Privacy Policy

This Privacy Policy explains how we collect, use, disclose, and protect personal data in connection with the Service. It is drafted for global use; where local law requires additional disclosures, we may provide supplemental notices.

1. What We Collect and Why

We process personal data to (i) create and maintain your account and deliver the Service (contract performance), (ii) operate, secure, and improve the Service (legitimate interests), (iii) comply with legal/recordkeeping needs, and (iv) where required, with your consent (e.g., certain marketing).

A) Account & Membership

• Sources: You; single-sign-on (SSO) providers you choose (Google/Apple).
• Items (may vary by SSO): Nickname, profile photo. Optional: email, gender, date of birth, mobile phone number.
• Purposes: Account creation; identity/authentication; membership maintenance; misuse prevention; notices/support.
• Retention: Until account deletion (see §7).

B) Paid Services (Subscriptions, Billing, Refunds)

• Items: Login ID, subscription/payment details from your payment provider, transactional records.
• Purposes: Provide and manage paid features, billing, invoicing, refunds, fraud prevention.
• Retention: For the period necessary to administer transactions and satisfy accounting/audit requirements.

C) Content Generation

• Required item: Generated outputs (images, videos, audio, and other formats).
• Optional items (if you choose to provide them): Prompts/text you enter; uploads such as images, videos, audio/voice clips, reference files (e.g., style images, sample audio), and related metadata (e.g., captions, timecodes).
• Derived items we may create for you: System-generated captions/transcripts, thumbnails/previews, transformations/edits, safety and quality signals.
• Purposes: To generate, store, deliver, edit, and improve content you request; to operate and enhance generation quality (including de-identified/pseudonymized use—see §9).
• Retention: Until you delete the content, withdraw consent (where applicable), or delete your account (see §7).

D) Events, Marketing & Support

• Marketing (opt-in): Optional: gender, contact details → personalized recommendations and communications → retained until you opt out or delete your account.
• Support: Required: name, contact details, message content/attachments → intake, investigation, response → retained for a reasonable period for support and QA.

Note on compliance retention: We may retain limited transaction/support records as necessary for tax, accounting, audit, fraud-prevention, or dispute-resolution purposes. Periods vary by jurisdiction; we apply what is required locally without listing country-specific rules here.

2. How We Share Personal Data

We share personal data only:

• with your consent;
• with service providers processing data on our behalf under contracts requiring confidentiality/security;
• as necessary to provide the Service (e.g., cloud hosting, support, AI processing);
• to comply with legal obligations, enforce terms, or protect rights, safety, and security.

In emergencies involving imminent risk to life, safety, or property, we may disclose data to competent authorities where permitted by applicable law.

3. Sharing of Personal Information

We may share your personal information with the following categories of third parties:

3.1 Service Providers

We share personal information with third-party service providers that perform services on our behalf:

3.2 AI Service Providers

When you use AI-powered content generation features, your inputs are transmitted to third-party AI service providers solely for the purpose of generating the requested content. These providers do not use your data for any purpose other than fulfilling the generation request.

For a full and regularly updated list of AI service providers, including what data is transmitted to each provider and links to their respective privacy policies, please see the AI Service Providers page.

We obtain your explicit consent within the app before transmitting your data to AI service providers. You may withdraw your consent at any time in the app settings, though this will disable access to AI-powered features.

4. External Service Integrations (Google, YouTube, Notion, Slack, Meta)

When you connect an external service — such as Google, YouTube, Notion, Slack, or Meta — to the Service, we access and use only the data within the scope you explicitly authorize in that external service, solely to provide the integration features you request.

• What we access: external service authentication tokens and account identifiers, and the content and related metadata you have linked or permitted access to. For example: Google Docs, Sheets, and Slides titles, body, tables, and slide contents and related metadata; YouTube upload-related information (videos, titles, descriptions, thumbnails, visibility); Notion page and database titles, body, property values, and attachments; Slack workspaces, channels, messages, files, and user information; and Meta (Threads, Instagram, Facebook, Meta Ads Manager) posts, media, ad accounts, and ad performance data.
• How we use it: access, collection, storage, retrieval, analysis, and transmission only as necessary to provide the integration features you request (e.g., AI-based analysis). We do not use it for any other purpose and do not sell it or share it with third parties.
• Your control: you can disconnect an integration or revoke access at any time via the in-app disconnection feature or the external service’s permission settings. Upon disconnection or account deletion, we delete data obtained through that integration without undue delay.

Google API Services / Limited Use. Our access to, and use, storage, and sharing of, data received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements, and the Google Workspace API User Data and Developer Policy. We do not use data obtained through Google APIs for serving advertisements, retargeting, personalized or interest-based advertising, sale to third parties, or determining creditworthiness or for lending purposes, and we use it solely to provide the features you explicitly request. We do not retain or use user data obtained through Google Workspace APIs to develop, improve, or train generalized AI and/or ML models.

YouTube. Where you connect YouTube, our use of the YouTube API Services is subject to the YouTube API Services Terms of Service and the YouTube API Services Developer Policies. Google’s privacy practices are described in the Google Privacy Policy, and you can revoke access via the Google security settings page or the in-app disconnection feature.

5. Cookies & Similar Technologies

We use cookies to operate the Service and provide personalization. Control cookies in your browser/device settings (e.g., Safari/Chrome → Privacy & Security). Blocking cookies may affect functionality.

6. Your Rights

Depending on your location, you may have rights to access, correct, delete, restrict or object to processing, and data portability; you can withdraw consent where processing relies on consent. You may act through a lawful representative with appropriate authorization.

We will verify identity/authority and respond within a reasonable time, subject to legal exceptions (e.g., records we must retain). To exercise rights, email contact@carat.im.

7. Data Retention & Deletion

We keep personal data only as long as needed for the purposes described or as required by applicable law. When data is no longer needed, we delete it without undue delay. If continued retention is legally required, we segregate it and limit access.

• Important: Unlinking a social login (Google/Apple/Kakao) does not delete your Carat account or data. Use the in-app account deletion flow or contact us.
• Deleting the app from your device does not delete your account.
• Deletion methods: irreversible deletion of electronic files; shredding/incineration of paper records.

8. Children’s Privacy

The Service is intended for individuals who can lawfully enter into a contract in their place of residence (generally 13+). If we learn that a minor purchased paid services without required authorization, we may cancel the purchase consistent with applicable law.

9. Use of De-Identified/Pseudonymized Data

We may de-identify or pseudonymize data (including multimodal outputs and other content associated with your use) and use it for service analytics, AI model improvement/training, safety, and statistics. Where personal data is involved, we apply the same security measures described in §10 and do not attempt to re-identify individuals.

This does not apply to data obtained through Google Workspace APIs, which we do not use to develop, improve, or train generalized AI/ML models (see §4).

10. Security

We implement administrative, technical, and physical safeguards appropriate to the nature of the data and risks, including internal policies/training, access controls, encryption, security monitoring/updates, and restricted physical access. No system is perfectly secure; please use strong, unique credentials and protect your devices.

11. User Posts & Third-Party Links

• Posts: Personal data you choose to disclose publicly (e.g., in posts) may be difficult to protect. If a post exposes someone else’s personal data, we may delete or redact it.
• Links: Third-party sites are governed by their own privacy policies. Review those policies before providing data.

12. Marketing Communications

Where permitted, we may send marketing communications. You can opt out at any time via the message footer or by emailing contact@carat.im. We will continue to send transactional/service notices as needed.

13. Questions, Complaints & Contact

For any privacy question or request, email contact@carat.im. You may also have the right to lodge a complaint with your local data protection authority, depending on your jurisdiction.

14. Changes to This Policy

We may update this Policy from time to time. If we make material changes, we will notify you in a manner consistent with applicable law (e.g., posting a notice in the Service with a new effective date).