Privacy Policy

Caelo ("Caelo," "we," "us," or "our") is built and operated by a small team focused on giving creators clear, convenient tools to run the business side of their work. We take the privacy of your financial information seriously.

This Privacy Policy explains what we collect, how we use it, who we share it with, and the rights and choices you have. It applies to the Caelo application and website at usecaelo.com (together, the "Service"). By using the Service, you agree to the practices described here.

Information you provide

• Account information — your name, email address, and, if you sign up with a password, a securely hashed password. If you sign in with Google, we receive your basic profile and email from Google.
• Profile and business details — optional information you add, such as your channel name, platform, business address, tax identification number, website, and display currency.
• The data you enter — the financial and business information you create in the Service, including revenue, expenses, brand deals, invoices, contracts, and media-kit content.
• Communications — messages you send us, such as support or feedback emails.

Information from connected services

• YouTube / Google — if you connect your channel, we store an encrypted OAuth refresh token and sync channel statistics and AdSense revenue figures so we can populate your dashboard.
• Stripe — if you connect Stripe, we store your API key in encrypted form so we can generate payment links on your invoices.

Information collected automatically

• Log and usage data — such as IP address, browser and device type, pages viewed, and timestamps, used to operate, secure, and improve the Service.
• Cookies — see the Cookies section below.

• Provide, maintain, and operate the Service — including syncing revenue, generating invoices and reports, and powering the features you use.
• Run the AI features you choose to use (see below).
• Authenticate you, keep your account secure, and prevent fraud and abuse.
• Communicate with you — send transactional messages (such as verification, password resets, and account notices) and, where permitted, product updates you can opt out of.
• Understand and improve the Service, generally using aggregated or de-identified data.
• Comply with legal obligations and enforce our terms.

When you use the contract analyzer, receipt scanner, or email-to-deal extractor, the content you submit for that feature is sent to the Google Gemini API for processing. We send only what is needed to perform the analysis and return the result to you. We do not retain the AI request beyond producing the result you see and save, and your content is not used to train our models or, to our knowledge under the applicable API terms, Google's models. Google's processing is governed by its own terms.

We do not sell your personal information. We share information only in the following limited circumstances:

• Service providers (subprocessors) who help us run the Service under confidentiality and data-protection obligations:
  • Supabase — database hosting.
  • Vercel — application hosting and performance monitoring.
  • Resend — transactional and product email.
  • Google — Gemini AI processing and YouTube data sync.
  • Stripe — payment-link generation, if you connect it.
• Legal and safety — when required by law, legal process, or to protect the rights, safety, and security of our users, the public, or Caelo.
• Business transfers — if Caelo is involved in a merger, acquisition, or sale of assets, your information may transfer as part of that transaction. We will notify you of any change in ownership or use of your information.

We keep your information for as long as your account is active. When you delete your account, we delete your account and associated personal data within 30 days, except where we must retain limited records to comply with legal obligations, resolve disputes, or enforce our agreements. Residual copies may persist in backups for a short period before being overwritten on a rolling basis.

• Sensitive credentials, such as YouTube refresh tokens and Stripe keys, are encrypted at rest using AES-256-GCM.
• Passwords are hashed with bcrypt (cost factor 12). We never store passwords in plain text.
• All traffic between you and the Service is encrypted in transit over HTTPS/TLS.
• Sessions use HTTP-only cookies; database access is restricted to the application under least-privilege principles.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. We work continually to protect your information and to improve our safeguards.

• Access and portability — you can export your data at any time from Settings, or by contacting us.
• Correction — you can edit your account and business information directly in the Service.
• Deletion — you can permanently delete your account and its data from Settings.
• Communication preferences — you can opt out of non-essential emails using the unsubscribe link in those messages.

EEA / UK users (GDPR). If you are in the European Economic Area or the United Kingdom, you have the right to access, rectify, erase, restrict, and port your personal data, and to object to certain processing. We process your data on the legal bases of performing our contract with you, our legitimate interests in operating and improving the Service, your consent (where applicable), and compliance with legal obligations. You may lodge a complaint with your local supervisory authority.

California users (CCPA/CPRA).If you are a California resident, you have the right to know what personal information we collect, to request its deletion or correction, and to opt out of its "sale" or "sharing." We do not sell or share your personal information, and we will not discriminate against you for exercising your rights.

To exercise any of these rights, contact us at the address below.

We and our service providers may process and store your information in countries other than the one in which you live. Where information is transferred internationally, we rely on providers that maintain appropriate safeguards for that data.

The Service is not directed to individuals under the age of 16, and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will take appropriate steps to delete it.

We use an essential, HTTP-only session cookie to keep you signed in. We do not use third-party advertising cookies. We may use privacy-respecting, aggregated analytics to understand overall usage and improve the Service.

We may update this Privacy Policy from time to time. If we make a material change, we will update the "last updated" date above and notify you by email or within the Service.

If you have questions about this Privacy Policy or how we handle your information, contact our team at [email protected] and we will be glad to help.