Privacy Policy

1. Data Controller

2. Data We Collect

3. Legal Basis for Processing (GDPR / LGPD)

• Contract performance — processing orders, managing your account, providing Ask Yaro
• Consent — analytics and marketing cookies, promotional communications; withdrawable at any time
• Legitimate interests — fraud prevention, site security, service improvement
• Legal obligation — tax and legal record-keeping requirements

4. AI Processing — Ask Yaro

Ask Yaro is an AI assistant operated by Merkava Studio that uses the Anthropic API (Claude model) to generate personalised responses about aquarism.

• Your query content and relevant aquarium data are sent to Anthropic, Inc. servers (located in the United States) to generate responses
• Anthropic processes this data under its own Privacy Policy
• We do not use your conversations to train our own AI models
• AI responses are informational and do not replace advice from a veterinarian or certified expert

5. How We Use Your Data

• Process and manage orders, shipping and returns
• Create and maintain your user account
• Provide and improve the Ask Yaro service
• Send order confirmations, invoices and service notifications
• Send marketing communications (only with your explicit consent)
• Detect and prevent fraud and unauthorised access
• Comply with applicable tax and legal obligations

6. Data Sharing

We do not sell or rent your personal data. We share it only with:

• Stripe, Inc. — payment processing (PCI-DSS Level 1 certified)
• Anthropic, Inc. — AI processing for Ask Yaro (query text and aquarium data only)
• Shipping carriers — contact details and delivery address for fulfilment
• Google LLC — Google Analytics (anonymised/pseudonymised data)
• Meta Platforms, Inc. — Meta Pixel for advertising (subject to your consent)
• Competent authorities — when required by law or court order

7. International Data Transfers

Some of our providers (Anthropic, Stripe, Google) operate servers in the United States:

• EU / UK users — transfers are covered by Standard Contractual Clauses (SCCs) approved by the European Commission
• Brazil — transfers comply with LGPD Article 33 adequate safeguards
• California, USA — we comply with CCPA/CPRA; we do not sell personal data

8. Data Retention

• Account data — for the lifetime of the account + 90 days after closure
• Ask Yaro conversations — up to 24 months; deletable on request
• Order and billing records — 5 years (tax obligation)
• Marketing data — until you withdraw consent or unsubscribe
• Technical logs — maximum 12 months for security purposes

9. Your Rights

To exercise any of the rights below, email us at hola@yaroreef.com. We respond within 30 days.

10. Data Security

• All communications encrypted via SSL/TLS
• Passwords stored as bcrypt hashes (never plaintext)
• Payments handled by Stripe (PCI-DSS Level 1)
• Access to personal data restricted to authorised personnel only
• In the event of a data breach affecting you, we will notify you within 72 hours (GDPR) or as soon as reasonably possible

11. Children

Our services are intended for users aged 18 and over. We do not knowingly collect personal data from children under 16. If we identify data collected from a minor, we will delete it immediately. Contact us at hola@yaroreef.com if you believe a minor has provided their data.

12. Cookies

We use cookies and similar technologies. Only strictly necessary cookies are placed without your consent. See our Cookie Policy for full details.

13. Policy Changes

We may update this Privacy Policy to reflect changes in our practices or applicable law. For material changes, we will notify you by email at least 30 days in advance. The "last updated" date at the top of this document reflects when the current version took effect.

14. Contact

To exercise your rights or for any privacy-related questions:

EU users: you also have the right to lodge a complaint with your national data protection authority. Mexico: INAI — inai.org.mx. Brazil: ANPD — gov.br/anpd.