Last updated: 18 April 2026 · Effective from: 18 April 2026
This Privacy Policy explains how CAML ("CAML", "we", "us" or "our") collects, holds, uses, discloses and protects personal information when you use caml.app, any related subdomain, and the software and services we provide (together, the "Service"). This policy is written to meet our obligations under the Privacy Act 1988 (Cth) and the Australian Privacy Principles ("APPs"), as well as equivalent obligations where we handle data of individuals in the European Economic Area, the United Kingdom or elsewhere.
By creating an account or using the Service, you acknowledge that you have read and understood this policy.
The Service is operated by CAML, a business based in Australia. If you need to contact us about privacy, use privacy@caml.app. Our full legal entity name and ABN will be listed here once registered; until then, we remain accountable under this policy as the operator of the Service.
When you use CAML, you add records such as customer names, addresses, phone numbers, emails, service history, job notes, quotes, invoices, photos and related business records ("Your Customer Data"). You are the collector and primary handler of that data; CAML holds it on your behalf to provide the Service. Section 5 explains the division of responsibility.
If you connect a Google account (for contact sync, calendar sync or Gmail sending), we receive only the information needed for the scopes you have granted — typically your Google account identifier, email address, contacts and/or calendar events. We store an encrypted OAuth refresh token so that you don't have to re-authenticate constantly.
Our use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, we do not use Google user data to serve advertising, we do not allow humans to read your Google data except with your explicit consent or where required by law, and we do not transfer or sell your Google data to third parties. You can disconnect Google at any time from your CAML settings, and you can revoke access at myaccount.google.com/permissions.
CAML is not designed for storing sensitive information as defined under the Privacy Act (for example, health information, racial or ethnic origin, political views, or criminal records). Please do not enter this kind of information into CAML.
We use personal information to:
We do not sell your personal information, we do not rent it, and we do not share Your Customer Data with advertisers. We do not use your data to train third-party AI or machine-learning models.
Where EU or UK data-protection law applies, we process personal information on the following bases: (a) performance of a contract with you; (b) our legitimate interests in operating, securing and improving the Service, balanced against your rights; (c) compliance with legal obligations; and (d) your explicit consent (for example, marketing emails or optional integrations).
Under Australian, EU and UK privacy law, there is a distinction between the party that decides why personal data is collected (the controller) and the party that handles it on their behalf (the processor):
We only share personal information with service providers that need it to operate CAML, and only under written agreements that require confidentiality and appropriate data protection. Our current sub-processors are:
| Sub-processor | Purpose | Data location |
|---|---|---|
| Amazon Web Services (Lightsail) | Hosting, database, backups | Australia / United States |
| Stripe | Subscription billing & payment processing | Australia / United States |
| Google (OAuth, Calendar, Contacts, Gmail) | Integrations you choose to connect | Global (per Google) |
| Cloudflare | DNS, DDoS protection, TLS termination | Global edge |
| Our outbound email provider | Transactional and marketing email delivery | Global |
We may also disclose information (a) if required by law, regulation, court order or government request; (b) to protect the rights, property or safety of CAML, our customers or the public; or (c) in connection with a merger, sale of all or substantially all of our assets, or change of control — in which case the acquirer will be bound to the same privacy commitments or we will give you the chance to withdraw your data first.
CAML runs on Amazon Web Services infrastructure. Your account data and Your Customer Data are stored in the AWS region we have configured for production (currently AWS Asia Pacific, Sydney). Automated backups are stored in the same region. Some sub-processors listed above operate globally — for example, email delivery and Google integrations — which may involve a cross-border transfer of personal information. Where a cross-border transfer occurs, we take reasonable steps required by APP 8 to ensure the overseas recipient handles the information in a way consistent with the APPs, or we rely on an exception under the Privacy Act.
We take information security seriously. Our current controls include:
No system is perfectly secure, and we cannot guarantee absolute security. If we ever detect a data breach that is likely to result in serious harm, we will comply with the Notifiable Data Breaches scheme under Part IIIC of the Privacy Act 1988 and notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as required, without undue delay.
If you want us to delete your account and data before these retention periods naturally expire, email privacy@caml.app and we will action it consistent with any legal hold.
You have the right to:
To exercise any of these rights, email privacy@caml.app. We will acknowledge within 7 days and respond substantively within 30 days, or tell you if we need longer. We may need to verify your identity before acting on a request. You may also authorise an agent to make a request on your behalf; we will verify both the agent's authority and your identity.
If you're not satisfied with our response, you can lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au. EEA/UK residents may complain to their local data protection authority. US state residents may complain to their state Attorney General.
If you are located in the European Economic Area, Switzerland or the United Kingdom, the General Data Protection Regulation ("GDPR") or UK GDPR applies to our processing of your personal information. This section supplements (and to the extent of any conflict, overrides) the earlier sections.
For your own CAML account data, CAML is the data controller. For information you put into CAML about your own customers, you are the data controller and we act as your data processor under Article 28 GDPR. If you need a Data Processing Addendum (DPA) for your records or audit, email privacy@caml.app and we will provide one.
We rely on the legal bases already described in Section 4: performance of contract, legitimate interests, legal obligation, and (where relevant) consent.
In addition to the rights in Section 10, you have the right to:
CAML is based in Australia and uses sub-processors in Australia, the United States and globally. When personal data is transferred out of the EEA or UK, we rely on appropriate safeguards as required by GDPR Articles 44–49, including:
You can request a copy of the safeguards in place, with commercially sensitive terms redacted, by emailing privacy@caml.app.
You have the right to lodge a complaint with your local data protection authority. A list is maintained by the European Data Protection Board. UK residents may contact the Information Commissioner's Office (ICO).
CAML's processing of EEA/UK data is occasional and limited to operating the Service for individual business customers who choose to sign up, and does not involve large-scale processing of special-category data. On that basis we currently rely on the exemption in Article 27(2) GDPR from appointing an EU representative. We will appoint a representative if and when we are required to, and will update this policy to identify them.
If you are a California resident, the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA") gives you the following rights in addition to those in Section 10:
To exercise CCPA rights, email privacy@caml.app. We will verify your identity before responding and will respond within the statutory 45-day period (extendable by another 45 days where permitted).
Residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana and other US states with comprehensive privacy laws have comparable rights (access, correction, deletion, portability, opt-out of targeted advertising and sale). We treat all such requests under the same process as Section 10. Email privacy@caml.app and we will respond within the timeframes required by your state law.
Our Service does not currently respond to "Do Not Track" browser signals because no consistent industry standard has been adopted. We do honour Global Privacy Control (GPC) signals where technically feasible as an opt-out of sale/sharing — though, as noted above, we do not sell or share personal information.
The Service is not directed at children under 13 and we do not knowingly collect personal information from children under 13 as defined under the Children's Online Privacy Protection Act (COPPA). If you believe we have collected information from a child under 13, contact us and we will delete it.
Our commercial emails comply with the US CAN-SPAM Act: accurate sender identification, clear subject lines, a physical mailing address, and a functional unsubscribe mechanism. You are responsible for ensuring that any commercial emails you send through CAML to your own customers comply with CAN-SPAM and equivalent laws (see Section 4 of our Terms of Service).
The Service is for businesses and is not directed at children. We do not knowingly collect personal information from anyone under 16 (or under 13 if you are in the United States). If you believe a child has provided us with personal information, please contact us and we will delete it promptly.
When you sign up, we may send you infrequent product updates and onboarding emails. Every marketing email contains a one-click unsubscribe link. Transactional emails (receipts, invoices, password resets, security alerts, critical service notices) will continue even if you unsubscribe from marketing, because they are required to operate your account. For recipients in the EEA or UK, we rely on opt-in consent for marketing as required by the ePrivacy Directive and UK PECR.
We will update this policy from time to time. If we make a change that materially affects your rights, we will tell you by email or a prominent in-app notice at least 14 days before it takes effect, except where the change is required for legal or security reasons. The "Last updated" date at the top of this page always shows the current version.
Privacy enquiries: privacy@caml.app
General support: support@caml.app