Privacy Policy | Casamates

1. Who We Are

PMD AI Labs Ltd ("PMD AI Labs", "we", "us", or "our") is the controller of personal data processed through the Casamates mobile application, website, and related services (collectively, the "Service"). For privacy questions or to exercise your rights, contact us at support@casa-mates.com.

PMD AI Labs Ltd is registered in England and Wales under company number 16432165. Our registered office is 20 Wenlock Road, London, N1 7GU, England.

This Policy applies to users worldwide. If local law gives you additional rights, those rights apply in addition to the rights described here.

2. Personal Data We Collect

We collect the following categories of personal data. The data we collect depends on how you use the Service and the features you choose to use.

Identifiers. Your user ID, email address, and chosen username or display name. We use these to create and secure your account, authenticate you, identify you to the members of your household, and provide the Service. Your username may be personal data even if you use a nickname, and it may reveal your real name if you choose to enter it. If you use Sign in with Apple or Google Sign-In, we also receive the provider identifier and the account information you authorise that provider to share.
Contact information. Your email address. We use this to administer your account, respond to support requests, and send service-related communications. We send marketing only where permitted by applicable law and you can unsubscribe from marketing communications at any time.
User content and household information. Your profile picture and information you add to a household, such as expenses, shopping lists, chores, calendar events, and household membership. Profile pictures are not public and are intended to be visible only to members of the household to which you belong.
AI-assisted feature content. If you choose to use an AI-assisted feature, we process the information you submit or authorise the Service to access, the relevant context needed to fulfil your request, and the resulting output. Depending on the feature, this may include receipt images or PDFs; recipe links, webpage or caption text, and pasted recipe text; typed instructions; voice recordings or transcripts; relevant expenses, lists, chores, recipes, calendar entries, or other household content; and the extracted, generated, or proposed records and actions returned to you.
Financial and purchase information. Expense amounts, splits, and payment status you record in the Service. RevenueCat processes app-store purchase history, product and transaction identifiers, subscription and entitlement status, purchase, renewal, cancellation and restore events, and the applicable store receipt or purchase token. We do not receive or store your full payment card details. Apple, Google, and their payment providers process app-store payments.
Usage data. Screens viewed, feature interactions, navigation, app lifecycle events, website page views, and related product analytics data. We use Firebase Analytics, PostHog, Google Analytics 4, and Google Tag Manager for these purposes.
Age and guardian information. Confirmation that an independently registered user is at least 18 and, where Managed Accounts are available, limited age information, the managing adult's user ID, guardian-consent records, and account-control information.
Diagnostics and session replay data. Crash logs, performance information, error reports, and technical logs from Firebase Crashlytics and PostHog. Where enabled, the mobile app uses PostHog session replay to record how an adult user moves through and interacts with app screens. We use replay to investigate errors and usability problems. All displayed text, text inputs, and images are masked on your device before replay data is sent to PostHog. Replays therefore do not show the text, financial details, household content, profile pictures, or other images displayed in the app. A replay still contains privacy-masked interaction information, such as navigation, taps, scrolling, timing, and technical session data, and is subject to any separate choice required by law.
Device and technical data. Device model, operating system, application version, language and region settings, IP address, identifiers generated by our providers, and information about how the Service connects to our systems. For subscription management, RevenueCat receives your Casamates user ID and limited technical information such as platform, device and app version, locale, currency, IP address, and activity timestamps. This also includes install attribution data, such as Google Play Install Referrer parameters on Android and probabilistic device matching signals (IP, device model, operating system) on iOS, used to link a website visit to a subsequent app install.
Cookies and website tracking data. Cookie choices, browser and device information, pages viewed, and interactions on our website. See section 8 for details.

We do not collect precise GPS location data. Our analytics providers derive approximate location data, such as country, region, and city, from your IP address. We do not ask you to provide special category data, such as health, biometric, or religious information. Please do not include that information in profile pictures or household content.

3. How We Collect Data

We collect personal data directly from you when you create an account, complete your profile, use household features, contact support, subscribe to email updates, or make a purchase. We also collect data automatically through the app, website, devices, and the providers described in this Policy. Authentication providers, app stores, and payment providers may provide us with information needed to create accounts, confirm purchases, or provide support.

4. How We Use Personal Data and Our Legal Bases

We use personal data to:

provide, maintain, personalise, and secure the Service;
create and administer accounts and households, authenticate users, and make household information available to the relevant household members;
process subscriptions, purchases, refunds, and entitlement requests;
provide optional AI-assisted features that interpret content, answer requests, structure or generate recipes, extract receipt details, and draft or carry out household actions you request;
monitor performance, diagnose faults, prevent fraud and misuse, and improve the Service;
produce aggregate statistics about feature use, user journeys, and subscription or paywall performance;
respond to questions, complaints, and support requests;
send service-related messages and, where permitted, marketing; and
comply with legal obligations and enforce our Terms.

For individuals in the United Kingdom, European Economic Area, and other jurisdictions with similar laws, our legal bases are: (a) performance of a contract or steps taken at your request before entering into a contract; (b) our legitimate interests in operating, securing, improving, and understanding the Service, provided those interests are not overridden by your rights; (c) your consent, where consent is required, including certain analytics, session replay, marketing, cookie, or location activities; and (d) compliance with legal obligations. Where permitted, we may use privacy-preserving analytics solely to produce aggregate statistics for improving the Service, after providing clear information and a simple way to object.

AI-Assisted Features

Some optional features use Mistral AI to interpret or generate content and help you carry out a request. Examples include scanning a receipt, importing or preparing a recipe, and, where available, responding to a typed or spoken instruction to draft or create an expense, chore, shopping item, recipe, calendar entry, or other household record. Features that let you communicate directly with an AI system will be identified in the Service unless it is already obvious from the context.

When you choose one of these features, Casamates sends the content and context reasonably needed for the request to Mistral AI through our systems. This may include personal data contained in a receipt, document, link, voice input, instruction, or relevant household record. We ask you not to submit special category data or information that is not needed for your request, and not to provide another person's information unless you are permitted to do so.

We use Mistral AI as a service provider and have disabled the use of Casamates API inputs and outputs for training Mistral's models. Mistral may retain API inputs and outputs for up to 30 days for abuse monitoring unless a shorter-retention or zero-retention setting applies to the relevant feature. Content you choose to save in Casamates is retained as part of the Service as described in section 7.

AI-generated or extracted information may be incomplete or inaccurate, so you should review it before saving it or relying on it. We do not use these features to make solely automated decisions about eligibility, rights, account access, or other matters that produce legal or similarly significant effects. If we introduce an AI use that materially changes how we process personal data, we will update this Policy and provide any additional notice or choice required by law.

5. How We Share Personal Data

We do not sell personal data for money. We share personal data only as necessary to operate the Service, meet legal obligations, protect rights and safety, or complete a corporate transaction. Recipients may include:

other members of your household, for the household information and profile picture you choose to share through the Service;
service providers that process data for us, including cloud infrastructure, authentication, storage, analytics, diagnostics, notifications, and customer support providers;
payment and app-store providers, including Apple, Google, and RevenueCat, for purchases, subscriptions, and entitlements;
professional advisers, authorities, or other parties where required by law or reasonably necessary to protect rights, safety, security, and property; and
a buyer, successor, or affiliate in connection with a merger, acquisition, financing, reorganisation, or sale of assets, subject to applicable law.

The third-party providers used by the Service include:

These providers have their own privacy policies and may process personal data under their own terms where they act as independent controllers, including in relation to app-store transactions.

6. International Transfers

We are based in the United Kingdom and our providers may process personal data in the United States, the United Kingdom, the European Economic Area, and other countries. Data protection laws in those countries may differ from the laws where you live.

Where required by applicable law, we use appropriate safeguards for international transfers, such as adequacy regulations, the UK International Data Transfer Addendum, or standard contractual clauses. You may contact us for further information about the safeguards relevant to your data.

7. Data Retention and Account Deletion

We retain personal data for as long as needed to provide the Service, maintain your account and household, meet legal and accounting obligations, resolve disputes, enforce agreements, and protect the security of the Service. Retention periods vary by the type of data and purpose of processing.

You may request deletion of your account and associated personal data through the in-app account-deletion control, where available, or by emailing support@casa-mates.com. We aim to action verified requests within 30 days, unless a longer period is permitted or required by law. Some data may remain in backups or be retained where necessary for legal, fraud-prevention, security, accounting, or dispute-resolution purposes. Shared household records may be retained for the other members but deleted or de-identified where appropriate. We also send deletion instructions to relevant processors where required. A managing adult may request deletion of a Managed Account. Deleting your account may remove access to shared household information and does not cancel an app-store subscription.

8. Cookies and Website Tracking

Our website uses essential local storage to remember your cookie preference. It also uses Google Analytics 4, Google Tag Manager, and PostHog for website analytics, page views, and error tracking. None of these load or send anything until you accept analytics cookies through the cookie banner. PostHog website session recording is disabled.

Analytics is a single choice covering all three, so accepting or declining applies to Google Analytics 4, Google Tag Manager, and PostHog alike. You can accept or decline directly on the banner, or open “Customize” to see each cookie category and turn analytics on or off there. You can change your choice at any time using the “Cookie settings” link in the website footer, or manage cookies through your browser settings. Declining analytics cookies may not stop all technical information necessary to operate the website.

9. Your Privacy Rights

Depending on where you live, you may have the right to request access to, correction of, deletion of, or a portable copy of your personal data. You may also have the right to restrict or object to processing, withdraw consent where processing is based on consent, and opt out of direct marketing.

To exercise a right, email support@casa-mates.com. We may need to verify your identity before responding. We will not discriminate against you for exercising applicable privacy rights, although some Service features may require certain data to function.

If you are in the United Kingdom, you may complain to the Information Commissioner's Office. If you are in the European Economic Area or elsewhere, you may complain to your local data protection authority. Users in certain United States states, including California, may have additional rights under applicable state privacy laws.

10. Children and Managed Accounts

A person must be at least 18 to create an independent Casamates account. Where Managed Accounts are available, an adult parent, guardian, or other legally authorised person may create and manage an account for someone under 18. We use the information associated with a Managed Account to provide household features, keep the account safe, comply with law, and give the managing adult appropriate controls.

Managed Accounts receive restricted permissions and high-privacy defaults. We do not use mobile session replay, advertising identifiers, personalised advertising, or non-essential behavioural profiling for Managed Accounts. We may use limited technical or aggregate information needed for security, reliability, or understanding the Service without identifying the child in reporting. Device location is off by default and will not be collected for a Managed Account unless an eligible feature is introduced with the required notice, guardian authorisation, device permission, and child-facing indication.

Where an AI-assisted feature is made available to a Managed Account, we will provide an age-appropriate explanation and any required guardian control before using the account holder's instructions or household information with that feature. We do not use AI-assisted features to make solely automated decisions about a young person's rights, safety, account access, or eligibility.

The managing adult can control access and request deletion. We may ask the adult to verify their authority or consent where required, including before knowingly collecting personal data from a child under 13 in the United States. If you believe a child created an account without the required adult involvement, contact support@casa-mates.com and we will investigate and take appropriate action.

Our Privacy Notice for Young People explains this information in simpler language. Our Safety Centre explains how to report a concern or complain about a safety decision.

11. Security

We use reasonable technical, organisational, and administrative measures designed to protect personal data. However, no method of transmission, storage, or security control is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your account credentials secure and for using a secure device and network.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will post the updated version on this page and change the "Last updated" date. If a change is material, we will provide additional notice where required by law.

13. Contact Us

For questions, requests, or complaints about this Privacy Policy, contact PMD AI Labs Ltd at support@casa-mates.com.

PMD AI Labs Ltd, company number 16432165, registered office: 20 Wenlock Road, London, N1 7GU, England.

Last updated: 2026-09-13