Effective September 7, 2026
Who is responsible. Carcin is a service of Ad-Apt Holdings LLC, an Oregon limited liability company (“Ad-Apt,” “Carcin,” “we,” “us,” or “our”). This Policy explains how we process personal data through carcin.app, carcin.ai, Carcin workspaces, agents, integrations, websites, and related services (the “Service”).
Our commitment. We do not sell personal data. We do not use ordinary Customer Data to train Carcin or general-purpose AI models, and we do not share one customer’s Customer Data with another customer. Content deliberately submitted through a thumbs-up, thumbs-down, feedback-message, error-report, or similar feedback control (“Explicit Feedback”) may be used to evaluate, tune, or train Carcin. We also use hashed, aggregated, or deidentified experience signals to detect failures, errors, and negative responses.
This Policy applies when Ad-Apt determines why and how personal data is processed, including account, billing, support, marketing-site, and product-usage data. It does not govern third-party products or websites that have their own notices.
When a business customer uses Carcin to process personal data in its workspace, connected accounts, files, communications, websites, or workflows, that customer generally determines the purposes and means of processing. The customer is the controller or business; Ad-Apt acts as its processor or service provider under its instructions. Requests about data controlled by a Carcin customer should first go to that customer. We will assist customers with those requests as required by law and contract.
If you connect a third-party account, we receive information and permissions needed for the connection. Depending on what you authorize, this may include account identifiers, profile details, tokens, files, messages, contacts, analytics, advertising data, code, site configuration, and activity records. Scope depends on the provider and permissions you select. You may disconnect an integration, although previously imported data may remain until deleted under our retention practices.
Please do not provide government identifiers, full payment-card data, health records, biometric identifiers, precise geolocation, regulated records, or other highly sensitive data unless an applicable feature and written agreement expressly support it. If we discover unsupported sensitive or regulated data, we may restrict access and notify the customer to remove, redact, or deidentify it within seven days. If it is not remediated, we may delete it; we may act sooner when reasonably necessary for security, safety, or legal compliance.
Where GDPR or similar law applies, our legal bases include performing a contract, legitimate interests in operating and securing the Service, complying with legal obligations, and consent when required. You may withdraw consent at any time without affecting prior lawful processing.
Carcin sends prompts, relevant Customer Data, instructions, and tool results to AI providers when needed to perform requested work. Authorized personnel may review limited content for support, safety, quality, or incident response. We require service providers to process data for contracted services and apply their API or enterprise data protections.
Ad-Apt does not use ordinary Customer Data to train Carcin or general-purpose AI models, does not authorize providers to train general-purpose models on it, and does not use one customer’s Customer Data to benefit another customer. We may use Explicit Feedback—including content intentionally included with that feedback—to evaluate, tune, or train Carcin. We may also use hashed, aggregated, or deidentified experience signals to identify failures, errors, and negative responses and improve reliability. We will not attempt to reidentify deidentified data except to test safeguards or as permitted by law.
We do not sell personal data for money. We do not share personal data for cross-context behavioral advertising. We do not knowingly sell or share personal data of anyone under 18.
We use:
You can use our consent controls and browser settings to manage optional cookies. Blocking necessary cookies may prevent account features from working. Because we do not sell or share personal data for targeted advertising, Global Privacy Control signals do not change a sale or sharing practice, but we treat them as an opt-out where applicable law requires.
Our standard schedule below may be shortened or extended when reasonably necessary for security, fraud prevention, a legal hold, dispute, contract, or applicable law:
You may request deletion at any time. We will delete or deidentify data unless retention is permitted or required by law, needed to complete a transaction, protect security, or establish or defend legal claims.
We use administrative, technical, and physical safeguards designed for the nature of the data and risk, including encrypted transport, access controls, secret management, logging, backups, and provider security controls. No system is completely secure. You are responsible for strong credentials, appropriate permissions, endpoint security, and promptly reporting suspected compromise. We notify affected parties and regulators of qualifying incidents as required by applicable law.
Depending on where you live and applicable exemptions, you may request access, confirmation of processing, correction, deletion, portability, restriction, or a list of third parties receiving personal data. You may object to or opt out of targeted advertising, sale, certain profiling, or other processing; withdraw consent; and appeal a denied request. You will not be discriminated against for exercising a privacy right.
Submit a request through our privacy request form, or email carcin@carcin.ai with subject “Privacy Request.” Each submitted form request receives a reference number, owner, response target, Carcin follow-up task, and event history. We will respond within the period required by applicable law and explain any denial and appeal process.
Oregon residents. Applicable rights may include confirmation, access, correction, deletion, portability, a list of specific third parties, and opt-outs from sale, targeted advertising, and profiling that produces legal or similarly significant effects. To appeal a denial, reply with subject “Privacy Appeal.”
California residents. Applicable rights may include knowing, accessing, correcting, deleting, and obtaining information about disclosures, plus opting out of sale or sharing and limiting certain uses of sensitive personal information. We do not sell or share personal information as those terms are used for cross-context behavioral advertising.
EEA, UK, and Switzerland. Applicable rights may include access, correction, erasure, restriction, portability, objection, and withdrawal of consent. You may complain to your local supervisory authority.
Ad-Apt is based in the United States. We and our providers may process data in the United States and other countries whose laws differ from yours. Where required, we use recognized transfer safeguards, such as standard contractual clauses, adequacy decisions, or another lawful mechanism.
The Service is for businesses and is not directed to children. We do not knowingly collect personal data directly from anyone under 18. If you believe a child provided data to us, contact us so we can investigate and delete it as appropriate.
We may update this Policy as the Service and law change. We will post the revised version and update the effective date. If a change materially reduces protections or changes how existing Customer Data is used, we will provide additional notice when required.
Ad-Apt Holdings LLC, doing business as Carcin
252 A Avenue, Suite 200
Lake Oswego, Oregon 97034
United States
Email: carcin@carcin.ai