Privacy — the waitlist

This page covers one thing: what happens to your email address when you join the Cara waitlist. Cara itself is not open yet, so nothing else is being processed. When the product opens, a full privacy policy will replace this notice and you will be told before it does.

What we collect

Your email address — so we can email you when Cara opens.
Which page you signed up from, and whether you read it in English or Spanish. We use this to learn which parts of the idea people respond to.
A record of your consent — the moment you gave it and the exact wording you were shown, so consent can be proved against what you actually read rather than against today's copy.
Two one-way hashes, one for the confirmation link and one for the removal link. The links themselves are never stored.

We do not collect your IP address or your device details. Not "we discard them" — there is no field in the database that could hold one. Nothing here tracks you across other websites, and there is no advertising or analytics on this page.

Why we are allowed to

Your consent, and nothing else (GDPR Article 6(1)(a)). You ticked an unticked box, and then confirmed by clicking a link in an email — so the address is on the list only if someone with access to it agreed twice. You can withdraw that consent at any time, and withdrawing it is the same action as removal below.

How long we keep it

If you never confirm, the record is deleted within 30 days. An unconfirmed address has no completed consent behind it, so we do not keep it.
If you confirm but never become a customer, the record is deleted after 24 months.
If you ask to be removed, immediately — see below.

One honest caveat about "immediately". Our database keeps a 30-day restore history that we cannot switch off. Your record is gone from the live system the moment you ask, and we will not use it again — but for up to 30 days it remains technically recoverable from that backup history, after which it is gone entirely. We would rather tell you that than claim it is gone for good and be wrong about it.

Who else sees it

Cloudflare — hosts this site and stores the waitlist, and runs the "are you human" check on the form, which may set a cookie for that purpose alone.
Resend — sends the confirmation email and nothing else.

Both are bound by data-processing agreements and neither may use your address for their own purposes. We do not sell your address, share it for marketing, or send it anywhere else.

Removing yourself

Every email we send carries a one-click removal link, and it works without signing in to anything — there is no account to log into. You can also write toprivacy@cara.app and we will do it for you.

You also have the right to ask what we hold about you, to have it corrected, and to complain to your local data-protection authority.

Who is responsible

Cara, a sole proprietorship registered in Mexico. Contact:privacy@cara.app.

Back to Cara · En español