Privacy Policy
Effective 18 August 2026 · Last updated 18 August 2026
Contents — 15 sections
- 1. Who we are
- 2. What we collect
- 3. Why we are allowed to process it
- 4. Your clients' data, and our role
- 5. How AI processing works
- 6. Sub-processors
- 7. Where your data is held
- 8. How long we keep it
- 9. Deletion and erasure
- 10. Your rights
- 11. Security
- 12. Personal data breaches
- 13. Cookies
- 14. Children
- 15. Changes and contact
CaribNexus AI builds artificial intelligence systems for businesses across the Caribbean. This policy explains what personal data we handle, why, where it is held, how long we keep it, and what you can ask us to do with it. It is written to be read rather than to be survived, and every factual statement in it describes the system as it actually runs.
Who we are
This policy governs everything we build. That is CaribBooks, the AI bookkeeper; CaribNexus Automations, the agents we deploy across messaging channels; the voice agents we embed on business websites; and any custom system we build through consulting. The rules below do not change from one to the next.
The lines isolate differently, and it is worth saying how. CaribBooks is a single system serving many businesses, so isolation is a property of its architecture: each business is a separate partition and the agent has no means of naming another. An Automations system is built for one business, so there is no second business inside it to reach.
CaribNexus AI is a company based in Montego Bay, Saint James, Jamaica, founded in 2024 by Dominic A.R. Waite. We are the data controller for information you give us directly, such as when you enquire about our services or hold an account with us.
Where an accounting practice uses CaribBooks to keep books on behalf of its own clients, that practice is the controller of its clients’ data and we act as its processor. Section 4 explains what that means in practice.
What we collect
We do not collect special category data, and CaribBooks is not designed to receive it. If it arrives in a message, it is treated the same as any other message content and is subject to the same retention and deletion terms.
Why we are allowed to process it
Your clients' data, and our role
When an accounting practice runs CaribBooks across its client list, we process those clients’ data on the practice’s instructions. The practice decides which clients are onboarded, who at the firm may see them, and what happens to the data. We do not use it for anything else.
Each business is isolated from every other. A business is identified internally by an identifier that the AI agent has no ability to supply, choose or alter: the identity is bound by our systems from the phone number the message arrived from, before the agent runs at all. The agent has no means of reading, naming or referring to another business’s records.
Within a practice, the right to erase data belongs to the firm’s owner or an administrator. A staff member seat cannot delete a client’s history.
How AI processing works
CaribBooks learns your business, your vendors, your categories and the way you describe things, so that it asks fewer questions over time. That learning stays inside your business and is never pooled with anyone else’s.
We do not train foundation models on your data. We are not a model developer. Where we would like to use anonymised examples to improve CaribBooks generally, we ask first, and the answer is no until you say otherwise.
Where we act as processor for an accounting practice, we use that practice’s client data only on the practice’s instructions, and never for our own product improvement. A practice’s clients are not our customers, and we do not treat their books as ours to learn from.
Producing a reply does require sending the content of a message to a model provider, in the same way that sending an email requires a mail server. That provider generates a response and returns it. We select and configure providers on the basis that submitted content is not retained for training.
CaribBooks does not make decisions with legal effect about anyone. It records transactions, asks questions when something is unclear, and proposes entries for approval. A posted transaction cannot be deleted by the agent: to reverse one it must post a reversing entry, so the original remains in the ledger and the audit trail stays intact.
Sub-processors
We use a small number of providers to run the service. Each is bound by its own contract and processes data only to deliver the function described.
We keep this list current. If we add a sub-processor that materially changes how data is handled, we will say so here and, for partner firms, in writing.
Where your data is held
Your data is held in two places, and we would rather name both than generalise.
The books themselves — transactions, ledgers, reports, receipt images and your account — are held by Amazon Web Services in the United States, in regions in Northern Virginia and Ohio.
WhatsApp message content passes through and is stored by Unipile, a French company, on Scaleway infrastructure in France. Unipile states that this data is hosted exclusively in the European Union with no transfer outside it, so your clients’ messages sit under the GDPR.
There is no Jamaican cloud region behind either provider. A claim of local storage would not be true, so we do not make one.
Transfers out of Jamaica are made under contractual safeguards with each provider. If your practice requires a specific arrangement for cross-border transfer, we will discuss it as part of a data processing agreement.
How long we keep it
| Data | Retention |
|---|---|
| Accounting records: journal entries, ledger, chart of accounts, invoices | Life of the account, then 10 years |
| Receipt and document images | Life of the account, then 10 years |
| WhatsApp message history | 24 months |
| What CaribBooks has learned about a business | Life of the account, erasable on request |
| Reminders | Until cancelled or fired, erasable on request |
| Agent reasoning records | 90 days |
| Server logs | 30 days |
| Backups and point-in-time recovery | 35 days |
Ten years on the accounting record is deliberate, and longer than the statutory minimum in Jamaica. A business is required by law to keep its accounting records, and a practice should never have to leave us in order to answer a records request.
Deletion and erasure
You can ask us to erase the message history, the facts CaribBooks has learned about your operations, and your reminders, at any time. We will do it and confirm when it is done.
Worth knowing before you ask: erasing what CaribBooks has learned makes it worse at your business. Vendor recognition, category memory and the patterns that let it post without asking all come from that data. It will go back to asking questions it had stopped needing to ask.
We cannot erase the accounting record itself while the statutory retention period runs. Deleting it would put the business, and any practice acting for it, in breach of its own obligations. This is the limit that data protection law itself recognises, and it applies to every provider of accounting software.
Two honest qualifications about what deletion means. Backups hold a copy for up to 35 days and expire on their own, and server logs may contain identifiers for up to 30 days. Deletion is therefore prompt rather than instantaneous everywhere, and we would rather say so than claim otherwise.
Your rights
Under the Jamaica Data Protection Act, and under the GDPR where it applies to you, you may ask us to give you a copy of your data, correct it, erase it, restrict how we use it, provide it in a portable format, or object to a particular use. You may also withdraw consent where our basis was consent.
Write to hello@caribnexusai.com. We will respond within 30 days. We may need to confirm who you are before acting, which is a protection for you rather than an obstacle.
If you are a client of an accounting practice that uses CaribBooks, please contact the practice first. They are the controller of your data and we will support them in answering you.
You have the right to complain to the Office of the Information Commissioner in Jamaica, or to your own supervisory authority if you are elsewhere.
Security
No system is perfectly secure, and anyone who tells you otherwise is selling something. What we can tell you is what we actually do, which is written above, and that we review it rather than assume it.
Personal data breaches
If a breach occurs that is likely to put anyone at risk, we will notify the Office of the Information Commissioner promptly, and within 72 hours where that obligation applies. We will tell affected people directly where the risk is high, and we will tell any affected practice what happened, what data was involved and what we did about it.
Children
Our services are for businesses and are not directed at children. We do not knowingly collect data from anyone under 16. If we learn that we have, we will delete it.
Changes and contact
If we change this policy in a way that materially affects you, we will update the date at the top, post a notice on this page, and tell partner firms in writing.
Partner firms who need a data processing agreement for their own compliance file should write to us and we will provide one.