CartiamAI LLC privacy policy

CartiamAI processes identity, contact, session, billing and usage data to create accounts, authenticate users, provide support, operate the service and prevent abuse. Operational data uploaded by an organization is processed on that organization's behalf; the organization determines its purposes and authorized users.

Only necessary data is collected. Acceptance records include the document version, text hash, actor, organization, language and time; IP and user agent are recorded only when enabled by the published configuration. Passwords are hashed and integration keys are encrypted; full keys are not displayed on subsequent screens.

Stripe processes payments; CartiamAI does not store complete card numbers. Enabled hosting, email, storage and AI providers may process data to deliver the service. Voluntarily connecting an AI provider permits sending the data needed for the authorized request. International transfers may occur under applicable rules and agreements.

Each organization can export its data. Requests for access, correction, deletion and other applicable rights are handled through the published privacy channel. Deletion may be deferred for legal or accounting duties or disputes; the retention policy describes configured periods.

Access controls and audit records restrict data use to authorized users. Optional analytics and advertising require the relevant consent. CartiamAI does not sell organizations' operational data. This version defines the product framework; actual providers and a privacy contact must be published before production operation.