Privacy Notice

Who is responsible

Codelab Technologies – FZCO, Building A1, Dubai Digital Park, Dubai Silicon Oasis, Dubai, United Arab Emirates (licence no. 76787), is the controller of personal data processed to provide Camppit. Contact: privacy@camppit.com.

Data we collect, why, and our legal basis

Email, password (stored hashed) and Google sign-in identifier — to create your account, sign you in and keep it secure (contract).

Name, display name, job title, avatar and preferences — to show you to your team and personalise Camppit (contract).

Workspace content: campaigns, tasks, notes, budgets, calendars and files you upload — to provide the service (contract).

Team membership, roles and invitations — for collaboration and permissions (contract).

Text, documents and voice recordings you send to AI features — to generate the suggestions you asked for (contract).

AI usage records, activity and audit logs, IP address and device or browser data — for security, fraud prevention, fair use and troubleshooting (legitimate interests).

Subscription, plan and payment status (never card details) — for billing access and support (contract, legal obligation).

Support messages — to answer you (contract, legitimate interests).

Email address and marketing preferences — to send product news and marketing emails; you can unsubscribe at any time (consent, or legitimate interests where permitted).

Who we share data with

Service providers: Lovable (hosting, database, authentication, file storage, email delivery and AI gateway), Cloudflare (network edge and security), and AI model providers reached through the gateway (currently OpenAI and Google), only for AI actions you start.

Paddle.com, our Merchant of Record, for the sale of the product, subscription management, payments, tax compliance and invoicing.

Professional advisers (legal, accounting), and authorities where required by law.

We do not sell personal data and do not use advertising trackers.

International transfers

Our service providers may process data outside the United Arab Emirates, including in the United States and the European Union. We rely on providers' contractual data-protection commitments, such as standard contractual clauses, and recognised adequacy decisions where available.

How long we keep data

We keep data while your account or workspace is active and for up to 5 years afterwards, including backups, logs, AI usage and billing records. After that it is deleted or anonymised. Temporary uploads not attached to a campaign are deleted after 24 hours of inactivity. You can ask us to delete data earlier unless we must keep it by law.

Your rights

Depending on where you live, you may access, correct, delete, restrict or object to processing of your data, receive a portable copy, withdraw consent, and complain to the UAE Data Office or your local authority. We respond within one month. Contact privacy@camppit.com.

Security

We use encryption in transit, access controls and role-based permissions enforced in the database, private file storage with short-lived links, hashed invitation and calendar tokens, and audit logging.

Cookies and browser storage

We use strictly necessary browser storage to keep you signed in and remember your preferences. Our hosting edge (Cloudflare) sets a security cookie (__cf_bm) to detect bots. We do not use analytics or marketing cookies. Paddle's checkout sets its own cookies when you pay. You can clear cookies in your browser settings, but Camppit may not work without the necessary ones.