← Plain-English Privacy summary
This is the legally-binding Privacy Policy. If you'd rather read the friendlier summary first, head to /privacy.

Carae Privacy Policy

Effective: 17 May 2026 Version: privacy-v1 Data Controller: Learn By Numbers Limited, Unit 26J, Building 6500, Cork Airport Business Park, Cork, T12 E6RY, Ireland DPO contact: [email protected]

TL;DR (this section is informational; the legally binding text is below)

1. Who we are

Carae is operated by Learn By Numbers Limited, a private limited company registered in Ireland. We are the Data Controller for the personal data described in this Policy. Our DPO can be reached at [email protected].

We are EU-headquartered, EU-hosted, and EU-owned. We do not transfer your personal data outside the European Economic Area except where strictly necessary to operate the Service (see Section 6 on LLM providers).

2. What personal data we collect

2.1 Data you provide

We collect the data below to make Carae work, but no one at Carae can read your messages or memories. Our staff have no access to the database, and our internal admin tools only ever show counts and account status, never the content of your conversations.

2.2 Data we collect automatically

2.3 Data we do NOT collect

3. Why we use your data (legal bases under GDPR Article 6)

Purpose Legal basis Examples
Operating the Service Contract performance (Art. 6(1)(b)) Receiving messages, generating replies, running scheduled jobs, executing Skill actions
Long-term assistant memory Contract performance + your consent during onboarding Storing facts you've told us so the assistant remembers across sessions
Billing Contract performance Charging your subscription, handling refunds
Fraud prevention and abuse detection Legitimate interest (Art. 6(1)(f)) Audit logs, rate-limit enforcement, integrity checks
Customer support Contract performance + legitimate interest Investigating fault reports you submit
Legal compliance Legal obligation (Art. 6(1)(c)) Responding to lawful requests, tax records

We do not use your messages or memories for marketing, ad targeting, or to train any model.

4. How we secure your data

4.1 Database isolation

Your data lives in a Postgres database in Frankfurt with row-level security enforced at the database engine level. Application code can only read or write rows belonging to the authenticated user; cross-user reads are technically blocked, not just policy.

4.2 Encryption at rest

Tokens for connected services (Notion, Microsoft, etc.) are encrypted using a per-user data-encryption key (DEK) wrapped by a key-encryption key (KEK). The KEK is held in a separate secure store. Tokens are never logged, displayed, or transmitted in plaintext after the initial OAuth flow.

The content of your messages is encrypted the same way. Each message is encrypted with a per-user DEK wrapped by the KEK, and the plaintext of your message content is not stored in our database. As a result, no one with direct access to the production database or to backups can read your stored message content. This is not end-to-end encryption: to generate a reply, our services decrypt your messages in memory and send them to our LLM providers for processing (Section 6), which receive your message content in plaintext under Data Processing Agreements. Your long-term memories are isolated per user and, like your message content, are encrypted at rest with the same per-user DEK wrapped by the KEK, so no one with direct database or backup access can read your stored memory content either.

4.3 Operator access

To deliver the Service we sometimes need to investigate problems. This means:

4.4 Backups

We take daily automated backups of our server, retained on a rolling seven-day basis in Hetzner's Frankfurt region. Backup access is restricted. Because your message and memory content are encrypted at rest (Section 4.2), these backups contain only the encrypted form of that content, not plaintext.

5. How long we keep your data

Category Retention
Messages While your account is active. Messages older than 90 days are deleted once their key details have been saved to your long-term memories, except for your most recent conversation, which is always kept so Carae can follow the thread.
Long-term memories While your account is active. Deleted within 24 hours of deletion.
Integration tokens Until you disconnect the integration or delete your account.
Service logs (technical) 30 days
Audit logs (security) 3 years
Billing records 7 years (Irish tax-law minimum)
Backups 7 days
deletions_log (no PII) Indefinite, for fraud prevention

After account deletion: messages, memories, integration tokens, scheduled jobs, and Skill configurations are removed within 24 hours. Audit logs and billing records are retained for the legal periods above; backups age out within 7 days.

6. Who we share your data with

We share the minimum necessary personal data with:

6.1 Large language model providers (sub-processors)

When you send the Service a message, we send the message content and recent conversation context to one of our LLM providers for processing. Providers used:

Each provider's standard Data Processing Agreement applies to our use of their API. These DPAs are incorporated by reference in the providers' commercial terms (which we accept by being a paying customer of their API) and bind them to act as data processors under GDPR Article 28. They commit not to use API content for training of public models. We have no influence over their security beyond what those contracts grant.

Links to the applicable DPAs:

6.2 Infrastructure providers (sub-processors)

6.3 Lawful requests

We will respond to lawful requests from Irish or EU authorities. We will challenge requests we believe are overbroad or unlawful, and will inform affected users where the law permits. We have not received any government data requests as of the date below.

We do not voluntarily share data with any third party other than the sub-processors above.

6.4 Google user data: Limited Use

If you connect a Google integration (Gmail, Google Calendar, or YouTube), our handling of Google user data is additionally governed by the Google API Services User Data Policy, including its Limited Use requirements:

Carae's use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Carae stores Gmail message content solely to provide user-facing assistant features (inbox triage, summaries, draft assistance, user-confirmed email sending, and your personal assistant memory) that are prominent in the app's interface. Every email send is confirmed by you: Carae shows a preview of the exact recipient, subject, and body with Send and Cancel buttons, and the email is sent only when you tap Send; nothing is ever sent silently or automatically. Carae does not transfer this data to third parties except as necessary to provide these features, does not use it for advertising, does not allow humans to read it except with your explicit consent or for security or legal reasons, and does not retain or use Google user data to develop, improve, or train non-personalized (generalized) AI or machine-learning models.

In plain terms, per integration: Google Calendar: we read your schedule (events, times, attendees) to answer your questions and power briefs and reminders, and, when you ask, we create or update events. Gmail: we read messages for triage, summaries, and reply context; we create drafts on your behalf; we send email only after you tap Send on a preview showing the exact recipient, subject, and body, never silently or automatically. YouTube: we read your subscriptions and run the searches you request; we never modify anything on your YouTube account.

7. International transfers

Service infrastructure is hosted in the EU (Frankfurt, Dublin). However, when your messages are processed by an LLM provider headquartered in the US, the request transits to the provider's API endpoint, which may be served from US infrastructure depending on the provider's region selection.

We rely on:

We are tracking the EU AI Act and will move to EU-resident inference where commercially feasible (Mistral, Aleph Alpha, etc.).

8. Your rights under GDPR

You have the right to:

We aim to respond to all rights requests within 30 days.

9. Children

The Service is not directed at, and we do not knowingly accept users under, the age of 18. If we become aware of an account belonging to a minor, we will delete it.

10. Changes

We may update this Policy. Material changes will be notified to active users 30 days before they take effect. The version in force at any time is identified by privacy-vN and visible at carae.ai/privacy.

11. Contact

End of Privacy Policy.