Privacy Policy

This Privacy Policy describes how Casa Bella ("Casa Bella," "we," "us," or "our") collects, uses, shares, and protects personal information when you use our website, web application, and mobile app (together, the "Service").

Contact: hello@getcasabella.com Postal address: 3165 E Michigan Ave, Unit 810, Lansing MI 48912

This policy covers information about two groups: (1) users who create Casa Bella accounts (models and micro-influencers), and (2) leads — brand-side contacts whose professional and contact data we collect from third-party sources so our users can send partnership outreach. If you are a lead, see Section 4.

Effective: August 5, 2026.

We collect the following categories of information from or about users:

Account data. Name, email address, and login credentials, provided by you and processed through Clerk, our authentication provider. Clerk syncs account identifiers into our Postgres database (Neon).

Profile and onboarding data. Role, social handles, follower metrics (pulled via Apify from Instagram, TikTok, and/or X when you connect or look up profiles), portfolio or agency websites, clothing and common sizes, shipping address (used for gifting deals and as a physical postal address for CAN-SPAM compliance where needed), deal preferences, brand exclusions, and voice-calibration content (such as captions used to learn your writing voice). You provide most of this during onboarding or in Settings; social metrics and related profile details may come from Apify lookups you initiate.

Connected email account data. When you connect a mailbox, we receive OAuth tokens (Google or Microsoft) or IMAP/SMTP credentials you supply, plus the mailbox address and messages needed for outreach features. See Section 3.

Content you create or edit. Edits to AI-generated email drafts, notes, and other content you enter in the Service.

Payment data. Billing is handled by Stripe. Card details are submitted to Stripe and are not stored on our servers. We store Stripe customer and subscription identifiers and subscription status.

Device and push tokens. For the mobile app, Expo push tokens so we can send notifications about outreach activity.

Log and technical data. IP address, browser or device type, timestamps, and similar diagnostic information generated when you use the Service, used for security, rate limiting, and reliability.

Casa Bella sends outreach email from your own connected mailbox. You remain the sender. Connecting a mailbox authorizes us to send messages you approve or schedule, and to access mailbox data needed to run outreach features.

We read mailbox messages to detect replies to your outreach threads, bounces, and out-of-office notices. We use that information to update lead status and manage follow-ups. We do not use your mailbox as a general-purpose inbox reader beyond those outreach purposes.

OAuth tokens and IMAP/SMTP passwords are stored encrypted at rest using AES-256-GCM.

Casa Bella's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Gmail data is used only to provide user-facing outreach features — sending your emails and detecting replies, bounces, and out-of-office responses. We do not use Gmail data to train generalized AI models. We do not sell Gmail data. Humans at Casa Bella do not read Gmail message content except with your consent, for security investigations, or as required by law.

We make the same commitments for Microsoft account mailbox data obtained through Microsoft OAuth: use limited to outreach features, no sale, no training of generalized AI models, and no human review except with your consent, for security, or as required by law.

You can disconnect a mailbox in Settings. You should also revoke Casa Bella's access in your Google Account or Microsoft account security settings. When you disconnect, we stop sending and reading through that mailbox and immediately delete stored credentials and tokens for that connection.

This section is for brand-side contacts whose information appears in Casa Bella.

What we collect. Names, job titles, employers, work history, education, skills, locations, LinkedIn and other social or professional profile URLs, profile photos, and business email addresses. We may also store AI-generated scores and summaries about a lead's fit for a user's outreach.

Where it comes from. We do not collect this information directly from you as a lead in most cases. It is gathered from public and professional sources through third-party providers (including Apify actors that collect data from LinkedIn, Instagram, TikTok, X, and website scrapes). Business emails may be discovered and verified through Bouncer. Profile photos may be mirrored and hosted on our infrastructure via UploadThing so the Service can display them reliably.

Why we process it. So Casa Bella users (models and micro-influencers) can send individually addressed partnership outreach — such as gifting, affiliate, paid partnership, ambassador, UGC, casting/editorial, or events/press — that is relevant to the lead's professional role at a brand.

Legal basis (where GDPR/UK GDPR applies). Legitimate interests in enabling B2B and professional partnership outreach, balanced against your rights and expectations as a professional contact. You may object as described below.

How long we keep it. Lead data is kept while it remains relevant to an active user account and outreach workflow. We delete it immediately when the related user account is closed, when you successfully request removal, or when it is no longer needed for the Service.

Profile photos. Photos may be cached and hosted on our systems (via UploadThing) to operate the Service.

You received an email from one of our users, or found your details in our system?

Controller: Casa Bella (Casa Bella), contact hello@getcasabella.com, postal address 3165 E Michigan Ave, Unit 810, Lansing MI 48912.

Categories of data: professional identity and contact details listed above (name, title, employer, profile URLs, photo, business email, and related public professional information), plus scores/summaries generated for outreach.

Source: public and professional sources via third-party data providers, not typically from you directly.

Purpose: to enable our users to send relevant, individually addressed partnership outreach related to your professional role.

Legal basis (EEA/UK): legitimate interests in B2B/professional outreach, balanced against your rights.

Retention: deleted immediately when the related account is closed, on a valid removal request, or when no longer needed for the Service. See Section 9.

Your rights: you may request access, erasure, or object to processing. Reply to the sender of the outreach email to opt out of further contact from that user, or email hello@getcasabella.com to ask us to remove your information from Casa Bella. We will handle removal requests manually. We will respond within the time required by applicable law.

We use personal information to:

• Provide, operate, and improve the Service. • Generate email drafts and lead scores with AI. • Send and receive email at your direction through your connected mailbox. • Process billing and subscriptions. • Provide customer support. • Maintain security, rate limiting, fraud and abuse prevention, and service reliability. • Comply with law and enforce our Terms.

We do not sell personal data. We do not share personal data for cross-context behavioral advertising. We do not use customer or lead data to train generalized AI models.

Drafting and lead scoring use third-party large language models via the Anthropic API. User profile data and lead data may be transmitted to Anthropic to generate drafts, scores, and summaries. Outputs may be inaccurate. Users must review AI-generated content before sending, as described in our Terms of Service.

Anthropic's handling of API data is governed by our agreement with Anthropic.

We share personal information with service providers (processors) that help us run the Service, under contracts that limit their use of the data:

• Clerk — authentication and account identity. • Neon — Postgres database hosting. • Stripe — payment processing and subscription billing. • Apify — collection of public/professional profile and related data. • Anthropic — AI drafting and scoring. • Bouncer — business email verification. • UploadThing — hosting of mirrored profile images. • Trigger.dev — background job processing. • Upstash — Redis for rate limiting and related infrastructure. • Expo — mobile push notification delivery. • Vercel — application hosting. • Google / Microsoft — at your direction, when you connect your own mailbox; governed also by their terms.

We may also disclose information if required by law, to protect our rights or users' safety, or in connection with a merger, acquisition, financing, or sale of assets, subject to appropriate safeguards.

We do not sell personal information. We do not share personal information for cross-context behavioral advertising as those terms are used under the California Consumer Privacy Act / CPRA.

We use strictly necessary and authentication/session cookies (including those set by Clerk) to operate the Service and keep you signed in. We do not currently use advertising or analytics cookies. If that changes, we will update this Privacy Policy.

We retain information only as long as needed to operate the Service, then delete it immediately when it is no longer needed.

Account data: kept for the life of the account and deleted immediately when the account is closed.

Email thread and outreach data: kept while your connected mailbox remains linked and deleted immediately when you disconnect or close your account.

Lead data: kept while relevant to an active user workflow; deleted immediately on a valid removal request, when the related account is closed, or when no longer needed.

Encrypted mailbox credentials and tokens: deleted immediately when you disconnect the mailbox.

Billing records: retained only as required by tax and accounting law, then deleted.

We use technical and organizational measures designed to protect personal information, including encryption of mailbox credentials at rest (AES-256-GCM), TLS encryption in transit, access controls, and rate limiting.

No system is perfectly secure. We will provide breach notification as required by applicable law.

Depending on where you live, you may have rights under GDPR/UK GDPR and/or California CCPA/CPRA.

EEA/UK (GDPR/UK GDPR): rights of access, rectification, erasure, restriction of processing, data portability, objection (including to processing based on legitimate interests), and the right to lodge a complaint with a supervisory authority.

California (CCPA/CPRA): rights to know, delete, and correct personal information, and to opt out of sale or sharing. We do not sell or share personal information for cross-context behavioral advertising. We will not discriminate against you for exercising your privacy rights.

How to exercise rights: email hello@getcasabella.com. We may need to verify your identity before fulfilling a request. Authorized agents may submit requests where permitted by law, subject to verification. We will respond within the time required by applicable law.

Do Not Track / Global Privacy Control: we do not run advertising or analytics tracking to opt out of. We honor Global Privacy Control (GPC) signals to the extent applicable to our processing.

Casa Bella processes personal information in the United States. If you are in the EEA, UK, or another region with data-transfer rules, your information may be transferred to the United States and other countries. Where GDPR/UK GDPR applies, we rely on appropriate safeguards such as Standard Contractual Clauses with processors, where required.

Casa Bella is not directed to anyone under 18, consistent with our Terms of Service eligibility rules. We do not knowingly collect personal information from minors. If you believe we have collected information from someone under 18, contact hello@getcasabella.com and we will take steps to delete it.

We may update this Privacy Policy from time to time. For material changes, we will notify you by email or in-app notice. The updated policy will show a new effective date. Continued use of Casa Bella after the effective date is acceptance of the updated policy. If you do not agree, stop using the Service and cancel your subscription.

Questions about this Privacy Policy or privacy requests:

Email: hello@getcasabella.com Postal address: 3165 E Michigan Ave, Unit 810, Lansing MI 48912

Casa Bella