delivery cues such as a sigh or a laugh, and xAI then turns the text into speech.
• We send only the reply text, never your own messages, your name, email, photo or account identifiers. The reply can still contain your nickname or details from the conversation.
• We do not store the audio on our servers. Your browser may keep recent clips so you can replay them.

6. Conversation storage, staff review and service improvement #

• Conversations and character memory are stored in our database so you can come back to them. Only you can see them in the Service.
• When you delete a conversation, its messages, images and character memory are deleted. When you delete your account, all your conversations and images are deleted with it.
• Every message you send is checked automatically by a word filter. A blocked message is not sent to the AI engine.
• Authorized staff may open a conversation only when a message in it is reported, or when we must investigate abuse, a security incident or a legal issue. Staff access is limited to people who need it for that work, and each view is recorded with who viewed it, when, and why.

7. Who we share information with #

We do not sell personal information and we do not give it to third parties for their own marketing. We share it only as follows.

Service providers that process information on our behalf and under our instructions (in Korean law, entrusted processing):

We require our providers to protect personal information and use it only to provide their services to us. We will update this table before we add a new provider.

We may also disclose information when the law requires it (for example a valid court order or request from an authority), when it is needed to protect someone's life or safety, or to establish or defend legal claims. If the company or the Service is merged, acquired or sold, information may pass to the new owner, who must keep honouring this policy. We will notify you in advance.

8. International transfers #

We are based in the Republic of Korea, but the Service runs on servers outside Korea. Your personal information is therefore transferred abroad as described below. These transfers are necessary to provide the Service you signed up for, and we disclose them here as required by the Korean Personal Information Protection Act (PIPA Art. 28-8).

How to refuse: you can refuse these transfers by not using the Service or by deleting your account. Because the Service runs on Google Cloud, it cannot be provided without the Google Cloud transfer. You can refuse the Google Analytics transfer by not allowing analytics, the ModelsLab transfer by not using image generation, the xAI transfer by not playing replies aloud, and the TagadaPay transfer by not subscribing to Cara Plus. None of these choices limits the rest of the Service.

For users in the European Economic Area, the United Kingdom and Switzerland: the European Commission and the United Kingdom have recognised the Republic of Korea as providing an adequate level of protection. For onward transfers to Google in the United States, we rely on Google's certification under the EU-U.S. Data Privacy Framework (and its UK and Swiss extensions) and on the Standard Contractual Clauses in Google's data processing terms. For the transfers to ModelsLab and xAI in the United States, we rely on Standard Contractual Clauses. For the transfer to TagadaPay, we rely on the safeguards in our agreement with TagadaPay. You can ask us for a copy of the relevant safeguards.

9. How long we keep information #

When a retention period ends or the purpose is achieved, we delete the information without delay, normally within 5 days, using methods that make electronic records unrecoverable. We do not keep separate backups of our database, so deleted information is gone from the database and cannot be restored; copies in server logs expire with the log retention above. Copies kept by ModelsLab, xAI and TagadaPay are governed by their own policies (section 8). If a law requires us to keep information longer, we store it separately and use it only for that legal purpose.

10. Your choices and rights #

You can do the following yourself in the Service at any time: delete a conversation, change your default AI model, turn "Use my conversations to improve Cara" on or off, change your analytics choice, and delete your account.

For anything else, email support@karakoa.io from the email address of your account. We may need to confirm your identity first. We do not charge for requests, unless a request is clearly unfounded or excessive where the law allows a fee.

11. Cookies and similar technologies #

Cookies are small files a website stores in your browser. We use a few that the Service needs to work, and analytics cookies only if you allow them. We do not use advertising cookies.

Until you choose, analytics is off and the Google Analytics script is not loaded. If you allow analytics, we load it with Google Consent Mode set to deny all advertising uses, with Google signals and ad personalization turned off. We send page addresses without query strings or conversation ids, and in-app events: signing in or up; starting a conversation, sending or regenerating a message, receiving a reply, reporting a message and changing engine; viewing a character, the shop or your profile; confirming you are 18 or older; creating an image; playing a reply aloud; reaching a daily chat, image or voice limit; and using settings, tips, subscription and profile controls.

These events carry only: character and engine identifiers; fixed codes from a short list (for example a report reason, the screen an action came from, the settings action, the name of the profile field you changed, or the image quality mode); whole numbers (how long a reply took in milliseconds, the length of a reply or voice clip in characters, and image width and height in pixels); and yes/no values (whether you are subscribed, whether a voice clip worked, whether a setting was turned on). We never send message text or anything else you type, the values in your profile (such as your nickname, birth year or gender), your name, email, or account and conversation identifiers.

If your browser sends a Global Privacy Control signal and you have not made a choice, we treat it as a refusal and keep analytics off.

You can change your choice at any time below. If you turn analytics off, we stop collection straight away and delete the Google Analytics cookies. You can also block or delete cookies in your browser settings; blocking necessary cookies will stop sign-in from working. Google's own sign-in window sets cookies on Google's domains under Google's privacy policy, and TagadaPay's checkout page may set cookies on TagadaPay's domain under TagadaPay's policy.

12. How we protect information #

• Administrative: an internal privacy management plan, access limited to staff who need it, and privacy training for those staff.
• Technical: encrypted connections (HTTPS) for all traffic, encryption of stored data by Google Cloud, a database that only our servers can reach, access control based on roles, logging of staff access, and keys kept in a secrets manager.
• Physical: our systems run in Google Cloud data centers, which have their own physical access controls.

No system is perfectly secure. If a breach affects your personal information, we will notify you and the authorities as the law requires.

13. Children #

The Service is not for anyone under 16. We do not knowingly collect personal information from people under 16. If we learn that we have, we will close the account and delete the information. Mature characters and image generation are only for people who confirm they are 18 or older. If you believe a child is using the Service, contact support@karakoa.io.

14. Automated decisions #

The word filter decides automatically whether a message can be sent. A blocked message is not a penalty on your account. We do not suspend or close accounts based only on an automated decision: a person reviews the case first. You can ask us to explain a decision or have it reviewed by writing to us.

15. Privacy officer and contact #

Privacy officer

Kyung Hoon Lim, Chief Privacy Officer (Representative Director)

Email

support@karakoa.io

Phone

050-6427-3800 (+82-50-6427-3800)

Post

Itaimi Global Inc., Unit A-054, Room 205, 2F, Bokjeong Building, 54 Maehwa-ro, Bundang-gu, Seongnam-si, Gyeonggi-do, Republic of Korea

16. Complaints #

Please contact us first; we will try to resolve your concern. You can also contact a regulator or dispute body.

In the Republic of Korea:

• Personal Information Infringement Report Center (KISA): privacy.kisa.or.kr, phone 118
• Personal Information Dispute Mediation Committee: www.kopico.go.kr, phone 1833-6972
• Supreme Prosecutors' Office, cybercrime: www.spo.go.kr, phone 1301
• Korean National Police Agency, cybercrime: ecrm.police.go.kr, phone 182

In the European Economic Area, the United Kingdom or Switzerland: the data protection authority in the country where you live or work. In California: the California Privacy Protection Agency or the California Attorney General.

17. Notice for users in the United States #

This section is our notice at collection and privacy policy under the California Consumer Privacy Act as amended by the CPRA, and similar laws in other states. It uses the categories those laws define.

Sources, purposes (including improving the Service) and retention periods are described in sections 3, 4, 6 and 9. We disclose these categories only to service providers under contracts that limit their use to providing services to us.

Sale and sharing: we do not sell personal information and we do not "share" it for cross-context behavioral advertising, and we have not done so in the past 12 months. We do not knowingly sell or share the personal information of anyone under 16. Google Analytics runs only with your consent, with advertising features turned off, and we honour Global Privacy Control signals as a refusal.

Your rights: you can ask to know what personal information we collect, use and disclose, and get a copy; ask us to delete or correct it; and opt out of sale or sharing (which we do not do). We do not use sensitive personal information for purposes that would give you a right to limit it. We will not discriminate against you for using your rights. An authorized agent may make a request for you with your signed permission; we may ask you to confirm your identity directly. We respond within 45 days, which we may extend once by 45 days with notice.

Appeals: if we decline your request, you can appeal by replying to our decision or writing to support@karakoa.io. If we deny your appeal, you can contact the attorney general of your state.

18. Changes to this policy #

We will post any change on this page with a new version date, and tell you in the Service or by email at least 7 days before it takes effect, or at least 30 days before for important changes such as new purposes, new recipients or new countries. Where a change needs your consent, we will ask for it. Previous versions are available on request. See also our Terms of Service, Community Guidelines, Cookies and similar technologies and International transfers.