Privacy Policy

Each Customer controls the business records it keeps in Carat: its inventory, its own customers and vendors, invoices, memos, payments and related files. We process those records on the Customer’s behalf and only to provide the service. If you are a Customer’s client and have a question about your information, please contact that business first; we will help them respond.

We are responsible for the account information of the people who sign in to Carat and for information about how the service is used.

• Account information: name, email address, role and organization of each user, and a hashed password (we never see or store passwords in readable form).
• Business records the Customer enters or uploads: inventory and stone details, photos and certificates, customer and vendor contact details, documents, payments, notes and attachments.
• Billing information: subscription plan and status. Card details are collected and held by our payment processor, Stripe; we do not store card numbers.
• Connected-service data: when a Customer connects another service (for example QuickBooks Online or a lab report service), the access tokens or keys for that connection and the identifiers the other service returns.
• Usage and technical data: log entries, IP address, browser type, and error reports. When an error occurs we may capture a recording of the page interaction that led to it, with form inputs masked, to diagnose the problem.

• To provide, secure and support Carat, including sending the emails and text messages a Customer asks it to send (invoices, statements, reminders).
• To run features the Customer turns on, such as AI extraction of details from certificates and photos, and syncing records to a connected service.
• To bill for the subscription and communicate about the account.
• To find and fix errors, prevent abuse, and improve the service.
• To comply with the law.

We do not sell personal information, we do not use Customer business records for advertising, and we do not use them to train AI models.

A Customer’s administrator may connect the Customer’s own QuickBooks Online company to Carat. The connection uses Intuit’s sign-in and asks only for accounting access. With it, Carat sends the Customer’s customers, invoices, payments and credit notes to that QuickBooks company, and reads back only what it needs to do so: the IDs QuickBooks assigns, the company name, and the list of products and services to book sales under.

• The access and refresh tokens are encrypted (AES-256-GCM) before storage and are readable only by our servers, never by a signed-in user’s browser.
• Data from QuickBooks is used only to keep the Customer’s own records in sync. It is not shared with other Customers or third parties, and not used for any other purpose.
• The administrator can disconnect at any time in Carat Settings or from within QuickBooks. On disconnect we revoke the tokens with Intuit and delete them. Records already in QuickBooks are not changed.

Keys a Customer supplies for other services (such as a lab report API key) are encrypted the same way.

We share information only with providers that help us run Carat, under contracts that limit their use of it:

• Supabase — database, sign-in and file storage
• Vercel — application hosting
• Resend — email delivery
• Twilio — text message delivery
• Stripe — subscription billing
• OpenAI — AI extraction and text features (API data is not used to train their models)
• Sentry — error monitoring
• Intuit, and lab report services, when a Customer connects them

We may also disclose information if the law requires it, to protect the rights and safety of our users or others, or as part of a merger or sale of our business, in which case this policy continues to apply.

Data is encrypted in transit (HTTPS) and at rest. Each Customer’s records are isolated from every other Customer’s at the database level, and access within a Customer is limited by user role. Third-party credentials are additionally encrypted by the application. No system is perfectly secure; if we learn of a breach affecting your information, we will notify the affected Customers as the law requires.

We keep a Customer’s records while its account is active. After an account is closed, the Customer may ask for an export within 30 days; we then delete its records within 90 days, except where the law requires us to keep them longer. Backups age out on their normal schedule.

You can view and update your account details in Carat. Depending on where you live, you may have the right to access, correct, delete or receive a copy of your personal information, or to object to certain uses. Write to support@carat.software and we will respond within the time the law allows. We will not discriminate against you for exercising these rights.

Carat is a business tool and is not directed to children under 16. We do not knowingly collect their information.

We will post any change on this page with a new effective date, and notify Customers by email or in the app before a material change takes effect.

Questions about this policy or your information: support@carat.software. See also our Terms of Service.