Carson Privacy Policy

Introduction

Kapiche Pty Ltd (ACN 162 982 961) ("Kapiche," "we," "us," or "our") provides Carson, a customer conversation intelligence platform. This Privacy Policy describes how we collect, use, disclose, and protect personal information in connection with the Carson web application at app.getcarson.ai, the Carson API, the Carson Slack app, Carson's MCP interface for AI clients, our marketing website at getcarson.ai, and any related support and communications (together, the "Services").

By creating a Carson workspace, accepting an invitation to one, or otherwise using the Services, you agree to the Carson Terms of Service, which incorporate this Privacy Policy and our Data Processing Addendum ("DPA"). If you are using the Services on behalf of an organization, you represent that you have authority to accept these terms for it. If you do not agree, do not use the Services.

Summary of Key Points

• You own your data. The conversations, tickets, transcripts, and other content you connect to Carson are yours. We use them only to provide and improve the Services for you, to improve Carson more widely where they appear in session replays (Section 2), and to create de-identified data (Section 5). We do not sell them, and we do not use them to train AI models.
• Two roles. For the content you bring into Carson, your organization is the controller (or "business" under U.S. state law) and we are its processor or service provider, acting on its instructions, apart from the two uses Section 1 describes. For your account, billing, and use of the product itself, we are the controller.
• Hosted in the United States. Your workspace runs on US-based cloud infrastructure. A small number of subprocessors, listed in Appendix A, support the Services under contracts that require equivalent protection.
• AI with guardrails. Carson sends bounded excerpts of your content, with your organization named for context, to third-party language models to extract themes, signals, and answers. Those providers are contractually barred from training on your data or retaining it beyond serving the request, apart from a short-lived prompt cache described in Section 4. Every AI output in Carson is traceable to the source conversations it came from.
• De-identified data. We may derive statistics, benchmarks, and insights from the Services in a form that cannot reasonably be linked to you, your organization, or any individual. We keep and use this data to improve Carson and to publish industry insights, and we commit not to re-identify it.
• Security you can verify. Kapiche is audited against SOC 2 Type II and CSA STAR and runs GDPR and CCPA programs. Our security practices and the current subprocessor list are published at getcarson.ai/security.
• Deletion when you leave. A workspace administrator can close your workspace at any time from Settings in Carson, or by emailing support@getcarson.ai. Your content and per-customer backups are deleted within one month of your account ending or of your request. Session replays, which can show your content, are deleted 30 days after they are recorded, even if you leave sooner (Section 10).
• Questions or requests: privacy@getcarson.ai.

1. Scope and Our Roles

This Privacy Policy applies to three groups of people:

• Customers and workspace users. Anyone who signs up for Carson, is invited to a Carson workspace, or joins the waitlist on getcarson.ai.
• Individuals whose information appears in Customer Content. Your customers, prospects, and staff whose support tickets, sales calls, survey responses, chat messages, and CRM records you connect to Carson. We process this information on behalf of the Carson customer that connected it. If you are one of these individuals and have a question about your data, please contact the organization you dealt with; it controls that data and we will assist it in responding.
• Website visitors and people who correspond with us.

"Customer Content" means the data a customer connects to or uploads into Carson and everything Carson derives from it: conversations, transcripts, tickets, survey responses, Slack messages, CRM account attributes, product-usage metrics, uploaded documents, the themes and signals Carson extracts, and the questions users ask Carson together with its answers.

For Customer Content, the customer is the controller and we are its processor (or, under U.S. state privacy laws, the customer is the business and we are its service provider). We process Customer Content only to provide and improve the Services for the customer, on its documented instructions, under the DPA, apart from two uses the Terms add: we view the Customer Content that session replays record (Section 2) to see how Carson is used and improve it, and we create de-identified data from it (Section 5). Customers are responsible for having a lawful basis to collect Customer Content and to share it with us, and for providing any required notices to the individuals it concerns.

For everything else described in this Privacy Policy, including account details, billing, product usage, diagnostics, and our communications with you, we are the controller.

2. Personal Information We Collect

A. Information You Provide to Us

Account and profile information. When you join the waitlist, sign up, or accept an invitation, we collect your name, work email address, organization name, and, if you provide them, your job title and the areas of the business you work in. Authentication is handled by Auth0. If you sign in with a password, Auth0 stores it as a salted hash and checks it against known breached-password lists; we never see the password itself.

Customer Content you connect or upload. Carson ingests Customer Content from the sources you choose to connect. Today those sources include Zendesk, Intercom, Gorgias, HubSpot, Gong, Slack, SurveyMonkey, data warehouses such as BigQuery, and files you upload directly. What we receive depends on the source and the permissions you grant during the connection flow: for a help desk it is tickets and their messages; for a call recorder it is transcripts and call metadata; for Slack it is messages from the public channels the Carson app is a member of, which means the channels you invite it into and any channel you choose as a destination for findings, together with the list of every active public channel in your workspace with each channel's name and description; Carson tries each channel on that list to see whether it can read it, and stores the name and description with each conversation it reads, the channel name as that conversation's title, and the names of every member of your Slack workspace so Carson can attribute each message to a person and tell internal participants from external ones, though only the names of people who took part in a conversation are kept, along with the Slack user ids of the people who wrote, replied to, or reacted to a message, and of anyone mentioned in a message, which Slack sends as an id; the names of the channels on that list appear in our sync logs, covered under Diagnostics below; for a CRM it is account records and attributes such as account owner, plan, and annual contract value; for a warehouse it is the aggregated product-usage metrics you map.

Customer Content routinely contains personal information about your customers and staff, such as names, email addresses, and whatever people wrote or said. It may include sensitive information if the people you dealt with disclosed it.

Integration credentials. To read from your connected sources, Carson stores the OAuth tokens or API keys you authorize. They are encrypted at rest and deleted from our systems when you disconnect the source. We use them only to sync the source you connected and, for Slack, to create or join the channel you choose for findings, which the app then stays a member of, and to post there at your direction (Section 6). To end the grant at the source system itself, revoke it there.

Questions you ask Carson. When you ask Carson a question in the app, we store the question, the answer, and the intermediate evidence Carson used to reach it, so you can revisit past answers, audit how Carson reached them, and continue a conversation later. When you ask Carson in a Slack thread where the app is mentioned, the reply path does not store the question, though in a public channel Carson is a member of, which is what lets you mention it there, the message carrying the question is read with the rest of that channel as described above. We store the answer Carson posted, a record that the question was answered across your whole workspace (nothing in that record is taken from the question), and the Slack workspace, channel, thread and user identifiers it needs to reply. Questions asked through an AI client connected over MCP are answered without being stored.

Communications. When you email us, reply to a product email, or contact support, we keep the correspondence.

B. Information We Collect Automatically

Product usage information. We collect information about how the Carson application is used: pages and features opened, clicks, viewport and browser type, operating system, session identifiers, and the workspace in use. Events are sent to an endpoint on our own domain, which forwards them to the analytics vendor.

Usage events are built so that Customer Content cannot pass through them. Every outgoing event is filtered against a fixed allowlist of known-safe properties; anything not on the list, including free text, search queries, URL parameters, and on-screen content, is dropped from the event before it leaves your browser. Session replays record what is on your screen as you use the application, including Customer Content and the names and email addresses of other people it shows, such as colleagues and people invited to your workspace, so we can support you and see how Carson is used in order to improve it. Our staff view replays under the controls in Section 9. When our staff open your workspace, replays of their sessions record it the same way. In a replay, what you type into a form field is masked in that field, though text the application shows elsewhere, such as a question you have sent, is recorded with the rest of the screen. On the screen where an administrator deletes a person's data, that person's details are not recorded, and network requests and responses are never recorded. We associate usage, including replays, with your name and work email so we can support you and understand adoption within your organization.

Diagnostics. When something goes wrong we capture error reports, performance traces, and server logs to fix it. Error reports from the application in your browser have their free-text message removed before they leave the browser and are associated with your account in the same way as product usage information. Server-side traces and logs can include your email address, your account identifier, your organization's name and workspace identifier, and, on our public endpoints (sign-in, sign-up, invitations, help with signing in, and the discovery document AI clients read before connecting over MCP), the network address you connect from. Server-side traces and error messages can also contain fragments of Customer Content, in request URLs and in error responses from model providers. Server-side error reports, with their messages, go to PostHog, and traces go to Honeycomb; both are listed in Appendix A. Our staff use them under the controls in Section 9.

Cookies and similar technologies. See Section 7.

C. Information We Receive from Third Parties

Identity providers. If you sign in with Google or Microsoft, we receive your name, email address, and a verified-email flag from that provider.

Connected sources. The Customer Content described above is received from the third-party systems you connect, under the permissions you grant.

Business contact data. We may receive business contact details from referral partners or publicly available professional sources for the purpose of contacting prospective customers. You can opt out of marketing at any time.

3. How We Use Personal Information

We use personal information for the following purposes:

• To provide, operate, and secure the Services, including syncing your sources, running analysis, answering questions, authenticating you, and preventing fraud and abuse.
• To understand how the Services are used and to improve them, including developing new features, measuring adoption, and viewing session replays, which can show Customer Content (Section 2).
• To diagnose and fix faults and maintain a reliable service.
• To communicate with you, including sending invitations, security notices, changes to terms, onboarding tips, product news, and responses to your requests. You can opt out of marketing emails at any time using the unsubscribe link.
• To bill you and keep financial records.
• To create de-identified data, as described in Section 5.
• To comply with law, enforce our terms, and protect rights and safety, including responding to legal process.

We do not use personal information for automated decisions that produce legal or similarly significant effects on individuals. Carson's outputs are analytical summaries for your team to act on, and every output links back to the underlying conversations so a person can check it.

4. Artificial Intelligence

Carson uses large language models to extract themes and signals from conversations, to build and maintain your taxonomy, to generate embeddings for search, and to answer the questions you ask. These models are operated by third-party providers in the United States. Carson routes every request through a gateway we operate. The providers that serve customer requests appear in our subprocessor list in Appendix A, and we give notice before adding one. The specific models change over time; the current set is available on request.

Our commitments:

• No training on your data. We do not use Customer Content to train, fine-tune, or otherwise improve any AI model, ours or anyone else's, and we do not build bespoke models on your data.
• Providers do not keep your data, with one exception. We use model providers under terms that prohibit them from retaining your inputs or outputs beyond serving the request, or from using them for training. The one exception is short-lived prompt caching: the provider may hold the stable opening part of a prompt, which includes your company background and the theme names, signal names and descriptions, and scope values Carson has derived from your content, for a short period the provider controls, currently up to an hour, so repeated requests are cheaper.
• Bounded inputs. Each request to a model carries the excerpts needed for that task, together with context such as your organization's name, the name of the person asking and the areas of the business they work in, the company background you entered at onboarding, and your workspace time zone, and carries your workspace identifier, the short address suggested and confirmed when your workspace was created, for cost attribution and to tell the model which workspace it is working in.
• Traceable outputs. Every stored output records which model produced it and which source records it was derived from.
• Human oversight. Our team reviews output quality on an ongoing basis, and you can challenge or correct any output in the product. A session replay that showed an output before you corrected it is not corrected; it is deleted 30 days after it was recorded (Section 10).

5. De-identified Data

We may create de-identified data from personal information and Customer Content, such as statistics about the volume, categories, and trends of customer conversations across many workspaces, and benchmarks of how organizations of similar size or industry compare. De-identified data has had identifiers removed and cannot reasonably be linked, directly or indirectly, to a particular individual, household, or customer.

We use de-identified data to operate, analyze, and improve the Services, to develop benchmarks and industry insights, to publish research, and for other lawful business purposes. We retain de-identified data indefinitely, including after your relationship with us ends. De-identified data is not personal information and is not Customer Content, and this Privacy Policy does not restrict our use of it, except that:

• We maintain technical and organizational measures designed to ensure it cannot reasonably be re-identified.
• We publicly commit not to attempt to re-identify it, except to test whether our de-identification measures are effective.
• We contractually prohibit any recipient of it from attempting to re-identify it.
• We do not publish benchmarks or insights in a form that would allow a reader to identify a particular customer or its data.
• Nothing in this Section permits us to use Customer Content to train AI models, as described in Section 4.

6. How We Disclose Personal Information

We do not sell personal information, and we do not share it for cross-context behavioral advertising or targeted advertising.

Service providers and subprocessors. We use a small number of service providers to run the Services. Each is bound by a contract that limits its use of personal information to providing its service to us and requires security measures appropriate to the data. The subprocessors that process personal information for the Services are listed, with locations and purposes, in Appendix A and on our security page at getcarson.ai/security; the two are published from one list. We update the list and notify customers before a subprocessor, including one already on the list, begins processing Customer Content or a kind or scope of Customer Content it did not process before, and customers may object as described in the DPA.

At your direction. When you connect an outbound channel, such as posting Carson findings into a Slack channel, or authorize an AI client to query your workspace over MCP, Carson sends information to that destination on your instruction. Content shared this way is governed by the destination's terms, and anyone with access to that channel or client can see it.

Within your workspace. Members of your Carson workspace can see the Customer Content in it and each other's names and email addresses. Questions you ask Carson in the app, and their answers, are visible in the product only to you, though a session replay of your screen shows them (Section 2); questions asked in a Slack thread, and their answers, are visible to that channel.

Legal, safety, and compliance. We may disclose personal information if required by law, subpoena, or court order, or where we believe disclosure is necessary to protect the rights, safety, or property of Kapiche, our customers, or the public, to enforce our agreements, or to detect and address fraud or security issues. Where legally permitted, we will notify the affected customer before disclosing Customer Content.

Business transfers. If Kapiche is involved in a merger, acquisition, financing, reorganization, or sale of all or part of its assets, personal information may be transferred as part of that transaction. We will notify you before your personal information becomes subject to a different privacy policy.

With your consent or at your request.

7. Cookies and Tracking Technologies

The Carson application uses cookies and browser storage to sign you in and keep you signed in, for security, and to remember your preferences. Product analytics uses browser storage to recognize a session and, after you sign in, your user, and records session replays of the application as described in Section 2. We do not use advertising cookies in the Carson application. The getcarson.ai marketing website may use analytics cookies to measure traffic.

You can control cookies through your browser settings. Blocking essential cookies will prevent you from signing in. Because there is no common industry standard, we do not currently respond to browser "Do Not Track" signals. We treat Global Privacy Control signals as described in Section 12.

8. Data Hosting and International Transfers

Carson's production systems run on US-based cloud infrastructure. In Carson's own systems, Customer Content is stored and processed in the United States with per-workspace isolation and encryption at rest. Session replays, which can show Customer Content (Section 2), are held by our analytics vendor, also in the United States, outside Carson's own systems.

Our team accesses systems from Australia, and some subprocessors operate elsewhere. As a result, if you are outside the United States, your personal information is transferred to and processed in the United States and may be accessed from other countries, including countries whose data protection laws differ from those of your home jurisdiction. Where the GDPR or UK GDPR applies and personal information leaves the EEA or the UK, we rely on the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, together with the safeguards described in this Privacy Policy. Where the Australian Privacy Act applies, we take reasonable steps to ensure overseas recipients handle personal information in accordance with the Australian Privacy Principles.

9. Security

Kapiche operates a security program audited against SOC 2 Type II and CSA STAR. Our practices are summarised at getcarson.ai/security, and the SOC 2 report and penetration test summary are available on request. Key measures include:

• Encryption of data in transit over public networks with TLS 1.2 or higher, and at rest in Carson's own systems with strong, industry-standard algorithms.
• Logical isolation of each customer's data by workspace in Carson's own systems, with every analytics query scoped to a single workspace at the application layer.
• Access to production systems and Customer Content, including session replays, limited to personnel who need it to run, support and improve the Services, enforced through single sign-on with multi-factor authentication, with access rights reviewed regularly.
• Fully separated production and development environments. Our customers' Customer Content is never copied into our development or test environments; Kapiche's own workspace data is used for development and testing.
• Continuous vulnerability scanning, dependency scanning, static analysis, cloud posture monitoring, and regular third-party penetration testing, with a public responsible disclosure program.
• Daily database backups and per-customer backups, tested periodically for restorability, with a recovery time objective of 24 hours.
• Endpoint protection, full-disk encryption, and security and privacy training for all personnel.

If we become aware of a security breach affecting your personal information, we will notify you without undue delay and in any case within 48 hours of confirming it, or sooner where your contract or applicable law requires, by email to your workspace administrators.

No method of transmission or storage is completely secure. You are responsible for keeping your credentials confidential and for the permissions you grant to workspace members, connected sources, and AI clients.

10. Data Retention

We retain personal information for as long as needed to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law. A session replay is a separate copy of what was on screen: whatever it shows, including Customer Content, is kept in the replay until the replay is deleted (Session replays, below), even where a row says the data itself is deleted sooner. Specifically:

Once deleted, data cannot be restored.

11. Your Rights and Choices

Marketing communications. You can opt out of marketing emails at any time using the unsubscribe link in any email or by contacting us. We will continue to send service messages such as invitations, security notices, and changes to terms.

Account and workspace. Workspace administrators can change member roles, remove members and close the workspace in the product, and any workspace member can connect or disconnect sources. To correct your name or email address, or to have us close the workspace for you, email support@getcarson.ai. A session replay that shows the old name or address is not corrected; it is deleted 30 days after it was recorded (Section 10).

Access, correction, deletion, and portability. Depending on where you live, you may have the right to access the personal information we hold about you, correct inaccuracies, delete it, receive a copy in a portable format, object to or restrict certain processing, and withdraw consent where processing is based on consent. A session replay that shows your information is not corrected, and is deleted 30 days after it was recorded, not sooner, even when the rest is deleted or corrected on your request (Section 10). Section 12 describes rights under U.S. state privacy laws and Section 13 describes rights in Australia.

How to exercise your rights. Email privacy@getcarson.ai from the address on your account, or ask a workspace administrator to do so on your behalf. We will verify your identity before acting on a request, typically by confirming control of the email address on your account. We will respond within 30 days, or within the period required by applicable law, and will not charge a fee unless a request is manifestly unfounded or excessive. Where we act as processor or service provider for Customer Content, we will refer your request to the relevant customer and assist it in responding.

12. Additional Information for U.S. Residents

This Section applies to residents of California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, and other U.S. states with comprehensive privacy laws, to the extent those laws apply to us. Most of the personal information we handle is business contact information or is processed on behalf of our customers, and some state laws exempt such information.

Categories of personal information. In the preceding 12 months we have collected the following categories of personal information, as defined by the California Consumer Privacy Act ("CCPA"):

We collect these categories from the sources and for the purposes described in Sections 2 and 3. We disclose them to the service providers described in Section 6 and Appendix A for business purposes only. We do not sell personal information and have not done so in the preceding 12 months. We do not share personal information for cross-context behavioral advertising. We use sensitive personal information only to provide and improve the Services for our customers, to improve Carson more widely where it appears in session replays (Section 2), to create de-identified data (Section 5), and for the purposes permitted by the CCPA regulations, and we do not use it to infer characteristics about individuals. We do not knowingly sell or share the personal information of anyone under 16.

Your rights. Subject to applicable exemptions, you have the right to know what personal information we collect, use, and disclose; to access it; to correct it (a session replay that shows it is not corrected); to delete it (a session replay that shows it is deleted 30 days after it was recorded, not sooner, Section 10); to obtain a portable copy; to opt out of sale, sharing, and targeted advertising (we do none of these); to limit the use of sensitive personal information; to appeal a decision we make about your request; and not to be discriminated against for exercising your rights. To exercise these rights, use the contact methods in Section 11. You may designate an authorized agent to make a request on your behalf; we will require proof of the agent's authority and may verify your identity directly. If we deny your request, you may appeal by replying to our response, and we will respond to your appeal within 45 days.

Global Privacy Control. Because we do not sell or share personal information, there is no opt-out to apply. We honor Global Privacy Control signals as a valid request to opt out of any sale or sharing should our practices change.

Notice of financial incentive. We do not offer financial incentives in exchange for personal information.

Shine the Light. California residents may request information about our disclosure of personal information to third parties for their direct marketing purposes. We do not make such disclosures.

13. Additional Information for Australia

We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. You may request access to or correction of your personal information using the contact methods in Section 11; a session replay that shows it is not corrected, and is deleted 30 days after it was recorded (Section 10). If you are not satisfied with our response to a complaint, you may contact the Office of the Australian Information Commissioner at oaic.gov.au.

14. Children's Privacy

The Services are business tools and are not directed to anyone under 16. We do not knowingly collect personal information from children. If you believe a child has provided us personal information, contact privacy@getcarson.ai and we will delete it; a session replay that shows it is deleted 30 days after it was recorded (Section 10).

15. Third-Party Services

The Services connect to third-party systems you choose, such as help desks, CRMs, call recorders, Slack, and AI clients, and may link to third-party websites. This Privacy Policy does not apply to those third parties. Their collection and use of information is governed by their own privacy policies, and we encourage you to review them.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will post the updated version here and revise the "Last updated" date, and each version takes effect when we post it. For material changes, we will make reasonable efforts to notify workspace administrators by email or in-app notice as soon as practicable, and before the changes take effect where we can. A customer that does not agree to a change may cancel its subscription or close its workspace as the Terms of Service describe. Anyone else may use the rights in Section 11, or, for information in Customer Content, contact the organization that connected it (Section 1).

17. Contact Us

Kapiche Pty Ltd (ACN 162 982 961)
Level 4, 260 Queen Street
Brisbane QLD 4000, Australia

Privacy contact: Brendan Brummer, privacy@getcarson.ai
General inquiries: hello@getcarson.ai
Security and trust: getcarson.ai/security

Appendix A: Subprocessors

The same list is published at getcarson.ai/security. Both are updated together.