1. Scope
This Privacy Policy explains how CarlRAC (“CarlRAC,” “we,” “us,” or “our”) collects, uses, stores, shares, and deletes information when you use the CarlRAC AI platform and related services (the “Service”), including information obtained through connected Google and Gmail accounts.
2. Information We Collect
- Account information: your name, email address, business or license information you provide, authentication identifiers, and account settings. Authentication credentials are handled by our authentication service provider.
- Contact and lead data: names, email addresses, telephone numbers, notes, categories, and communication history you upload, import, or create.
- Gmail data: only if you connect Gmail, message metadata and message-body content relevant to matched contacts, retrieved through the Gmail API.
- Usage data: log data, device and browser information, feature usage, diagnostic information, and security events.
- Payment information: information processed by our payment provider when paid services are available. CarlRAC does not store complete payment-card numbers.
3. How We Use Information
We use information to:
- Provide contact organization, communication analysis, AI-generated insights, follow-up planning, and message-sending features you enable.
- Operate background Gmail synchronization so matched communication data stays current.
- Generate AI insights and drafts by transmitting relevant content to an AI service provider acting on our behalf.
- Maintain security, prevent abuse, and troubleshoot failures.
- Comply with legal obligations.
- Communicate with you about your account and the Service.
We do not sell personal information or Gmail data. We do not use Gmail data for advertising.
4. AI Processing
Content you submit, and Gmail content you authorize us to access, may be transmitted to an AI service provider acting on our behalf to generate summaries, insights, classifications, recommendations, or draft communications that provide the user-facing features you request.
We require AI service providers to protect this information and use it only to provide the contracted service. CarlRAC does not use or transfer Gmail data to develop, improve, or train generalized or non-personalized artificial-intelligence or machine-learning models.
5. Storage and Security
Matched Gmail messages and other application data are stored using service providers, including our database provider. We use encryption in transit, access controls, encrypted OAuth tokens, and account-level data isolation designed to protect information from unauthorized access, use, alteration, or disclosure.
No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
6. Sharing of Information
We share information only:
- With service providers that process information on our behalf, including hosting, database, authentication, AI processing, email or SMS delivery, monitoring, and payment providers, under agreements requiring appropriate protection and limiting use to the contracted service.
- With authorities when required by applicable law or when necessary to protect rights, safety, or the integrity of the Service.
- In connection with a merger, acquisition, or sale of assets only as permitted by applicable law. Where the transfer includes Google user data, we will obtain explicit prior consent when required by Google’s Limited Use requirements.
- When you direct us or provide consent.
7. Your Choices and Rights
You may:
- Request access to, correction of, export of, or deletion of your account data by contacting support@carlrac.com.
- Disconnect Gmail in account settings, which stops future Gmail access and initiates deletion described in Section 9.
- Request deletion of your account and associated data, subject to the concrete timeframes in Section 9.
Depending on your location, you may have additional rights to access, delete, correct, obtain, or restrict the processing of personal information. Contact us to exercise those rights.
8. Google API Services and Gmail Data - Limited Use Disclosure
CarlRAC AI’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Specifically:
- We use Gmail data only to provide or improve the user-facing features that are prominent in CarlRAC AI and that you enable, including contact matching, communication analysis, follow-up insights, draft generation, and message sending.
- We do not use Gmail data for advertising.
- We do not transfer Gmail data to third parties except when the transfer is necessary to provide or improve those user-facing features, to comply with applicable law, to protect against malware, spam, phishing, fraud, or abuse, as part of a merger, acquisition, or sale of assets after obtaining explicit prior user consent, or when you provide affirmative consent.
- We do not allow humans to read Gmail data unless we first obtain your affirmative consent to view specific messages for a specific support purpose; the data is aggregated and anonymized and used for internal operations in accordance with applicable privacy requirements; access is necessary for security purposes such as investigating abuse; or access is required to comply with applicable law.
- We do not use or transfer Gmail data to develop, improve, or train generalized or non-personalized AI or machine-learning models.
9. Data Retention and Deletion
- Gmail message content matched to your contacts is retained while your Gmail integration remains connected and the content is needed to provide the enabled Gmail features.
- When you disconnect Gmail, future access stops and cached Gmail message content is deleted from active systems within 30 days.
- When you delete your account, personal information and Gmail-derived data are deleted or de-identified from active systems within 60 days, except when retention is required by applicable law or is reasonably necessary for fraud prevention, security, or the establishment, exercise, or defense of legal claims.
- Residual copies in protected backups are deleted or overwritten within 90 days after deletion from active systems, unless a longer period is required by law.
You may initiate a deletion request at any time by contacting support@carlrac.com. We begin processing verified requests promptly and complete deletion within the timeframes above.
10. Children’s Privacy
The Service is not directed to individuals under 18, and we do not knowingly collect personal information from them.
11. Changes to This Policy
We may update this Privacy Policy. We will post the revised Policy and update the effective date. We will provide appropriate notice before material changes affecting Gmail data use take effect and obtain consent when required.
12. Contact
CarlRAC
Massachusetts, United States
support@carlrac.com