Cardumen

Legal · v1

Privacy Policy

How Cardumen.ai handles account, billing, support and product data.

Last updated: July 22, 2026 Version: 1.0 Legal framework: Chilean Law No. 19,628 and Law No. 21,719 (in force from December 1, 2026, creating the Personal Data Protection Agency). For users in the United States, references to California's CCPA/CPRA also apply. Chile is the base jurisdiction; specific sections for other jurisdictions apply according to the data subject's location.

Effective-date note: Law No. 21,719 enters into full force on December 1, 2026. This Policy is drafted to meet that standard.

1. Data controller

The data controller is Grow Capital Technologies SpA, RUT 78.255.487-5, domiciled at Avda. Providencia 1208, Providencia commune, Metropolitan Region, Chile ("Cardumen.ai").

Privacy channel / Data Protection Officer: contacto@cardumen.ai.

2. Definitions

  • Personal data: information linked to an identified or identifiable natural person.
  • Sensitive data: ethnic origin, political or union affiliation, beliefs, health, sex life or sexual orientation, biometric data and others.
  • Data subject: the natural person to whom the data relates.
  • Processing: any operation performed on personal data, including collection, storage, use, communication and deletion.
  • Processor: a third party that processes data on Cardumen.ai's behalf.

3. Principles

Cardumen.ai processes data according to the principles of lawfulness and fairness, purpose limitation, proportionality, quality, security, proactive accountability, transparency and confidentiality established by Law No. 21,719.

4. Data we process

  • Registration and account data: name, email, credentials and organization data.
  • Billing data: payment data processed through our payment provider (Cardumen.ai does not store full card numbers).
  • Platform usage data: input and generated content, activity logs, IP address, device identifiers and cookies.
  • Support data: communications sent to us by the data subject.

The data subject is responsible for not adding third-party personal data to an input without a lawful basis, or sensitive data without authorization.

5. Purposes and legal basis

PurposeLegal basis
Provide the service and manage the accountPerformance of the contract
Process payments and issue tax documentsLegal obligation / performance of the contract
Security, fraud prevention and abuse preventionLegitimate interest
Support and operational communicationsPerformance of the contract
Improve AI modelsSpecific and separate consent (see section 6)
Direct marketingConsent (opt-in, revocable)
Comply with authority requestsLegal obligation

6. AI model training

Cardumen.ai does not use user input or generated content to train its models unless the data subject gives specific, prior and informed consent, through a separate option that can be revoked at any time.

When analysis uses effectively anonymized data (irreversibly dissociated so that a person cannot be reidentified), that information is no longer personal data and is not subject to this Policy. Cardumen.ai does not invoke "anonymization" as a pretext for processing that still allows reidentification.

7. Automated decisions

The Platform generates content and assists the user, but does not make decisions based solely on automated processing that produce legal effects or significantly affect the data subject. If this type of processing is added in the future, the data subject will be informed and the safeguards in the relevant article of Law No. 21,719 will be enabled, including human intervention, explanation and challenge.

8. Retention periods

Data is kept while the account and contractual relationship exist, and afterward for the applicable legal periods, including tax, accounting and limitation periods. Once those periods expire, data is deleted or anonymized.

Reference periods by category: billing data: 6 years (tax and accounting obligations); input and generated content: 12 months after account closure; security and audit logs: 12 months.

9. Processors and international transfers

To provide the service, Cardumen.ai shares data with processors acting under its instructions and a data processing agreement (DPA). Servers and infrastructure are hosted outside Chile (Amazon Web Services — AWS), which involves international data transfers.

These transfers use appropriate safeguards under Law No. 21,719, including contractual clauses, equivalent security measures and the provider's confidentiality commitments. Processor categories include:

  • Infrastructure and hosting: Amazon Web Services (AWS), United States
  • Payment processing: Stripe, Inc., United States
  • AI model providers: the model provider selected by the user or organization, such as Anthropic or OpenAI, United States
  • Transactional email: Resend, United States
  • Analytics and advertising measurement: Google and Meta, United States (only after cookie consent)

10. Information security

Cardumen.ai applies reasonable technical and organizational measures, including encryption in transit and at rest, access control, audit logs and periodic vulnerability assessments. No measure guarantees absolute security.

11. Security breach notification

If a breach affects personal data, Cardumen.ai will notify the Personal Data Protection Agency without undue delay and, as a reference, within 72 hours of becoming aware of it. It will inform affected data subjects when the breach creates a high risk to their rights, according to Law No. 21,719.

12. Data subject rights (ARCOP + Blocking)

The data subject may exercise the following rights:

  • Access — learn what data we process and for what purpose.
  • Rectification — correct inaccurate or incomplete data.
  • Cancellation / Deletion — delete data when appropriate.
  • Objection — object to a specific processing activity.
  • Portability — obtain and transfer data in a structured format.
  • Blocking — temporarily suspend processing while a request is resolved.

How to exercise them: send a request to contacto@cardumen.ai. We may request identity verification to protect the data subject.

Deadlines under Law No. 21,719: we will respond within a maximum of 30 business days, extendable once by up to 30 additional business days when complexity justifies it, informing the data subject. Temporary blocking requests are resolved within 2 business days.

Complaint to the authority: if a request is not handled within the deadline or the data subject is not satisfied, they may complain to the Personal Data Protection Agency within the legal periods.

12 bis. California resident rights (CCPA / CPRA)

If you are a California resident in the United States, the California Consumer Privacy Act (CCPA), as amended by the CPRA, grants you the following rights:

  • Know the categories of personal data we collect, its sources, purposes and sharing recipients.
  • Access the specific data collected during the last 12 months.
  • Delete the personal data we hold about you, subject to legal exceptions.
  • Correct inaccurate data.
  • Opt out of selling or sharing ("Do Not Sell or Share My Personal Information").
  • Limit the use of sensitive personal information.
  • Receive no discrimination for exercising these rights.

Sale/sharing of data: Cardumen.ai does not sell personal data. If we use advertising pixels or cookies, such as the Meta Pixel, which may qualify as "sharing" under the CPRA, we provide a visible opt-out mechanism.

How to exercise them: write to contacto@cardumen.ai with "CCPA Request" in the subject. We may verify your identity and respond within the 45 days required by the CCPA, extendable by another 45 days.

13. Children

The Platform is intended for people over 18. We do not knowingly collect data from children. If we identify processing of a child's data without the required authorization, we will delete it.

14. Cookies and tracking technologies

We use cookies necessary for operation and, with prior consent, analytics and personalization cookies. The data subject can manage preferences through the cookie banner or browser settings.

15. Changes

This Policy may be updated because of legal or technical changes. Changes will be communicated through the Platform or by email. The current version and date appear in the header.

16. Contact

Privacy rights requests and questions: contacto@cardumen.ai. Supervisory authority: Personal Data Protection Agency (Chile).