Privacy Policy

This policy explains what data the Camelo app collects, why it collects it, who it is shared with and how you stay in control of it. It covers the mobile app and the services it connects to. Your data is processed in accordance with the General Data Protection Regulation (GDPR) and Moroccan Law No. 09-08 on the protection of individuals with regard to the processing of personal data.

Camelo is an application trading under the brand Camelo by Mello Group. It is operated by Mello Lab - FZCO, a free zone company with limited liability incorporated in Dubai Silicon Oasis, United Arab Emirates.

Mello Lab - FZCO is the data controller for all of the processing described below.

We only collect the data required to run the service. We do not request sensitive data within the meaning of the GDPR (health, opinions, origin). Photos, videos and voice recordings you send are used as production material and to talk to the team, never to identify or authenticate anyone biometrically.

We do not sell your personal data, we do not share it with data brokers, and we do not use it for targeted advertising.

Your data is only accessible to authorised Camelo staff and the creatives working on your projects, to the members of your company workspace for that company's projects, and to the following providers, all contractually bound to confidentiality and security:

Some of these providers are established outside Morocco and the European Union, notably in the United States. Such transfers are covered by appropriate safeguards (standard contractual clauses, confidentiality commitments) and limited to the data strictly necessary for the service.

The assistant and Insights send what you type or select to the AI providers listed above. The app asks for your permission before the first request, names those providers, and sends them nothing until you tap Allow. You can withdraw that permission at any time in Settings → Share with AI providers: the assistant then answers from Camelo's built-in help articles only, and Insights does not run.

We do not use your data, briefs or deliverables to train AI models, and we do not authorise our providers to do so, unless you have expressly agreed otherwise in writing.

• The camera, photo library and microphone are used only when you take a photo, attach a file or record a voice message. The app does not access them in the background.
• The app does not collect your location or your contacts.
• The app contains no advertising, analytics or crash-reporting SDK, and does not track you across other companies' apps or websites.
• While the app is open, it signals that you are online so the team can see you are available. Only an opaque account identifier is shared for this, never your name, and it is not stored.
• The app uses no cookies or advertising identifiers. The camelo.io website uses audience-measurement cookies, as described in its legal notice.

• All traffic between the app and our servers is encrypted (HTTPS/TLS).
• Passwords are stored as cryptographic hashes, never in plain text.
• Access to data is restricted to authorised staff on a need-to-know basis.
• Access logging and monitoring of security incidents.
• Regular backups and minimisation of the data collected.

Under the GDPR and Law No. 09-08, you have the following rights over your data at any time:

• Right of access: obtain a copy of the data we hold about you.
• Right to rectification: correct inaccurate or incomplete data.
• Right to erasure: request deletion of your account and your content.
• Right to restriction: freeze a processing operation while it is being verified.
• Right to object: object to processing based on our legitimate interest.
• Right to portability: receive your data in a structured, machine-readable format.
• Right to withdraw consent at any time, without affecting the lawfulness of processing already carried out.

To exercise these rights, write to the contact address at the bottom of this page from the email associated with your account. We reply within 30 days at the latest. Proof of identity may be requested where there is reasonable doubt about the requester's identity.

If you believe your rights are not being respected, you may lodge a complaint with the CNDP in Morocco, or with the data protection authority of your country of residence in the European Union (for example the CNIL in France).

You can have your account deleted at any time, in either of two ways:

• In the app, under Settings → Delete my account. Your request goes to our team and is carried out within 30 days. You can withdraw it while it is pending, and you receive an email once it is done.
• On the web, without signing in, through our deletion form. Once you enter the code we email to the account's address, our team carries out the deletion within 30 days.

Deletion erases your account, your sign-in credentials, your profile and photo, your questionnaire answers, your notifications and the content of the messages you wrote. We keep only your invoices and token history (10 years, legal obligation), the projects and deliverables produced for your company as its production record, no longer linked to you, an anonymised technical history, and an irreversible fingerprint of your email address used solely to prevent abuse.

Camelo is a professional tool reserved for people aged 18 or over. We do not knowingly collect data about anyone under 18. If you believe a minor has provided us with personal data, contact us and we will delete it without delay.

This policy may change, in particular as new features are released or legal requirements evolve. The last-updated date appears at the top of this page. In the event of a significant change, you will be notified in the app or by email before it takes effect.

For any question about this privacy policy or to exercise your rights, write to us at:

support@camelo.io