Privacy Policy

This policy describes what data Carbon collects, how it is used, and the choices you have. It applies to the Carbon dashboard at oncarbon.site, the ingest API, and the Carbon SDK (together, the “Service”).

Account data. When you sign in through our identity provider we receive your email address and basic profile details, which we use to create and operate your account.

Event data. Your applications send events to Carbon through the SDK or the ingest API. An event can include LLM prompts and outputs, tool inputs and outputs, model and token usage metadata, and identifiers you choose to attach (such as user, agent, and thread IDs). You control what your applications send.

Billing data. Payments are processed by our payment provider. We store your subscription state and usage counts; we do not store your card details.

Technical data. We store API keys only as cryptographic hashes, and we keep operational logs needed to run the Service securely.

The dashboard uses a single HTTP-only cookie to keep you signed in. We do not use advertising or cross-site tracking cookies.

Product analytics. We use a third-party product-analytics provider to understand how the Service is used so we can improve it. On our website this runs in a cookieless mode — it sets no cookies, stores nothing on your device, and collects no directly identifying information; it measures only anonymous, aggregate usage such as page views. Separately, our servers record a small set of product milestones associated with your account — for example creating a space or upgrading a plan — which we process under our legitimate interest in operating and improving the Service. We do not use session replay, we do not use this data for advertising, and we do not sell it.

• to provide the Service: store events, compute analytics, and render your dashboard;
• to enrich events with derived metadata such as model provider and estimated cost;
• to meter usage and operate billing;
• to secure the Service, prevent abuse, and debug operational issues;
• to communicate with you about your account and material changes to the Service.

We do not sell your data and we do not use your event data to train models.

We rely on infrastructure and service providers to operate Carbon — including cloud hosting and storage, analytics databases, authentication, payments, and webhook delivery. These providers process data only as needed to provide their services to us.

Event data may contain personal data of your own users — for example inside prompts or the identifiers you attach. For that data you act as the data controller and Carbon acts as a processor on your behalf. You are responsible for providing required notices and obtaining consents from your users, and for not sending data you lack the right to process.

Account and event data are retained while your account is active. When you delete your account, or upon verified request, we delete your data within a reasonable period, except where retention is required by law or for billing records.

Data is encrypted in transit. API keys are never stored in plain text — only as keyed cryptographic hashes. Access to production systems is restricted. No system is perfectly secure; we encourage you to rotate API keys if you suspect compromise.

Depending on your location, you may have rights to access, correct, export, or delete your personal data, or to object to its processing. To exercise these rights, contact us at the address below; we will respond within the timelines required by applicable law.

The Service is not directed at children under 16, and we do not knowingly collect their data.

We may update this policy from time to time. Material changes will be announced through the Service or by email before they take effect. The date above reflects the latest revision.

Questions or requests about your data: support@oncarbon.site