Privacy Policy

Account and business information. We act as a “controller” or “business” for personal information we collect to create and manage accounts, process payments, operate and improve the Service, communicate with you, and meet legal obligations.

Customer Content. “Customer Content” means the code, repositories, files, prompts, instructions, agent outputs, session history, logs, and other materials that you or your collaborators submit to, connect to, or generate through the Service. We process personal information within Customer Content on your behalf to provide the Service. Where you use the Service for an organization, that organization controls Customer Content. Our processing of it is governed by the Terms and, where applicable, our Data Processing Addendum (the “DPA”). Questions about personal information in Customer Content should go first to the account owner who controls it.

• Account information: name, email address, username, password or single sign-on identifiers, organization name, and role.
• Billing information: billing name, billing address, and payment card details. Our payment processor, Stripe, collects and stores full card numbers directly. We receive limited details, such as card type, last four digits, and expiration date.
• Customer Content: as defined in Section 1, Customer Content may include personal information. Examples include names and emails in commit histories, code comments, configuration files, or data sets you give the agent access to.
• Credentials and integration information: access tokens, API keys, and similar credentials you provide so the Service can reach third-party systems on your behalf. This includes source code hosts such as GitHub and any model provider API key you supply (“Your API Key”).
• Collaborator information: names and email addresses of people you invite to an account or session.
• Communications: information you provide when you contact support, answer surveys, or otherwise communicate with us.

• Usage and metering data: tokens consumed (input and output), models and harnesses selected, agent run time, session start and stop times, credit purchases, and prepaid credit balances. We use this data to calculate fees and maintain your account balance.
• Session and activity data: actions taken in a session, which user took them, agent tool calls and commands, errors, and performance data.
• Device and log data: IP address, browser type, operating system, device identifiers, referring URLs, pages viewed, and timestamps.
• Cookies and similar technologies: see Section 9.

• Integrations you connect: information from services you authorize, such as repository contents, account identifiers, and metadata from a source code host.
• Payment processor: payment confirmation, fraud screening results, and transaction status.
• Single sign-on providers: profile information you authorize the provider to share.

We use personal information to:

1. Provide, operate, and maintain the Service, including running agent sessions on our servers while you are offline.
2. Enable collaboration among users you authorize in a session or account.
3. Route prompts and Customer Content to the model and harness you select (see Section 4).
4. Meter usage, calculate inference passthrough, per-token, and agent-time fees, process prepayments, and maintain credit balances.
5. Authenticate users and protect the security and integrity of the Service, including detecting fraud, abuse, and violations of the Terms.
6. Provide support and respond to requests.
7. Send transactional messages, such as receipts, low-balance alerts, security notices, and changes to pricing or terms.
8. Send product updates and marketing communications, subject to your preferences (see Section 10).
9. Analyze aggregated or de-identified usage to understand and improve the Service.
10. Comply with law, enforce our agreements, and establish or defend legal claims.

No model training on Customer Content. We do not use Customer Content to train or fine-tune artificial intelligence models.

Separation from other Carta products. We do not combine personal information collected through the Service with information from Carta’s equity management, fund administration, or other products.

The Service lets you select among AI models and agent harnesses. Running an agent session requires sending prompts, instructions, and relevant Customer Content to the provider of the selected model.

• Default model access. By default, the Service uses Carta’s account with Anthropic, PBC. We send the content needed for each request to Anthropic under our commercial agreement with Anthropic.
• Other models. If you select a model from another provider using Carta’s access, we send the needed content to that provider under our agreement with it. Current providers appear in our Subprocessor List at evergreen.carta.com/subprocessors.
• Your API Key. If you use Your API Key, we send the needed content to that provider under your account. Your agreement with that provider governs its handling of that content, not this Privacy Policy. We store Your API Key in encrypted form and use it only to make requests you initiate.

We disclose personal information only as follows:

• Service providers and subprocessors: cloud hosting, compute, payment processing, email delivery, analytics, customer support, and security vendors that process information on our behalf under written obligations. See our Subprocessor List at evergreen.carta.com/subprocessors.
• Model providers: as described in Section 4.
• Collaborators and account owners: users in a shared session can see that session’s Customer Content, activity, and the names of participants. Account owners and administrators can see account-level usage, billing, and collaborator information.
• Integrations you direct: third-party services you connect, when the agent reads from or writes to them at your instruction. For example, the agent may push commits or open pull requests on your source code host.
• Carta affiliates: our corporate affiliates, for purposes consistent with this Privacy Policy, such as shared infrastructure, security, finance, and legal functions.
• Legal and safety: government authorities, courts, or other parties when we believe in good faith that disclosure is required by law or legal process, or needed to protect rights, property, or safety.
• Corporate transactions: a buyer, successor, or other party in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets.
• With your consent: any other disclosure you direct or authorize.

No sale or targeted advertising. We do not sell personal information. We do not share it for cross-context behavioral advertising, as those terms are defined under U.S. state privacy laws.

We retain personal information for as long as needed for the purposes in this Privacy Policy, unless law requires or permits a longer period. In general:

• Account information: for the life of the account and 24 months after closure.
• Customer Content and session history: for the life of the account or until deleted by you. After account closure we delete it within 30 days, except for backups, which expire on a rolling 60-day cycle.
• Credentials and Your API Key: until you revoke or delete them, or the account closes.
• Billing, usage, and transaction records: for 7 years to meet tax, accounting, and revenue recognition requirements.
• Log and security data: for up to 6 months.

We may keep de-identified or aggregated information that cannot reasonably identify you.

We use administrative, technical, and physical safeguards designed to protect personal information. These include encryption in transit and at rest, encrypted storage of credentials, isolated execution environments for agent sessions, and role-based access controls.

No system is completely secure. Agents run autonomously and may execute commands and access systems you connect. You are responsible for the permissions and credentials you grant, for the secrets you place in repositories or sessions, and for limiting session access to people you trust.

We are based in the United States and process information in the United States and other countries where our service providers operate. If you access the Service from outside the United States, your information will be transferred to and processed in the United States. Where required, we rely on appropriate safeguards for these transfers, such as the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum.

We use cookies and similar technologies to keep you signed in, remember preferences, secure the Service, and understand how the Service is used. Most browsers let you block or delete cookies. Blocking essential cookies may prevent the Service from working. Certain web browsers and devices transmit “Do Not Track” (DNT) signals to websites with which the browser communicates. Because no industry standard has been adopted regarding how DNT signals should be interpreted, the Services do not currently respond to DNT signals. The Services do, however, recognize and honor the Global Privacy Control (GPC) signal where required by applicable law. We honor Global Privacy Control signals as a request to opt out where applicable law requires.

• Account information: you can update your profile in account settings.
• Customer Content: you can delete sessions, repository connections, and files in the Service. You can revoke integrations and delete Your API Key at any time.
• Marketing emails: you can opt out using the unsubscribe link in any marketing email. We will still send transactional and account messages.
• Account closure: you can close your account in your account settings or by contacting evergreen-support@carta.com. Unused prepaid credits are handled as described in the Terms.

Depending on where you live, including California, Colorado, Connecticut, Virginia, and other states with comprehensive privacy laws, you may have the right to:

• know or access the personal information we hold about you;
• correct inaccurate personal information;
• delete personal information;
• receive a portable copy of personal information; and
• opt out of sale, sharing for targeted advertising, or profiling with legal or similarly significant effects. We do not engage in these activities.

We will not discriminate against you for exercising these rights.

California notice at collection. In the past 12 months we have collected these categories of personal information under the California Consumer Privacy Act: identifiers; customer records; commercial information; internet or other electronic network activity information; geolocation inferred from IP address; and professional information. We may also collect any category that you include in Customer Content. We collect and use these categories for the purposes in Section 3 and disclose them as described in Section 5. We retain them as described in Section 6. Account passwords and credentials are sensitive personal information. We use them only to provide the Service and do not use them to infer characteristics about you.

If the GDPR or UK GDPR applies, you may have the right to access, correct, delete, restrict, or object to processing, and to data portability. Where we rely on consent, you may withdraw it at any time. You may complain to your local data protection authority.

Our legal bases are: performance of a contract (providing the Service and processing payments); legitimate interests (security, fraud prevention, service improvement, and direct marketing to business users, balanced against your rights); legal obligation (tax and accounting records); and consent (where required, such as for non-essential cookies).

Submit a request to evergreen-privacy@carta.com or through preferences.carta.com. We will verify your identity before acting. You may use an authorized agent where the law allows, and we may require proof of the agent’s authority. If we deny your request, you may appeal by replying to our decision with “Appeal” in the subject line.

For personal information in Customer Content that an organization controls, we will refer your request to that organization and support its response as required by the DPA.

The Service is not directed to children. We do not knowingly collect personal information from anyone under 18. If we learn we have collected it, we will delete it. Contact us at evergreen-privacy@carta.com if you believe a child has given us personal information.

We may amend, modify, supplement, or otherwise update this Privacy Policy from time to time in our sole discretion to reflect changes in our business operations, the Services, applicable law, regulatory guidance, industry practice, or for any other reason. Any such changes will become effective upon posting of the revised Privacy Policy to evergreen.carta.com/privacy or such other location at which this Privacy Policy is then made available, unless a later effective date is specified in the revised version. We will post the updated version with a new “Last Updated” date.

• Email: evergreen-privacy@carta.com
• Postal Address: Data Protection Officer, eShares, Inc. dba Carta, Inc., 333 Bush Street, Floor 23, Suite 2300, San Francisco, CA 94104, United States

EU Representative. In accordance with Article 27 of the EU General Data Protection Regulation (Regulation (EU) 2016/679), we have appointed DataRep as our representative in the European Union for data protection matters. Individuals located in the European Economic Area may contact DataRep with respect to the processing of their personal information by submitting a request through the online form available at datarep.com/data-request, or by writing to DataRep at any of its offices listed at datarep.com.