Privacy Policy

Last updated: 2026-05-02

This Privacy Policy explains how Carma Labs ("we", "us", "our") collects, uses, and protects personal information when you use our documentation generation service (the "Service"). It applies to our hosted product, our APIs, our command-line tools, and our public website.

We are based in Ontario, Canada. If you have questions about this policy or your data, please email privacy@carmahq.com.

---

1. Summary

• We collect the minimum information needed to operate the Service: account credentials, billing data (handled by Lemon Squeezy), and usage records.
• We process repository content you submit only to generate documentation; we do not train Carma Labs models on it.
• We use a small set of well-known sub-processors (listed in §5).
• You may access, export, correct, or delete your data at any time. After account deletion we keep data for a 90-day freeze period for fraud prevention and recovery, then permanently delete it.

2. Who we are and your rights at a glance

Carma Labs is the data controller for the personal information described in this policy. Depending on where you live, you may have rights under:

• the EU/EEA General Data Protection Regulation (GDPR) and the UK GDPR if you are in the EU, EEA, or UK;
• the California Consumer Privacy Act (CCPA / CPRA) if you are a California resident;
• the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial laws (including Quebec's Law 25) if you are in Canada.

Section 8 explains how to exercise those rights.

3. Information we collect

3.1 Information you provide

• Account information. Email address, password hash (or API-key hash), display name, and any organization metadata you supply.
• Billing information. When you subscribe to a paid plan, Lemon Squeezy processes payment-card details on our behalf. We receive limited information from Lemon Squeezy — typically billing country, plan identifier, transaction ID, and the last four digits of your card — but not the full card number or CVV.
• Communications. If you contact us by email or through a support form we keep a copy of the message and any attachments.

3.2 Information you submit through the Service

• Repository content. When you connect a repository or upload code, the Service transmits selected files, file paths, and metadata to our backend and to a third-party LLM provider for the purpose of generating documentation. We refer to this as "Repository Content" elsewhere in our Terms.
• Prompts and configurations. Any custom prompts, model selections, or generation parameters you set.

3.3 Information collected automatically

• Usage data. We collect server-side logs of API calls, generation requests, error rates, response times, and similar diagnostic data, generally tied to an account or API key.
• Device data. When you visit our website we may receive standard request metadata (IP address, user-agent string, referrer, language preference, timestamps).
• Local-storage tokens. Our frontend stores your API key and theme preference in your browser's local storage. We do not use third-party analytics, advertising, or behavioral-tracking cookies.

4. How we use your information

We use your information to:

• create and manage your account;
• provide, operate, monitor, and improve the Service;
• generate documentation in response to your requests;
• bill you and prevent fraud;
• respond to your support inquiries;
• comply with our legal obligations and enforce our Terms of Service; and
• protect the security and integrity of our systems and our users.

We rely on the following lawful bases under GDPR / UK GDPR (where applicable):

• Contract — to provide the Service you have signed up for;
• Legitimate interests — to operate, secure, and improve the Service;
• Legal obligation — to comply with applicable law; and
• Consent — where we ask for it (for example, before sending product-update emails).

What we do not do

• We do not sell your personal information.
• We do not use Your Content to train Carma Labs machine-learning models.
• We do not profile you for advertising.

5. Sub-processors and third parties

We use a small number of carefully chosen sub-processors. Each processes personal data on our behalf under contractual data-protection obligations.

Sub-processor	Role	Region
Lemon Squeezy	Payments and merchant of record	United States, EU
Vercel	Frontend hosting and edge delivery	Global edge network
Hetzner	Backend application hosting	Germany / Finland
Anthropic	LLM provider (Claude) for generation when selected	United States
OpenAI	LLM provider (GPT family) when selected	United States
Google	LLM provider (Gemini family) when selected	United States, EU
Ollama (self-hosted)	Local inference, when you choose self-hosted models — data does not leave your environment	N/A

We may add or change sub-processors over time. Material changes will be reflected in this policy and, where required, communicated to you.

6. International data transfers

Because our infrastructure and sub-processors operate in multiple countries, your information may be transferred to, stored in, or processed in jurisdictions outside your home country, including the United States and the European Union. Where required by law (for example, transfers out of the EU/EEA or UK), we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or equivalent mechanisms.

7. How long we keep your information

We keep personal information only as long as needed for the purposes described in this policy or as required by law.

• Account data: while your account is active and for 90 days after you delete the account (the "freeze period"), to allow recovery and to investigate fraud or abuse.
• Repository Content and Output: stored only as long as needed to provide the Service. You can delete generated documents at any time from your dashboard; deletions take effect immediately on our primary store and are removed from backups within 30 days.
• Billing records: retained for the period required by tax and accounting law, typically seven years.
• Server logs: retained for up to 90 days, except where retained longer for security investigations.

After the applicable retention period we delete or irreversibly anonymize your information.

8. Your rights

Depending on your jurisdiction you may have the following rights, exercisable free of charge:

• Access — obtain a copy of the personal information we hold about you.
• Correction — ask us to correct inaccurate information.
• Deletion — ask us to delete your information, subject to limited legal exceptions.
• Portability — receive your information in a structured, machine-readable format.
• Restriction or objection — limit or object to certain processing.
• Withdraw consent — where processing is based on consent, withdraw it at any time.
• Lodge a complaint — with your local data-protection authority. EU/EEA users can find their authority at edpb.europa.eu; UK users with the Information Commissioner's Office; Canadian users with the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d'accès à l'information.

To exercise any of these rights, email privacy@carmahq.com. We will respond within the timelines required by applicable law (generally 30 days under GDPR; 45 days under CCPA, extendable once).

California-specific disclosures (CCPA / CPRA)

In the past 12 months we have collected the categories of personal information described in §3. We have not sold or shared personal information for cross-context behavioral advertising in the meaning of the CCPA. Categories we disclose for a business purpose are listed in §5. Californians have the right to non-discrimination for exercising their privacy rights.

Canada-specific disclosures (PIPEDA / Law 25)

We collect, use, and disclose personal information for the purposes described in this policy and only with knowledge or consent except as permitted or required by law. Quebec residents may also request information about how their personal information is being processed and may direct privacy concerns to our privacy contact at privacy@carmahq.com.

9. Security

We use industry-standard technical and organizational measures to protect personal information, including TLS in transit, encryption at rest where supported by our hosting providers, hashed credentials, role-based access control, audit logging, and least-privilege deployment of secrets. No system is perfectly secure; if we become aware of a security incident affecting your information we will notify you and the appropriate authorities as required by law.

10. Children

The Service is not directed to children under 16, and we do not knowingly collect personal information from children. If you believe a child has provided personal information to us, please contact privacy@carmahq.com so we can delete it.

11. Changes to this policy

We may update this policy from time to time. If we make material changes we will provide at least 30 days' notice by email (if you have an account) or by posting a notice on our website. The "Last updated" date at the top of this page reflects the most recent revision.

12. Contact us

For privacy questions, requests, or complaints, email privacy@carmahq.com.

For general inquiries: contact@carmahq.com.

Carma Labs · Ontario, Canada