Privacy Policy

Effective Date: February 9, 2026 · Last Updated: February 12, 2026

1. Who We Are

Carrot Labs AI, Inc. ("Carrot Labs," "we," "us," or "our") helps teams make their AI agents faster, more reliable, and continuously improving. We build evaluation environments, measure performance, and optimize agent systems for production.

This Privacy Policy explains how Carrot Labs collects, uses, stores, and shares your personal information when you use our website at carrotlabs.ai, our products, and any related services (collectively, the "Services").

If you have questions about this policy or your data, contact us at [email protected].

2. Information We Collect

2.1 Information You Provide

  • Account Information: When you create an account, we collect your name, email address, and authentication credentials.
  • Payment Information: If you purchase a subscription, payment information is processed by our third-party payment processor. We do not store full credit card numbers.
  • Communications: When you contact us for support or inquiries, we collect the content of your messages and contact details.

2.2 Information from Google APIs

Certain features of our Services may request access to your Google account data through Google APIs. When you authenticate with Google, we may access:

  • Basic Profile Information: Your name, email address, and profile photo, used to create and manage your account.
  • Google Workspace Data: Depending on the product and the permissions you grant, we may access specific Google Workspace data (such as Google Sheets or Google Drive files) solely to provide the functionality you requested.

We only request the minimum scopes necessary for the features you use. You can review and revoke permissions at any time through your Google Account settings.

2.3 Automatically Collected Information

  • Usage Data: Pages visited, features used, interactions with our Services, timestamps, and referring URLs.
  • Device Information: Browser type, operating system, device identifiers, and IP address.
  • Cookies & Analytics: We use PostHog for product analytics to understand how our Services are used and to improve the user experience.

3. How We Use Your Information

We use the information we collect to:

  • Provide, operate, and improve our Services.
  • Authenticate your identity and manage your account.
  • Process transactions and send related communications.
  • Respond to your support requests and inquiries.
  • Analyze usage patterns to improve product functionality and user experience.
  • Comply with legal obligations and enforce our Terms of Service.

4. How We Share Your Information

We do not sell your personal information. We may share your information only in the following circumstances:

  • Service Providers: With trusted third-party vendors who perform services on our behalf (e.g., hosting, analytics, payment processing), bound by contractual obligations to protect your data.
  • Legal Requirements: When required by law, legal process, or to protect the rights, property, or safety of Carrot Labs, our users, or others.
  • Business Transfers: In connection with a merger, acquisition, or sale of assets, in which case your data would remain subject to this Privacy Policy.

We do not share Google user data with third parties for advertising, market research, or with data brokers.

5. Google API Services — Limited Use Disclosure

Carrot Labs' use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically, we limit our use of Google user data as follows:

  • We only access Google user data that is necessary to provide or improve the specific features you use.
  • We do not use Google user data for serving advertisements.
  • We do not transfer or sell Google user data to third parties unless necessary to provide the Service, comply with applicable laws, or as part of a merger or acquisition.
  • We do not use Google user data for purposes unrelated to the functionality of the Services.
  • Human access to Google user data is limited to the minimum necessary for security, compliance, legal obligations, or to provide support you have explicitly requested.

6. Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required by law. Specifically:

  • Account Data: Retained for the duration of your account. When you delete your account, we will delete or anonymize your data within 30 days, unless retention is required for legal or compliance reasons.
  • Google API Data: Data obtained from Google APIs is retained only as long as needed to provide the requested functionality. We delete cached Google data when you revoke access or delete your account.
  • Usage Analytics: Aggregated, anonymized usage data may be retained indefinitely for product improvement purposes.

7. Data Deletion & Your Rights

You have the right to:

  • Access the personal data we hold about you.
  • Correct inaccurate or incomplete data.
  • Delete your personal data.
  • Revoke Google API permissions at any time through your Google Account settings.
  • Export your data in a portable format.

To exercise any of these rights, contact us at [email protected]. We will respond to your request within 30 days.

8. Data Security

We implement industry-standard security measures to protect your data, including encryption in transit (TLS) and at rest, access controls, and regular security reviews. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

9. Third-Party Services

Our Services may contain links to third-party websites or integrate with third-party services. This Privacy Policy does not apply to those services. We encourage you to review the privacy policies of any third-party service you interact with.

10. Children's Privacy

Our Services are not directed to individuals under the age of 16. We do not knowingly collect personal information from children. If we learn that we have collected data from a child under 16, we will take steps to delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last Updated" date at the top of this page. For material changes, we will provide notice through our Services or by email. Your continued use of the Services after changes are posted constitutes your acceptance of the updated policy.

12. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us: