Privacy Policy

Data we collect and sources

If you were on a call with a Caretta customer

A Caretta customer may use Caretta to transcribe and analyze calls you take part in. We process that data on the customer's behalf. Questions and requests about that data should go to that customer. If we receive a request directly, we will promptly forward it to the relevant customer where we can identify them.

How we use the data

• Authenticate sessions, manage accounts, and secure the service.
• Prepare call briefings; capture/transcribe calls if enabled; generate notes/summaries; support evaluations.
• Read relevant Google/Microsoft calendar event data for scheduling and context, and create Google Calendar events only when you enable and use follow-up invites.
• Index supported files from an optional Google Drive connection so they can be found through workspace search.
• Process customer content, including call transcripts, notes, context, and connected data such as Google-derived data, through configured AI service providers only to generate requested user-facing briefings, notes, summaries, and related assistance. We do not use Google user data to train or improve generalized AI or ML models.
• Read and, when enabled, create or update HubSpot contacts, companies, deals, and associated call notes.
• Create a Zoom meeting you request, add its join URL to your calendar invitation, and delete that new meeting if the matching calendar event definitively fails.
• Provide analytics, product improvement, and support.
• Comply with legal obligations and enforce terms.

Legal bases

For personal data we process as a controller, we rely on the following legal bases:

• Performance of a contract (Art. 6(1)(b)): creating and running accounts, delivering requested features, and providing support, where necessary to perform a contract with you.
• Legitimate interests (Art. 6(1)(f)): security and fraud prevention, product improvement, PostHog cookieless counting before consent, and contacting business users about Caretta.
• Consent (Art. 6(1)(a)): analytics and marketing tools that load after cookie consent, including PostHog with an identifier, Vercel Web Analytics, and Surface.
• Legal obligation (Art. 6(1)(c)): keeping billing and tax records and responding to legal requests where required by law.

For customer data processed under the DPA, the customer is responsible for the legal basis.

Sharing and processors

We use service providers under our instructions for cloud hosting and storage, database and authentication, AI models, analytics, website hosting, and marketing tools. The current Subprocessor list is available at https://trust.caretta.so/?tab=subprocessors. Depending on the feature and configuration, AI model providers process customer content, including call transcripts, notes, context, and connected data such as Google-derived data, to provide requested user-facing AI features. Caretta's self-hosted TensorZero gateway software routes configured AI inference; TensorZero is not a separate third-party AI model provider. Selected Google Drive files are imported directly into Caretta Brain rather than sent to Airweave. Inference observability may include request/response content and metadata where configured. For connected calendars we also use the Google Calendar API and Microsoft Graph; for CRM features we use HubSpot APIs. Our service providers receive only the data needed for their stated function. We do not sell personal data.

International transfers

Transfers of customer data from the EEA or UK are covered by the EU Standard Contractual Clauses and the UK Addendum included in our DPA at https://caretta.network/dpa. Caretta is based in the United States. Account, website and analytics data may be processed in the United States and other countries where our providers operate, as listed at https://trust.caretta.so/?tab=subprocessors. Our website PostHog data is hosted in the EU. Where safeguards are required for those transfers, we rely on the EU Standard Contractual Clauses or our providers' equivalent, legally valid transfer mechanisms.

Security

Caretta is ISO 27001 certified. We protect Customer Personal Data with encryption in transit and at rest, multi-factor authentication, least-privilege and role-based access controls, security monitoring, reviewed and tested production changes, and vulnerability management. We maintain incident-response and recovery procedures, test restoration at least annually, and track deletion requests across active systems and backups. Our technical and organizational measures are described in Annex 2 of the DPA at https://caretta.network/dpa. Further security information is available at https://trust.caretta.so.

Retention

We retain OAuth tokens for connections that need ongoing access. Caretta does not retain the short-lived Google Drive token used to import selected files. A successful Zoom disconnect or signed Zoom deauthorisation notification deletes the active Zoom token record and its Zoom user and account ID mapping. Imported Drive data remains in Caretta Brain after Drive disconnect until you or your organisation admin delete the imported file or request deletion. Calendar-derived records, AI inputs and outputs, and inference-observability records are retained only while needed to provide and secure the service, under applicable workspace settings and processor terms, unless law requires longer. Provider security or abuse-monitoring records may be kept for the limited periods in the applicable provider terms unless account-specific reduced-retention controls apply. The website analytics and marketing data is retained only as needed for the stated purposes, according to our provider settings and terms. Withdrawing consent stops PostHog session recordings and returns PostHog to cookieless counting; the other consent-based analytics and marketing scripts will not load on later page loads. It does not automatically delete data already collected by a provider. Revoking access in Google stops new API access but does not automatically delete existing copies already imported, generated, or logged. You or your organisation admin may request deletion of Caretta and processor-held copies at any time by following the deletion process below. We and our providers delete active copies of the applicable data within thirty (30) days of a deletion request and backup copies within ninety (90) days of the request, except where retention is required by law. Backup copies are not used except for disaster recovery. Provider retention terms do not extend these deadlines. Legally required retention is limited to the data, purpose, and period required by law. If we terminate a customer's account, we make Customer Data available for electronic retrieval for thirty (30) days and then delete it on the same basis. In that case, the ninety (90) day backup deletion period starts at the end of the retrieval period. Production logs expire automatically after 365 days, subject to earlier deletion under the deadlines above and retention required by law. We keep a restricted record of deletion requests and completion, containing request and account references but no customer content, to prevent deleted data from returning to use after a restore.

Your rights

You may have rights to access, rectify, erase, restrict, object, and data portability under the GDPR. You may lodge a complaint with the data protection authority in your country, for example the Autoriteit Persoonsgegevens in the Netherlands or the Information Commissioner's Office in the UK. We will respond within statutory periods.

Revocation & deletion

Google-specific disclosures

• Our use and transfer of information received from Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements.
• We use Google user data only to provide or improve prominent, user-facing Caretta features. We do not use Google user data to train or improve generalized AI or ML models.
• Relevant Google-derived data may be processed by the service providers identified in Sharing and processors. We use commercial API services for requested features and disable OpenAI Responses storage and OpenAI Agents SDK tracing in our server-side agent path; provider security or abuse-monitoring retention may still apply as described under Retention.
• We request only the minimum scopes needed and justify any sensitive/restricted scopes during verification.

Children

Our services are not directed to children and we do not knowingly process children's data.

Changes

We may update this policy from time to time. We will post the new date and, where appropriate, notify you.

Scopes & permissions

Below are the exact scopes our app uses or has submitted for approval and how we use them. We only request the minimum set of permissions required to deliver the described functionality.