Privacy Policy

Effective 11 November 2026

On this page

1. Who we are and what this covers
2. What we collect
3. How we use it
4. AI models and what they see
5. Device data and health
6. Who we share it with
7. Legal bases
8. How long we keep it
9. Your rights and choices
10. Security
11. International transfers
12. Children
13. Self-hosted servers and telemetry
14. Google user data
15. Changes to this policy
16. Contact us

1. Who we are and what this covers

Casama is made by Stackwares, based in the Philippines ("we", "us"). We are the personal information controller for the data described here.

This policy covers:

• Casama Cloud, the hosted service we run;
• the Casama apps for iOS, Android, macOS, Windows, Linux and the web, and the Casama CLI, when they connect to Casama Cloud;
• this website, casama.ai.

Casama can also be self-hosted. A self-hosted server is run by whoever hosts it, and they decide what happens to the data on it. We don't receive that data. See Self-hosted servers and telemetry.

We follow the Philippine Data Privacy Act of 2012 (Republic Act No. 10173). We also give everyone, wherever they live, the rights described in Your rights and choices.

2. What we collect

Account information

• Your email address, and your name if you give it or your sign-in provider shares it.
• If you sign in with Apple or Google, an identifier from that provider. With Apple you can choose to hide your email.
• Your password, stored only as a secure hash, and your two-step sign-in authenticators if you set them up.
• Your profile: the name bots should call you, pronouns, how you like replies, what you write under About you, and facts bots learn about you if Learn about me from chats is on.

Your content

Everything you and your bots create in Casama: conversations, messages, attachments, memories, skills, routines, pages, tickets, knowledge sources, files on your bots' computers, voice transcripts, and the history of each run (tool calls, outputs and errors).

Keys, secrets and connections

Model keys, app connection tokens and secrets you give your bots. These are kept in an encrypted vault on the server. They are never shown back to you in full, never put into a model's input, and never included in exports.

Device data, only if you turn it on

Calendar, contacts, health summaries, named places, notifications from apps you pick, and computer activity summaries. Each kind is off until you switch it on. See Device data and health.

Voice

Microphone audio when you dictate, read aloud, or start a live call. The wake word on desktop and Android is detected on your device, and no audio leaves it until a call starts.

Purchases

Your plan, subscription status, credit balance and purchase records, such as store transaction and order ids. Card details are handled by Apple, Google or Dodo Payments. We never see your full card number.

Usage and technical data

• Usage records: model tokens, computer time, costs and similar counts, so we can show usage and bill credits.
• An audit log of admin actions, approvals and credential changes in your workspace.
• Push notification tokens for your devices, and basic device and app details such as platform and app version.
• Request data our servers need to work and stay safe, such as IP addresses.
• Signals that protect sign-up and our computers from abuse, such as a sign-up check token and blocked network attempts from a bot's computer.

Error reports

If error reporting is turned on in an app build or on our servers, crash and error reports are sent to an error reporting service. Before they leave, they are scrubbed of message text, prompts, secrets and email addresses. They are not used for tracking.

When you contact us

Your email address and whatever you write to us.

This website

casama.ai sets no cookies and runs no analytics or ad scripts. Cloudflare, which serves the site, processes standard request data such as IP addresses to deliver it and block attacks.

3. How we use it

• To provide Casama: run your bots, their tools and computers, sync your data across devices, and send notifications.
• To bill paid plans and credits, and show your usage.
• To keep Casama secure: prevent fraud, spam, abuse and attacks, and enforce our Terms of Service.
• To answer your support requests and send important messages about your account, such as sign-in links and changes to these terms.
• To fix bugs and improve reliability, using error reports and aggregate counts.
• To meet legal obligations.

We don't sell or rent your personal information. We don't use it for advertising. We don't train AI models on your content.

4. AI models and what they see

To answer you, a bot sends the conversation and relevant context (such as memories, skills, tool results, your profile, and device data you allowed) to an AI model provider.

• Your own key. If you add a key for OpenAI, Anthropic, Google, xAI, OpenRouter or another provider, or sign in with a ChatGPT plan, requests go to that provider under your account and their terms and privacy policy.
• Casama credits. If you use credits we provide, requests go through our account with a model provider or router, such as OpenRouter. We send only what the request needs.
• Local models. If you point a bot at a model on your own machine or network, the content stays there.

What models never see:

• Secrets. Bots use placeholders. The real value is filled in only when a request goes to a host the secret allows, after the model has written the call. Known secret values are removed before anything reaches a model, the run history or logs.
• Model keys and connection tokens. These stay in the server's vault and are used by the server, not the bot.
• Card details for bot payments. Bots see placeholders only.
• What you type while you control a bot's computer. While you hold control, input is not recorded and screenshots are not sent to the model.

Model providers have their own policies about storing and using the data they receive. Check them for the providers you choose.

5. Device data and health

Device connections let bots use personal data from your phone or computer. These rules apply:

• Each kind is off until you turn it on. The system permission prompt appears only then.
• Turning a kind on doesn't give any bot access. A bot must ask, and you tap Allow. You can revoke a bot at any time.
• A bot reads your device data only in runs acting for you. A teammate using the same bot gets nothing, and workspace admins can't see it.
• Every read shows on the run's timeline: which kind, how many items, which dates and which devices.
• You can mark a kind Private models only, so only bots whose models all run on your own machine or private network can read it.
• Bots don't learn facts about you from runs that used personal device data.

What each kind shares:

By default, daily summaries are kept for a year, and places and notifications for 90 days. You can shorten this for each kind, or choose "live only" so nothing is stored. Turning a kind off deletes what it stored. Forgetting a device deletes everything it shared.

Health data. On Casama Cloud, health data is stored only in encrypted form, and only once you have turned on encryption for a workspace you own. We never use health data for advertising or marketing, never sell it, and never use it to train AI models. Bots don't give medical advice.

6. Who we share it with

We share data only with service providers that help us run Casama, with services you choose to connect, or when the law requires it. Providers may use it only to provide their service to us or to you.

People in your workspace. Content in a shared workspace is visible to its members according to their roles. Your profile name and pronouns are visible to teammates. Your About you details, learned facts and device data are private to you.

Legal reasons. We may disclose data if the law requires it, to respond to valid legal process, or to protect the rights, safety or property of our users, the public or us. Where we can, we tell you first.

Business changes. If Stackwares is involved in a merger, acquisition or sale of assets, your data may transfer as part of it. This policy, or one at least as protective, will continue to apply, and we will tell you.

7. Legal bases

Where the law requires a legal basis for processing, we rely on:

• Contract: to provide the service you signed up for.
• Consent: for device data, health data, and anything else you switch on. You can withdraw consent at any time by switching it off.
• Legitimate interests: to keep Casama secure, prevent abuse and fix problems, in ways you would reasonably expect.
• Legal obligation: for example, keeping billing records.

8. How long we keep it

• Your account and content: until you delete them, or delete your account.
• Run history: 180 days by default. Workspace owners and admins can change this from 30 to 730 days in the app, or 7 to 3,650 days through the API. Older run events are deleted automatically every day.
• Device data: as described in Device data and health.
• Billing records: as long as tax and accounting laws require.

When you delete your account

• Right away: you are signed out everywhere, your devices stop getting notifications, and your device data is deleted.
• After a 7-day grace period: your account, and every workspace where you are the only owner, with its bots, chats and computers (including computer snapshots). The app shows the exact date.
• Shared workspaces with another owner keep their data. Only your membership is removed.

A workspace where you are the only owner is deleted with your account, even if other people use it. Make someone else an owner first if it should stay.

Copies in our backups are removed as those backups expire.

9. Your rights and choices

Wherever you live, you can:

• Access and export your data. In the app, go to Settings → Privacy → Export my data, or run casama account export. You get a ZIP of JSON files with everything you can see. Secrets and keys appear by name only.
• Correct your data. Edit your profile and content in the app, or ask us.
• Delete your data. Delete individual items in the app, or your whole account at Settings → Privacy → Delete my account.
• Object to or restrict how we use your data, and withdraw consent for anything you switched on.
• Be informed about how we process your data, which is what this policy is for.
• Complain to a data protection authority. In the Philippines, that is the National Privacy Commission (privacy.gov.ph). You can also complain to the authority where you live.

For anything you can't do in the app, email privacy@casama.ai. We may need to confirm it's you. We aim to reply within 30 days. We won't treat you differently for using these rights.

If your data is in a workspace run by your employer or another organization, they control that workspace. We may refer your request to them.

10. Security

We protect your data with:

• Encrypted connections (TLS) everywhere.
• Row-level security on every database table, so one workspace can't read another's data.
• Keys and secrets in an encrypted vault, never returned by the API.
• Optional encryption at rest for workspace content, with a key per workspace.
• Two-step sign-in, which workspaces can require for owners and admins.
• Isolated computers for bots, with a network proxy that blocks private and internal addresses.
• Approvals before risky bot actions, and checkpoints before destructive commands.

No system is perfectly secure. If a breach affects your personal data, we will notify you and the National Privacy Commission as the law requires. To report a security issue, email security@casama.ai.

11. International transfers

We are based in the Philippines. Some of our service providers, and the AI model providers you choose, process data in other countries, including the United States. When data moves across borders, we use providers that commit to protecting it, and we take the steps the law requires, such as contractual safeguards.

12. Children

Casama is not for children under 13, or under 16 where local law sets a higher age for consent. We don't knowingly collect data from them. If you believe a child has given us personal data, email privacy@casama.ai and we will delete it.

13. Self-hosted servers and telemetry

If you use a Casama server that you or someone else runs, the data on it stays on that server. The person or organization running it is responsible for it. Ask them about their privacy practices.

A self-hosted server sends us nothing by default. If its owner turns on the usage ping (TELEMETRY=on), it sends us once a week: a random instance id, the Casama version, and the number of bots and users active in the last 7 days. Nothing else.

If a self-hosted server uses Cloud Connect for our cloud computers or model credits, the data needed for those requests passes through Casama Cloud and this policy applies to it.

The official apps may still use Apple or Google services (such as push notifications) when connected to a self-hosted server, as described above.

14. Google user data

When you connect a Google account (for example Gmail, Google Calendar or Google Drive), Casama uses the data only to do what you ask your bots to do, shown in the app. Casama's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We don't use Google user data for advertising, don't sell it, and don't use it to train AI models. People can't read it unless you ask us to for support, it's needed for security, or the law requires it. You can disconnect a Google account at any time from the connection's page, which deletes its stored token.

15. Changes to this policy

We may update this policy as Casama changes. We will post the new version here with a new effective date. If a change is significant, we will tell you in the app or by email before it takes effect.

16. Contact us

Stackwares, Philippines.

• Privacy questions, data requests and our data protection officer: privacy@casama.ai
• Help with the apps or your account: support@casama.ai
• Security issues: security@casama.ai
• Plans, invoices and refunds: billing@casama.ai
• Anything else: hello@casama.ai