Privacy Policy

Carter AI LLC (“Carter AI,” “we” or “us”) builds monitoring software for restaurant operators. This policy explains what information we collect, why, who we share it with, and how long we keep it. It is short because what we do is narrow.

01Who this covers

Carter AI is a business-to-business service. There are no consumer accounts. This policy covers three groups of people:

• Visitors to carterai.io and people who write to us.
• Users who sign in to the Service on behalf of a restaurant customer.
• People whose information appears in our customers’ systems, such as guests on a receipt or staff on a schedule. For this information the restaurant customer decides how it is used and we act on its behalf, as described in the data-processing section of our Terms of Service. If you have a question about that information, start with the restaurant.

02What we collect

When you visit carterai.io

Our pages are served by our hosting provider, which keeps ordinary server logs (such as IP address, browser type and the page requested). The pages load typefaces from Google Fonts, so your browser requests them from Google, which receives your IP address and browser details. We do not run advertising trackers or third-party analytics on the marketing pages.

When you contact us

If you use the order form on our home page or contact page, we receive the system you named, the text you wrote and your email address. To limit spam we also store a one-way hash of your IP address, and your browser’s user-agent string as sent. To see which channels bring us inquiries, we also store where the submission came from. If the page address you arrived on carries a campaign tag (?src=, or utm_source, utm_medium or utm_campaign), we store that tag, lowercased and cut to 40 characters. If it carries none, we store only the hostname of the site that referred you, never the full address, and nothing when the referrer is our own site. We record this only when you submit the form. It uses no cookies and no browser storage, and it is not recorded for visitors who don't submit. We receive the submission by email at our sales inbox and also keep it as a record in our database. Contact and order-form submissions are deleted after 24 months. If you email support@carterai.io or sales@carterai.io, we receive what you send; those inboxes run on Google Workspace.

When a user signs in

For each user we and Clerk hold name, email address, the role and location access their organization assigns, and sign-in events. Authentication is handled by Clerk. Passwords are handled by Clerk and are not visible to us. Where a customer turns on single sign-on, the customer’s identity provider shares the user’s name and email with us.

From a customer’s connected systems

With the customer’s authorization we read, in read-only mode, records from its systems, such as its Toast point-of-sale account: orders and checks, menus and item availability, schedules and labor data, and location settings.

• Payment details. We do not access full card numbers, card security codes or magnetic-stripe data by design. When a customer’s staff use receipt lookup, the check they open can show the card brand, the last four digits and, where the POS provides it, the cardholder name. That information is displayed to the authorized user and is not stored in our database. A receipt that is emailed passes through our email provider, Resend. We are not a payment processor and we hold no PCI DSS certification.
• Receipts and guest email addresses. To email a receipt, a customer’s staff type the guest’s email address. We use it to send that receipt and keep it only in an audit entry (below) and in our email provider’s delivery records. We do not use it for marketing and do not build a mailing list from it.
• Audit entries. For each lookup or send we store who searched, when, which location and date range, how many results came back, and, for a send, the destination email address and the check identifier and number. We do not store the receipt itself.

From the on-site agent

Where a customer installs our on-site agent in a kitchen, it reads two kitchen display system files without modifying them, and sends outbound over an encrypted connection. We receive store and agent identifiers, health reports, and ticket timing with check number, table, item names, the name of the server on the ticket, and the box’s hostname. Those files are kitchen ticket files; they do not carry card numbers. The agent does not accept inbound connections.

03How we use it

• to provide the Service: showing customers what their systems are doing, sending the alerts and emails they set up, and verifying figures;
• to authenticate users and enforce who can see which locations;
• to keep the Service secure, prevent abuse and fix problems;
• to respond to inquiries and provide support;
• to operate our business, keep records, and comply with the law.

We do not sell personal information. We do not use it for advertising.

04Who we share it with

We share information with the service providers below (our subprocessors), only as needed to run the Service. We also share information when a customer tells us to, such as sending alerts to its own Microsoft Teams channel or email recipients, when the law or a valid legal process requires it, to protect rights, safety or security, and as part of a merger, acquisition or sale of our business (with notice to customers).

Subprocessor	Purpose
Vercel	Application hosting and content delivery
Neon	Managed database (primary data store)
Clerk	Authentication and user account management
Resend	Email delivery (receipts, alerts and notification emails)
DigitalOcean	Cloud infrastructure for background monitoring workers and internal operations
Google Workspace	Business email and collaboration; nightly database backup copies are mirrored to Google Drive, kept 14 days
GitHub	Incident tracking for our monitoring workers (issue titles can include a store name)
Anthropic (Claude)	AI engineering and support tooling; may process customer data during diagnostics and support work
Wave	Accounting and invoicing (customer billing contact details once invoicing begins)

Carter AI operates from the United States, and Customer Data is stored in the United States.

05How long we keep it

• Receipt lookup audit entries and alert delivery logs: deleted once they are more than 90 days old (cleanup runs on a rolling basis, so a record can linger a few days).
• On-site agent telemetry: deleted once it is more than 90 days old; routine health reports after 14 days.
• Account and monitoring data for a customer: for as long as the customer is with us. After termination we delete it from our production systems within 60 days, except billing and tax records that the law requires us to keep and security audit logs, which we keep for 12 months (see the Terms of Service).
• Contact-form and order-form submissions: deleted after 24 months.
• Support and sales email: until you ask us to delete it or it is no longer useful to us.

06Security

We use reasonable administrative, technical and organizational safeguards: role-based and per-location access controls, separation of customers’ data by account (which we test automatically), encrypted connections, and encrypted storage of the system credentials customers give us (for example Toast API keys). We do not hold a SOC 2 report or similar certification, and no system is perfectly secure. If you believe you have found a security problem, email support@carterai.io.

07Your questions and requests

If you want to ask what we hold about you, correct it, or have it deleted, write to support@carterai.io. We will reply to data requests there within 30 days. If your information appears in a restaurant customer’s systems, we may need to pass your request to that customer, because it decides how the information is used.

08Cookies, children and changes

Cookies. Signing in sets cookies needed to keep you signed in. We do not use advertising or cross-site tracking cookies.

Children. The Service is for businesses and is not directed to children. We do not knowingly collect information from children.

Changes. If we change this policy we will post the new version here with a new date. For a material change affecting customers we will also email the account owner.

09Contact

Carter AI LLC
Email: support@carterai.io
Mail: 1418 Rowe Drive, Glen Burnie, MD 21061

See also our Terms of Service.