Privacy Policy

1. What we collect

Account data: name, email, phone and business name. Subscription payments are handled by Paymob; we never see your card numbers.

Customer data you store in Carot: customer names, phone numbers, conversation history, orders, addresses. This is your data, not ours.

Usage data: error reports, browser type and IP address in our server logs.

Channel data: messages from WhatsApp/Messenger/Instagram via official Meta APIs. We only see what the channel APIs send us.

2. How we use your data

Provide and improve the Service (the obvious use)

Detect fraud, abuse, and security issues

Send service-related emails (login alerts, invoices, security notices) - these are mandatory

Send product update emails - you can unsubscribe from these anytime

Generate anonymous, aggregated statistics for marketing (e.g. 'merchants average X messages per day')

3. Who we share with

We never sell your data. Period.

We share data only with vetted processors who help us run the Service:

OpenAI (AI replies, Co-pilot suggestions and voice-note transcription) - receives conversation text and voice notes to process them

Anthropic (backup AI provider when OpenAI is unavailable) - receives conversation text only in that case

Google (Gemini) - only if a merchant connects their own Gemini key; requests then go to Google under the merchant's account

Railway (application, database and cache hosting in Singapore) - runs the servers that process and store your data

Cloudflare (network, security and web analytics) - carries traffic to carot.tech and counts page views without cookies

Paymob (payment processing) - handles Carot subscription payments; card numbers go to Paymob directly and Carot never sees them

Paymob and Fawry (on the merchant's own account) - when a merchant connects one, it receives the customer's name, phone, email and the amount to create a payment link

Sentry (error monitoring) - receives technical error reports, which can include the page or request that failed

Amplitude (product analytics) - receives the name, email, phone and role of the person signed in to the dashboard and how they use it (pages opened, buttons clicked, and whether an action succeeded). Customer names, messages, phone numbers and addresses are hidden before anything is sent, and screens are not recorded

Resend (email delivery) - sends account emails such as password resets

Web push services (Google, Mozilla, Apple) - deliver the browser notifications you turn on, including their text

Meta / Telegram / Reddit (channels) - we send/receive your messages through their official APIs

Bosta / Mylerz (shipping, on the merchant's own account) - when a merchant connects one, it receives the customer's name, address, phone and order details to deliver the package

4. Data from Facebook, Instagram & WhatsApp

When a merchant connects a channel through Facebook Login, Meta shares with Carot the merchant's app-scoped Facebook user ID, the Facebook Page, Instagram account and WhatsApp Business Account the merchant picked (their IDs, names, pictures and the WhatsApp business number), the names of the merchant's Business Manager accounts (only to find the WhatsApp account), plus access tokens that let Carot send and receive messages on them. Tokens are stored encrypted.

After that, Meta sends Carot the messages and comments people send to those accounts: the text and media, the sender's ID, and their name and profile picture when Meta includes them. For comments, Carot also reads the post they belong to (its text, picture and link).

We use this data only to run the merchant's inbox: showing conversations and comments, sending the merchant's replies, the comment actions the merchant takes (reply, like, hide, delete, or one private reply), and the automatic bot and AI replies the merchant turns on. We never sell it and never use it to advertise to anyone.

Ads attribution (optional, off by default): if a merchant turns it on and connects their own Meta pixel, Carot reports conversation events (a message received, an item added to the cart, a purchase) to that pixel through Meta's Conversions API, so the merchant can measure their ads. It sends the order value, the ad click ID when the chat started from an ad, and the customer's email and phone number hashed with SHA-256, never in plain text.

Deleting it: remove Carot from the apps and business integrations in your Facebook settings. Carot loses access right away. Facebook then lets you send Carot a data deletion request from the same place; when it arrives we automatically erase the tokens and Page details your login gave us. You can also press Disconnect on a channel in Carot, or delete the Carot account (Settings → Danger zone), which erases all of it after a 30-day grace period.

If you messaged a shop that uses Carot, that conversation belongs to the shop: ask the shop to delete it, or email [email protected] and we will reply within 5 business days.

Step-by-step instructions and the status of any deletion request: carot.tech/legal/data-deletion

5. How we protect your data

Encryption in transit: every connection to Carot uses HTTPS (TLS).

Encryption at rest: channel access tokens are encrypted by Carot before they are stored.

Access control: only the Carot team can access production systems, and only to run and support the Service.

Reporting a vulnerability: email [email protected].

Incident response: if we discover a breach, affected merchants are notified within 72 hours.

6. Your rights

Access: request a copy of all your data from Settings → Danger zone → Export.

Correction: update any incorrect data from your account settings.

Deletion: delete your entire account anytime. It is erased after a 30-day grace period in which you can still restore it.

Portability: export all data in standard formats (CSV, JSON).

Object to processing: opt out of marketing emails. (Service emails like billing are mandatory.)

Withdraw consent: stop using the Service anytime.

Exercise any of these by emailing [email protected] or using the in-app controls.

7. Data retention

Active accounts: data is kept as long as the account is active.

Deleted accounts: after you delete your account there is a 30-day grace period in which you can restore it; after that, conversations, customers, products and every other operational record are permanently deleted.

Financial records: orders, payments, subscriptions, shipments and returns are kept after the account is deleted, because we must keep them for tax and dispute purposes.

8. Cookies & tracking

We use only essential cookies: two sign-in cookies (accessToken and refreshToken) that keep you logged in. Your preferences (language, theme) are saved in your browser, not in cookies.

No advertising cookies and no ad tracking on carot.tech. Cloudflare, which delivers carot.tech, may count page views with its cookie-free Web Analytics.

You can clear cookies anytime - you'll just need to log in again.

9. International data transfers

Carot is operated from Egypt by العربيه ايه اتش اس للمقاولات و التجاره ش ذ م م. Our application, database and cache run on Railway servers in Singapore.

Our AI providers (OpenAI, and Anthropic as a backup) process requests in the US under their commercial API terms.

Meta processes channel data per their own privacy policy.

10. Contact & complaints

Email [email protected] for any privacy-related questions or requests. We respond within 5 business days.

Data Protection Officer: [email protected]

Carot is operated by العربيه ايه اتش اس للمقاولات و التجاره ش ذ م م, Egypt.

For unresolved concerns, you can contact the Egyptian Data Protection Center or your local privacy regulator.