1. Who we are and our two roles
Carpuse (“Carpuse”, “we”) runs carpuse.com and the Carpuse application. We act in two roles:
- Controller for personal data about our own users, website visitors and prospects: for example your name, email and how you use Carpuse. This policy covers that data.
- Processor for the data our customers upload about their own customers and contacts (“Customer Data”). Our customer is the controller of that data and we process it only on their instructions, under our Data Processing Agreement. If your details are in a Carpuse customer's workspace, please contact that company first.
Privacy contact: hi@carpuse.com.
2. What we collect and why
| Data | Purpose | Legal basis (GDPR Art. 6) |
|---|---|---|
| Account data: name, work email, password (stored hashed), profile photo, language and time zone | Create and secure your account, run the Service | Contract (6(1)(b)) |
| Workspace and usage data: workspace name, team members, roles, actions in the app, assistant usage counts | Provide the Service, enforce plan limits, support, fix problems | Contract (6(1)(b)); legitimate interest in a secure, working product (6(1)(f)) |
| Consent records: what you agreed to, when, and which version | Prove consent and acceptance of our terms | Legal obligation (6(1)(c)); legitimate interest (6(1)(f)) |
| Billing data: billing contact, company, address, VAT ID, payment status (card details are held by Paddle, not us) | Take payment, issue invoices, meet tax rules | Contract (6(1)(b)); legal obligation (6(1)(c)) |
| Support emails and messages | Answer you and improve the Service | Contract (6(1)(b)); legitimate interest (6(1)(f)) |
| Product and marketing emails | Send product news and offers, only if you opted in | Consent (6(1)(a)); you can unsubscribe in one click |
| Website data: pages visited, referrer, campaign tags, device type | Understand which pages help visitors, measure campaigns | Consent (6(1)(a)), only after you accept analytics |
| Technical logs: IP address, browser, timestamps | Security, abuse prevention, troubleshooting | Legitimate interest (6(1)(f)) |
3. AI and your data
The Revenue Assistant uses an AI model from Anthropic to answer questions and summarize accounts. When a user asks the assistant something, we send Anthropic the question and only the records needed to answer it, limited to what that user is allowed to see.
- We do not use your data or Customer Data to train AI models.
- Anthropic does not use data sent through its commercial API to train its models.
- Recommendation cards on the Today screen are calculated by rules inside Carpuse and do not send data to an AI provider.
- The assistant never changes records or sends messages without a person's approval.
5. Where data is stored and international transfers
Our database is hosted in the European Union (Frankfurt, Germany). Some providers, such as Anthropic, are based in the United States. Where personal data leaves the EEA, we rely on the European Commission's adequacy decisions (including the EU–US Data Privacy Framework where the provider is certified) or on Standard Contractual Clauses, with additional safeguards where needed.
6. How long we keep data
- Account and workspace data: while your account is active. After you close your account, you have 30 days to request an export; we then delete it within a further 30 days, and from backups as they rotate.
- Locked workspaces that were never paid for: we may delete them after 12 months of inactivity, and will email the owner at least 30 days before.
- Billing records: as long as tax law requires (usually up to 10 years), kept by Paddle and us.
- Consent records: for as long as the consent applies, plus the period in which claims can be made.
- Technical logs: up to 90 days.
7. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you and get a copy;
- have inaccurate data corrected;
- have your data deleted;
- restrict or object to processing based on legitimate interest;
- receive your data in a portable format;
- withdraw consent at any time, without affecting earlier processing;
- complain to your local data protection authority.
To use these rights, email hi@carpuse.com. We reply within one month.
8. Security
We protect data with encryption in transit and at rest, workspace isolation enforced in the database, and role-based access. Read more on our Security page.
10. Changes to this policy
If we make material changes, we will tell account holders by email or in the app before they take effect.
Questions about this page? Write to us through the contact page.