Privacy notice

Cartha AI, Inc. operates Cartha Hub and is responsible for staff-account and service-operation data. When an organization uses Hub for member-approved support coordination, Cartha AI, Inc. processes the organization's records under the applicable organization agreement and instructions.

Cartha Hub is an authorized organization response desk. It routes information a member intentionally sent, records who owns the response, and shows acknowledgement and handled state. It is not therapy, diagnosis, clinical monitoring, crisis response, or an emergency service.

• Staff account data: name, work email, user ID, organization, role, session, and security records.
• Member-approved support data: display name, disclosed check-in, up to two member-chosen concern tags, an explicit request for contact, and an optional short approved note or excerpt.
• Consent and workflow data: purpose, recipient, consent-copy version, expiry or revocation, owner and fallback, delivery, acknowledgement, handling evidence, and audit events.
• Service data: IP address, request time, device/app version when supplied, error and security logs, and deletion/support correspondence.

We use Hub data only to authenticate authorized staff, deliver and route an approved support request, maintain the visible response state, prevent abuse, provide support, honor consent and deletion choices, and meet documented legal or contractual obligations. We do not use Hub data for advertising, cross-app tracking, data brokerage, or model training.

Hub uses Amazon Web Services for hosting, encrypted storage, logs, scheduling, and transactional email; self-hosted SuperTokens software on Cartha's AWS account for authentication; and Apple for App Store distribution. These providers receive only the information needed for their service and are bound by their terms and Cartha's security controls.

We may disclose data when required by valid legal process, to protect the service or people from unlawful activity, or during a corporate transaction with required notice and continued protection. We do not sell or share personal information for behavioral advertising.

Staff can initiate full account deletion in the app or on the public deletion page. We verify the request, remove account access and data that Cartha is not required to retain, and confirm completion by email. Most requests are completed within 30 days.

Operational handoff and audit records are retained while the participating organization's account is active and for up to 90 days after termination, unless the organization requests earlier deletion or a documented legal or contractual duty requires a longer period. Security and access logs are retained for up to 180 days. A narrowly retained record is not used for advertising or unrelated product development.

Member revocation stops future organization access under that consent. Alumni access requires a separate purpose-specific grant and can expire or be revoked.

Hub uses TLS in transit, encrypted AWS storage, tenant-scoped authorization, least-privilege service roles, protected secrets, audit logging, and production backup controls. Data is processed in the United States. No security method is perfect; report suspected unauthorized access immediately.

Depending on where you live, you may request access, correction, deletion, or a copy of your data and may appeal a denied request. Cartha honors verified privacy requests nationwide. Email privacy@cartha.ai from your account address or use the deletion page.

Cartha AI, Inc.
1820 S Bentley Ave
Los Angeles, CA 90025
United States

Privacy: privacy@cartha.ai
Support: support@cartha.ai
Phone: +1 661-235-5912