Privacy Policy

1. Who this policy covers

Cartora Technologies (“Cartora,” “we,” “us”) operates cartora.tech and provides connected reporting, analytics, and workflow services for B2C brands and agencies managing complex paid media. This policy covers visitors to cartora.tech and customer workspace administrators and authorized users. Customers choose which data sources they connect and which users and destinations they authorize. Where Cartora processes connected business data on a customer's instructions, the customer remains responsible for its own notices and lawful permissions toward its own end users.

2. Information we receive

We may receive contact details and correspondence sent to us; account identity, workspace membership, and role permissions; integration identifiers, authorized tokens, and related connection metadata; usage, operational, and security logs; workflow definitions, approved outputs, evidence, and run history; and the content and metrics a customer authorizes Cartora to read from a connected data source. Website visits may generate ordinary analytics such as pages viewed, referrers, and general browser or device information. The exact categories depend on the data sources and features a customer enables.

3. How Cartora works with your data

Cartora is the platform and connector (Cartora MCP) that manages data connections, permissions, workflow logic, evidence, schedules, delivery, and run history. Authorized users work with their connected data from inside Claude or ChatGPT. Cartora brings data from connected data sources into an operation in real time rather than keeping an unnecessary standing copy of that source data. Workflow definitions, approved outputs, evidence, and run history may be retained so a workflow can be reviewed and operated. When a customer selects creative analysis, creative files may be stored temporarily for that analysis and cleared afterward under the customer's selected process.

4. Google-connected data sources

With the account's authorization, Cartora may access Google Ads, Google Analytics 4, Google Search Console, Google Tag Manager, and Google Play Console, and may read and write Google Sheets a customer has authorized as a working file. This may include advertising performance and configuration, analytics metrics, search and app performance, tag or container metadata, and spreadsheet contents the customer has connected. Cartora requests only the scopes needed for the features a customer enables.

Cartora's use of information received through Google APIs is limited to providing or improving the user-facing features described on this site, such as dashboards, analysis, reconciliation, and customer-requested reports. This use complies with the Google API Services User Data Policy, including its Limited Use requirements. Cartora does not use Google user data for advertising, does not sell it, and does not use it to train generalized AI models. Cartora does not allow humans to read Google user data except where the user has given affirmative consent, it is necessary for security purposes, it is required by applicable law, or the data has been aggregated and anonymized.

5. Meta-connected data sources

With the account's authorization, Cartora may access Meta Ads account information and performance, and Facebook Page and Instagram professional account insights, to the extent permitted by the granted permissions and Meta's applicable terms. Cartora uses that information to prepare the customer-requested analytics, reporting, and workflow outputs described on this site. Cartora does not publish posts, change ads, or message end users through these connections, and does not sell Meta Platform Data or use it for independent advertising or profiling unrelated to the customer's own request.

6. Other connected data sources and destinations

Depending on what a customer connects, Cartora may also work with Adjust, CleverTap, Metabase, and additional API-based business systems scoped per implementation, and may deliver scheduled reports and alerts by email, Slack, WhatsApp, or Telegram. A requested analysis sends only the minimum relevant content to the AI interface (Claude or ChatGPT) and delivery destination the customer has selected. Those third parties process information under their own terms; Cartora does not control their retention or model-training settings. Customers should avoid sending sensitive personal data through a connected data source, working file, or delivery destination unless they have confirmed it is appropriate to do so.

7. Purposes and recipients

Cartora processes data to authenticate users, operate authorized connections, generate analysis and scheduled reports, deliver outputs to the destinations a customer designates, troubleshoot failures, defend against misuse, maintain operational records, and comply with law. Access may be given to authorized users within the same customer workspace, the infrastructure providers and processors Cartora relies on to run the service, the AI interface or delivery destination a customer selects, and recipients required by law. Cartora does not disclose one customer's connected data to another customer.

8. Storage, protection, and retention

Integration credentials and access tokens are treated as sensitive and are protected with access controls and encrypted transport. Retained workflow records, logs, and backups follow the customer's configuration, contractual terms, technical recovery needs, and applicable law; retention periods are not identical for every category. Disconnecting a data source stops future authorized retrieval once the change takes effect, but does not automatically erase outputs already generated or delivered. Customers who need a specific retention schedule before sharing regulated or sensitive data should confirm it with us first.

9. Your choices and rights

An authorized user can withdraw a Google or Meta permission directly through that provider's account settings and can ask their workspace administrator to remove a Cartora connection. To request access to, correction of, export of, or deletion of information under our control, contact hello@cartora.tech. Identify your workspace and the connected account by name, not by password or token. We verify requester authority before acting. See Data Deletion for Google and Meta specific disconnection and deletion steps.

10. Cross-border processing and changes

Cartora's infrastructure providers and a customer's selected AI interface or delivery destination may process data in different countries. We will update this page when our processing changes materially. This policy does not override the terms of a signed customer agreement where one exists.