Privacy Policy.

We collect the information you provide when you create and use your account, and the content you build on CAURATE:

• Account information: email address, password (hashed), and your chosen username / handle.
• Site content: pages, subpages, text, images, videos, and other media you upload or embed.
• Usage data: basic server logs and error reports needed to keep the service running and secure.
• Billing information: subscription status and payment-related identifiers handled by our payment processor.

We use your data to:

• Provide, host, and maintain your CAURATE site.
• Process payments and manage subscriptions.
• Keep your account and our service secure.
• Respond to support requests and send service-related notices.

We do not sell your personal data. We do not use your content for advertising profiling.

We rely on the following legal bases under UK GDPR when we process your personal data:

• Performance of a contract — to create and maintain your account, host your pages, and provide the features of your chosen plan.
• Legal obligation — to keep billing and tax records, and to respond to lawful requests from authorities.
• Legitimate interests — to keep the service secure, prevent fraud and abuse, debug errors, and improve the product. We balance these interests against your rights and only rely on this basis where your rights do not override ours.
• Consent — where we ask for it (for example, for optional communications). You can withdraw consent at any time.

CAURATE runs on managed cloud infrastructure. The services we rely on to host and operate the platform include:

• Lovable Cloud — database, authentication, file storage, and serverless functions.
• Paddle — payment processing and subscription management.

Each subprocessor only receives the data necessary to perform its function and is contractually bound to protect it.

We use essential cookies and similar technologies to keep you signed in and secure. We do not use analytics or advertising cookies.

Your content is stored for as long as your account is active. When you delete a page or schedule your account for deletion, it enters a 30-day grace period before it is permanently removed. This gives you time to recover content if you change your mind.

After the grace period expires, we permanently delete your pages, media, and account record. Some information may remain in encrypted backups for a limited time, but it is not restorable as a live account.

If you are in the United Kingdom, you have rights under UK data protection law, including the right to access, correct, erase, restrict, or object to the processing of your personal data. You can update most account information from your CAURATE dashboard. For other requests, contact us using the details below.

We take reasonable measures to protect your data, including encrypted connections, access controls, and row-level security in our database. No online service can guarantee complete security.

If you have questions about this policy or want to exercise your data rights, email us at hello@caurate.com.

We may update this policy as our service evolves. When we make material changes, we will revise the effective date at the top of this page. Continued use of CAURATE after changes means you accept the updated policy.