Privacy Policy

Last Updated: March 23, 2026

Effective Date: January 27, 2026 | Version: 1.0

Introduction

At Famara ("we", "us", or "our"), we respect your privacy and are committed to protecting your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

This policy applies to all users worldwide and complies with:

GDPR (General Data Protection Regulation) - EU/EEA
CCPA (California Consumer Privacy Act) - California, USA
PIPEDA (Personal Information Protection and Electronic Documents Act) - Canada
Australian Privacy Act 1988 - Australia

1. Information We Collect

1.1 Information You Provide

Account Registration:

Email address (required for account creation and login)
Username (optional display name)
Password (encrypted with bcrypt, never stored in plaintext)
Profile information (optional: name, preferences)

Content You Submit:

AI prompts and conversations (text inputs sent to AI models)
File uploads (images, documents, code files for AI processing)
Feedback and support requests
Payment information (processed by Stripe; we do NOT store credit card details)

1.2 Information Automatically Collected

Usage Data:

Device information (browser type, operating system, device model)
IP address (for security, rate limiting, and geolocation)
Access times and dates
Pages visited and features used
Referring URLs and search terms
Session duration and interaction patterns

Technical Data:

Cookies and similar tracking technologies (see Section 7)
Error logs and crash reports (for debugging)
Performance metrics (response times, AI provider usage)

1.3 Information from Third Parties

OAuth providers (Google, GitHub, etc.) - if you use social login
Payment processors (Stripe) - transaction confirmation data
Analytics providers (PostHog) - aggregated usage statistics

2. How We Use Your Information

We use your information for the following purposes:

2.1 Provide and Improve the Service

Process your AI prompts and deliver responses from AI providers
Manage your account, authentication, and preferences
Analyze usage patterns to optimize performance and user experience
Develop new features and improve existing functionality
Troubleshoot technical issues and provide customer support

2.2 Security and Fraud Prevention

Detect and prevent abuse, spam, and malicious activity
Enforce our Terms of Service and Acceptable Use Policy
Monitor for security vulnerabilities and unauthorized access
Comply with legal obligations and respond to law enforcement requests

2.3 Communication

Send account-related notifications (password resets, security alerts)
Provide customer support and respond to inquiries
Send service updates and important announcements
Marketing emails (only with your consent; opt-out available)

2.4 Legal Compliance

Comply with applicable laws, regulations, and legal processes
Respond to subpoenas, court orders, and government requests
Protect our rights, property, and safety

Legal Basis for Processing (GDPR):

Contract: Necessary to provide the Service you requested
Consent: You explicitly agreed (e.g., marketing emails)
Legitimate Interest: Security, fraud prevention, service improvement
Legal Obligation: Compliance with laws and regulations

3. How We Share Your Information

We do NOT sell your personal data to third parties. We may share data in the following circumstances:

3.1 AI Service Providers

Your prompts and uploaded content are sent to third-party AI providers to generate responses. By default, we route to providers with servers in Western jurisdictions. Each provider has its own privacy policy:

Groq (USA) — https://groq.com/privacy/
Together.ai (USA) — https://together.ai/privacy
Mistral AI (EU/France, GDPR-native) — https://mistral.ai/terms/
Cohere (Canada) — https://cohere.com/privacy
Ollama — local processing only, no data leaves your device
DeepSeek (China) — https://deepseek.com/privacy — opt-in only; data is processed on servers in China subject to Chinese law

Important: DeepSeek is not used by default. It is only activated when you explicitly select it. All other providers are US/EU/Canada-based. We do not control how any provider uses your data — review their policies before use.

3.2 Service Providers

Hosting: Vercel (https://vercel.com/privacy)
Authentication: NextAuth (self-hosted, no data shared)
Payments: Stripe (https://stripe.com/privacy) - PCI-DSS compliant
Analytics: PostHog (https://posthog.com/privacy) - self-hosted option available
Error Tracking: Sentry (https://sentry.io/privacy/)

These providers are contractually obligated to protect your data and use it only for providing services to us.

3.3 Legal Requirements

We may disclose your information if required by law or in good faith belief that such action is necessary to:

Comply with legal obligations, court orders, or subpoenas
Protect our rights, property, or safety
Investigate fraud, security breaches, or Terms violations
Respond to law enforcement or government agency requests

3.4 Business Transfers

In the event of a merger, acquisition, bankruptcy, or asset sale, your information may be transferred to the new entity. We will notify you via email and/or prominent notice on the Service.

3.5 Aggregated Data

We may share aggregated, anonymized data that cannot identify you (e.g., "70% of users prefer Groq for code generation"). This data is used for research, marketing, and service improvement.

4. Data Retention

We retain your information for as long as necessary to provide the Service:

Account Data: Retained while your account is active, plus 30 days after deletion
Conversation History: 90 days (unless you delete earlier)
Uploaded Files: 30 days (or until you delete them)
Usage Logs: 12 months (for security and analytics)
Payment Records: 7 years (for tax and legal compliance)
Security Logs: 24 months (for fraud prevention)

Deletion Process: When you delete your account, we permanently remove your personal data within 30 days, except where retention is required by law (e.g., financial records).

You can request immediate data deletion by contacting privacy@famara.ai with subject "Data Deletion Request".

5. Your Rights and Choices

5.1 GDPR Rights (EU/EEA Users)

Under GDPR, you have the following rights:

Right to Access: Request a copy of your personal data
Right to Rectification: Correct inaccurate or incomplete data
Right to Erasure: Request deletion of your data ("right to be forgotten")
Right to Restriction: Limit how we process your data
Right to Data Portability: Receive your data in a machine-readable format
Right to Object: Opt-out of processing based on legitimate interests
Right to Withdraw Consent: Revoke consent for marketing emails
Right to Lodge a Complaint: File a complaint with your data protection authority

5.2 CCPA Rights (California Users)

Under CCPA, you have the following rights:

Right to Know: Request disclosure of data collected in the past 12 months
Right to Delete: Request deletion of your personal data
Right to Opt-Out: Opt-out of data sales (we do NOT sell data)
Right to Non-Discrimination: Equal service regardless of privacy choices

We do NOT sell personal information and have not sold it in the past 12 months.

5.3 How to Exercise Your Rights

To exercise any of the above rights, contact us at:

Email: privacy@famara.ai

Subject: "Privacy Request - [Your Right]"

Include: Your email address and specific request

We will respond within 30 days (GDPR) or 45 days (CCPA). We may request verification of your identity before processing requests.

5.4 Cookie Preferences

You can manage cookies through your browser settings:

Block All Cookies: Disable cookies in browser settings (may limit functionality)
Essential Cookies Only: Accept only authentication and security cookies
Opt-Out of Analytics: Use Do Not Track (DNT) browser setting

6. Data Security

We implement industry-standard security measures to protect your data:

Encryption:

TLS 1.3 for data in transit (all communications encrypted)
AES-256 encryption for sensitive data at rest
Bcrypt hashing for passwords (salted, never stored in plaintext)

Access Controls:

Role-based access control (RBAC) for internal systems
Two-factor authentication (2FA) for admin accounts
Regular access audits and least-privilege principle

Infrastructure Security:

Hosted on Vercel's secure, compliant infrastructure
Regular security patching and vulnerability scanning
DDoS protection and rate limiting
Automated backups and disaster recovery

Monitoring and Incident Response:

24/7 security monitoring and alerting
Incident response plan for data breaches
Notification within 72 hours of confirmed breach (GDPR requirement)

No Method is 100% Secure: While we strive to protect your data, no internet transmission or storage is completely secure. Use strong passwords and enable 2FA when available.

7. Cookies and Tracking Technologies

We use cookies and similar technologies to enhance your experience:

Essential Cookies (Required):

Authentication tokens (keep you logged in)
Security cookies (CSRF protection)
Session management

Functional Cookies (Optional):

User preferences (theme, language)
Feature settings

Analytics Cookies (Optional):

PostHog analytics (usage patterns, feature adoption)
Performance monitoring
A/B testing

Cookie Lifespan: Essential cookies last for your session. Functional and analytics cookies last up to 12 months.

8. International Data Transfers

Famara is operated from Australia. Your data may be transferred to and processed in countries outside your residence, including the United States and European Union.

Safeguards for International Transfers:

Standard Contractual Clauses (SCCs) for EU data transfers
Service providers comply with GDPR, CCPA, and applicable data protection laws
Data Processing Agreements (DPAs) with third-party processors

By using the Service, you consent to international data transfers as described in this policy.

9. Children's Privacy

By creating a Famara account, you represent that you are 18 years of age or older. Famara is not designed for independent use by anyone under 18, and we do not knowingly collect personal data directly from a person we know to be under 18 outside of the family-member path described below.

An adult account holder who owns a family group may add family members, including minors, to share that family's AI usage. By adding a minor to a family group, the adult account holder represents that they are the minor's parent or legal guardian, consents on the minor's behalf to this Privacy Policy and the Terms of Service, and is responsible for that minor's use of the Service — the same model used by Netflix profiles, Google Family Link, and Amazon Kids. Famara does not enter into a separate agreement with the minor, and does not independently verify the age of any account holder.

A minor family member's account is flagged internally so that Famara's safety-monitoring feature can screen their chat messages and the AI's responses for signs of self-harm, harm to others, drug use, or attempts to manipulate the AI into unsafe behaviour. If a message is flagged, the family owner who added the minor is notified by email and in-app, with a short excerpt and a link to the full conversation, so they can review it directly. This monitoring does not block or alter the AI's response to the minor — it only notifies the responsible adult.

If you are a parent or guardian and no longer want a minor's account monitored under this feature, or want it removed from your family group entirely, contact us at privacy@famara.ai.

10. Third-Party Links

The Service may contain links to third-party websites and services. We are not responsible for their privacy practices. Review their privacy policies before providing personal data.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last Updated" date.

Material changes will be announced via email (if provided) and/or prominent in-app notification. Continued use after changes constitutes acceptance.

We recommend reviewing this policy periodically to stay informed about how we protect your data.

12. Contact Us

For privacy-related questions, concerns, or requests, contact us at:

Email: privacy@famara.ai

Subject Line: "Privacy Inquiry" or "Data Request"

Service Name: Famara

Data Controller: AXD Intelligence (ABN 36 242 601 526), Perth, Western Australia

Location: Perth, Western Australia

EU Representative: If required under GDPR, we will appoint an EU representative and update contact details here.

Response Time: We respond to privacy requests within 30 days (GDPR) or 45 days (CCPA).

Privacy at a Glance

What We Collect:

Email, username, password
AI prompts and uploads
Usage data and IP address

How We Use It:

Provide AI services
Improve user experience
Security and fraud prevention

Who We Share With:

AI providers (for processing)
Service providers (hosting, payments)
We do NOT sell your data

Your Rights:

Access, correct, delete your data
Opt-out of marketing
Data portability (GDPR)