Customer Terms of Service

The agreement between Carom and the organization or person who pays for it

Last updated: July 26, 2026

Notice

These terms require most disputes to be resolved by individual arbitration rather than in court, and waive your right to participate in a class action. You may opt out of arbitration within 30 days of first accepting these terms. See Resolving disputes.

These terms also limit what we owe you if something goes wrong. See What we commit to, and what we don’t and Limits on liability.

Summary

• You pay monthly in advance, and it renews automatically until you cancel.
• Cancel any time in the app. Service continues through the end of the month you paid for.
• We claim no ownership of your data. We use your mail and the content you create solely to run Carom for you.
• We do not guarantee that Carom will be available or error-free.
• Our liability is capped at the greater of $500 or what you paid us in the last twelve months.
• Disputes go to individual arbitration unless you opt out in your first 30 days.

The full agreement follows and controls.

Who this is for

Carom is for business use. The Services are offered solely for business, professional, nonprofit, and organizational purposes, and not for personal, family, or household use. If you are an individual Customer, you represent that you are acting in your trade, business, or profession. Customers and Users must be at least 18 years old.

Each account is one Customer, regardless of how many people use it. If the person who signs up is acting for a company, partnership, or other organization, that organization is the Customer. Otherwise, they are the Customer personally.

Signing up on behalf of an organization is a representation that you have authority to bind it.

Carom is offered in the United States. You represent that you are established in the United States and direct your use of the Services from there. We do not offer the Services in the European Union, the United Kingdom, or other jurisdictions whose data-transfer requirements we have not implemented.

People invited into an existing account are Users, not Customers, and their relationship with us is governed by the User Terms of Service. An individual using Carom for their own business is both the Customer and a User, and both documents apply.

What these documents do

Three things make up your agreement with us:

	What it covers
A signed order form, if we have one with you	Negotiated commercial terms — pricing, term, any specific commitments
The Data Processing Addendum, which applies automatically	How we process personal data on your behalf
These Customer Terms	Everything else between you and us

Where they conflict, an order form controls commercial matters, the Data Processing Addendum controls data-processing matters, and these Customer Terms control everything else.

The User Terms are a separate agreement between us and each individual who uses Carom, including your employees. They are not part of your agreement with us, and nothing you and we agree — including an order form — changes an individual’s rights under them. Your responsibilities for your Users are set out in this document.

The Privacy Policy describes how we handle data. It is a disclosure document rather than a set of contractual warranties; the commitments we make to you contractually are the ones written in this agreement and the Data Processing Addendum, together with the parts of the Privacy Policy they expressly incorporate.

Your account

You are responsible for your Users. You decide who gets access and what they can do. You are responsible for their conduct, including violations of the User Terms, and for fees they cause you to incur — for instance by adding a mailbox.

You are responsible for account security. Use strong, unique passwords, do not share credentials, and control access to signed-in devices. Report suspected compromise to security@carom.io.

Keep your contact and billing details current. We send account, billing, and security notices to the email address on the account, and those notices are effective when sent.

Your rights to Carom, and ours

We grant you a non-exclusive, non-transferable right to access and use the Services during the term, for your internal business purposes, subject to this agreement.

We keep everything else. The Services, our software, documentation, designs, and trademarks are ours, along with all improvements to them. Nothing in this agreement transfers any of it to you, and the restrictions in the User Terms apply to you as well.

Your data

We claim no ownership of Customer Data. As between Carom and you, you retain all rights you have in it. These terms do not decide ownership or other rights as among you, your Users, mailbox administrators, senders, recipients, or anyone else.

Our license is limited to running Carom for you. You grant us a worldwide, non-exclusive license to access, store, copy, process, transmit, and display Customer Data solely to: provide, maintain, and support the Services for you; prevent or resolve security, support, or technical problems; comply with the law; and perform tasks you specifically request. That is the complete list.

We do not use Customer Content for our own purposes. We do not train AI models on it, sell it, share it for advertising, or use it for research. We do use Account Data and Service Data — billing details, support correspondence, logs, error reports, and usage events — to bill you, support you, secure the Services, and understand what to build. Those four categories are defined in the Privacy Policy.

You are responsible for the rights to the data you bring. You represent that you have the rights and permissions necessary for us to process the data you and your Users bring into Carom, including data belonging to third parties who appear in your mail, calendar, and contacts.

Access follows the mailbox, and we do not transfer data between accounts. Access to data we import follows control of that mailbox at the email provider. If one of your Users connects a mailbox you do not administer and later leaves, we will not hand you that data on request. The User Terms state the same rule to them. Where your organization needs to retain correspondence after someone departs, use a shared mailbox from the outset. Valid legal process overrides this.

Regulated data. You will not use the Services to create, receive, maintain, or transmit protected health information on behalf of a covered entity or business associate, as those terms are defined under HIPAA, or to process other data subject to sector-specific regulation that requires a written agreement we have not signed. We do not sign Business Associate Agreements. This restriction does not depend on whether Carom is your system of record.

Feedback. “Feedback” means suggestions, ideas, and comments you give us about the Services. It does not include Customer Data or your Confidential Information. You grant us a perpetual, irrevocable, worldwide, royalty-free license to use Feedback for any purpose, with no obligation to you.

Fees and billing

Pricing. You pay monthly in advance. Fees are those presented at signup, adjusted for usage — the number of Users, mailboxes, and other billable items on your account.

Automatic renewal. Your subscription renews automatically each month and we charge your payment method until you cancel. Cancellation is available at any time in the app.

Launch credit. Credit we apply toward your first month applies to that first billing period only. Any unused portion expires when the period ends and does not carry forward.

Usage changes. Usage above what you paid for in a period appears on your next invoice. Usage below it produces a credit applied to future months until exhausted. Usage credits have no cash value and are not refunded at closure.

Payment method. You must maintain a valid payment method and authorize us to charge it for amounts owed.

Taxes. Prices exclude taxes. Where required, we collect and remit them.

Late payment. If undisputed fees are more than 30 days overdue, we may limit, downgrade, or suspend your account on at least 10 days’ notice.

Refunds. We may offer refunds at our discretion. We are not required to, except where these terms provide otherwise.

Price changes. We may change prices on at least 30 days’ notice before they take effect. Cancel before then if you do not want to pay the new price.

Cancellation and deletion

Cancel at any time, for any reason, in the app. Cancellation is as simple as signup.

Cancellation stops future renewals. It does not eliminate usage adjustments, taxes, or other amounts incurred before your account closes — if you added seats in your final month, that appears on a final invoice. You retain access through the end of the period already paid for.

We may terminate your account if you or your Users materially breach this agreement or the User Terms and do not cure within 30 days of notice. We may suspend access immediately, without notice, where we reasonably believe continued access threatens the security of the Services or another person.

After closure, we delete your data. Your account closes at the end of the current billing period. Seven days later we delete the Customer Content imported from your mailboxes and the content created in your account, as described in the Privacy Policy. Encrypted backups expire within 45 days, and our deletion records prevent a restore from resurrecting deleted data.

Retrieve what you need before cancelling. After closure we are not obliged to retain your data or provide access to it. Your mailbox is unaffected: we never delete mail, and everything we imported remains with your email provider.

What we commit to, and what we don’t

Our commitments.

• We will keep your data confidential and process it in accordance with this agreement and the Data Processing Addendum.
• We will use commercially reasonable security measures to protect it.
• If we discover a security incident affecting your data, we will notify you without undue delay after becoming aware of it, and no later than 72 hours after discovery, or sooner where the law requires, with what we know at the time and following up as we learn more. A security incident means unauthorized access to, or the acquisition, loss, disclosure, destruction, or alteration of, your data. Routine unsuccessful events — blocked attacks, failed logins, scans — are not security incidents.
• If we discontinue the Services, or materially reduce core functionality you are paying for, we will give at least 30 days’ notice and refund the unused portion of anything prepaid.
• Support is available at support@carom.io on a best-efforts basis, without a committed response time.

Disclaimer. The Services are provided “as is” and “as available.” To the fullest extent permitted by law, we disclaim all warranties, express, implied, or statutory, including any implied warranty of merchantability, fitness for a particular purpose, title, accuracy, and non-infringement.

We do not warrant that: the Services will meet your requirements; that they will be available, uninterrupted, timely, or error-free; that defects will be corrected; that the Services are free of harmful components; or that anything the Services produce — including AI-generated summaries, tasks, tags, and briefings — will be accurate, complete, or reliable.

On AI output specifically: it is wrong sometimes. It misreads, omits, and asserts incorrect things without signaling uncertainty. Carom organizes what is already in your mail; it does not replace reading it. Do not rely on it for decisions with legal, financial, medical, or safety consequences without checking the source, which we always link.

We offer no uptime guarantee at standard pricing. Larger customers may request one; if we agree, it will appear in a signed order form.

Confidentiality

Each party may learn confidential information about the other. “Confidential Information” means non-public information disclosed by one party that a reasonable person would understand to be confidential. Customer Data is your Confidential Information. Our non-public technology, security details, and pricing are ours.

Each party will protect the other’s Confidential Information with at least reasonable care, use it only as this agreement permits, and disclose it only to employees, vendors, and professional advisers who need it and are bound by confidentiality obligations at least as protective.

This does not cover information that is public through no fault of the receiving party, was already known without a duty of confidence, is independently developed without reference to the other’s information, or is lawfully received from a third party. Where either party is legally compelled to disclose, it will give notice where legally permitted, disclose only the minimum legally required, and seek confidential treatment.

These obligations continue for three years after this agreement ends — for Customer Data, for as long as we hold it, and for trade secrets, for as long as they remain trade secrets under applicable law.

Acceptable use

You and your Users must follow the acceptable use rules in the User Terms of Service. You are responsible for the content of messages sent through the Services from your account, including compliance with anti-spam laws such as CAN-SPAM.

We may suspend any account or User we reasonably believe is violating these rules deliberately, repeatedly, or in a way that presents a credible threat to other people or to the Services.

Indemnity

You will defend us against third-party claims arising from: Customer Data, including any claim that it infringes or misappropriates someone’s rights; your or your Users’ unlawful use of the Services; or your material breach of this agreement. You will pay damages and costs — including reasonable legal fees — finally awarded or agreed in settlement.

This does not apply to claims caused by our breach of this agreement, our negligence, or our willful misconduct.

We will notify you of any such claim, give you control of the defense with counsel reasonably acceptable to us, and provide reasonable assistance at your expense. We may participate at our own cost with our own counsel. You may not settle a claim in a way that requires us to admit fault, pay money, or take or refrain from any action, without our written consent, which will not be unreasonably withheld. Delay in notifying you relieves you of your obligations only to the extent you are materially prejudiced by the delay.

Limits on liability

Neither party is liable to the other for indirect, incidental, special, consequential, exemplary, or punitive damages, or for lost profits, revenue, data, goodwill, or business interruption, even where the possibility of such damages was known or should have been known.

Our total liability for all claims, taken together, will not exceed the greater of $500 or the amount you paid us in the twelve months preceding the event giving rise to the claim.

These limits do not apply to: fees you owe; your indemnity obligations above; or either party’s gross negligence, willful misconduct, or fraud.

Where local law does not permit some of these exclusions, they do not apply to you to that extent, and the remainder stands.

Changes to these terms

We may update these terms, the User Terms, the Data Processing Addendum, and the Privacy Policy. We will post the new version with a new date and, for material changes, email you or notify you in the product at least 30 days before they take effect. Prior versions are available on request.

Material changes apply at the start of your next billing period following that notice. Cancel before then if you do not want to accept them. Continued use after they take effect constitutes acceptance.

Changes are not retroactive. They do not govern a dispute that arose before they took effect, and a change to how we use data that requires your consent does not take effect merely because we sent notice.

Changes to the Services

We improve, change, and sometimes remove features. Where a change materially reduces the core functionality you are paying for, or we discontinue the Services, we will give at least 30 days’ notice and refund the unused portion of anything prepaid. Routine changes we make as we go.

Resolving disputes

This section is governed by the Federal Arbitration Act.

Informal resolution. Before filing anything, the party with the complaint will email the other — legal@carom.io for us, your account address for you — describing the problem and the resolution it seeks. Both parties will spend 60 days attempting to resolve it. This is a precondition to arbitration and pauses any applicable deadline while it runs.

Arbitration. Any dispute arising out of or relating to these terms or the Services that is not resolved informally will be settled by binding individual arbitration administered by the American Arbitration Association under its Commercial Arbitration Rules, together with its Mass Arbitration Supplementary Rules where those apply. Judgment on the award may be entered in any court with jurisdiction.

Who decides what. The arbitrator decides all questions of arbitrability, including whether this section is enforceable as to a particular claim, except that a court decides whether the class action waiver below is enforceable.

Location. Arbitration will be conducted by phone or video where possible, or in the federal judicial district where you are located. You will not be required to travel to Delaware.

Costs. For claims under $25,000, we will pay the arbitration filing and administrative fees unless the arbitrator finds the claim frivolous. Each party otherwise bears its own legal costs, unless the law or the arbitrator provides otherwise.

Class action waiver. You and Carom each agree to bring claims only individually, and not as a plaintiff or class member in any class, collective, consolidated, or representative action. The arbitrator may not consolidate claims or preside over any representative proceeding.

Mass filings. The AAA’s Mass Arbitration Supplementary Rules apply according to their own terms, including the appointment of a process arbitrator. Separately, and whether or not those rules are triggered, where 25 or more similar claims are filed against us by or with the assistance of the same counsel or a coordinated group, the parties agree the claims may be administered in batches for efficiency. Each claim remains legally separate, is decided on its own record, and receives its own individual award. Deadlines are paused while batching proceeds.

Exclusions. Either party may bring a qualifying claim in small claims court, and either may seek injunctive relief from a court to protect intellectual property or stop unauthorized access to the Services. Nothing in this section waives the right to seek public injunctive relief in a court of competent jurisdiction where such a waiver would be unenforceable, and any such claim is severed and stayed pending arbitration of the rest.

Opting out. Email legal@carom.io within 30 days of first accepting these terms with your account name and the words “arbitration opt-out.” The rest of these terms continue to apply, and disputes proceed in the courts identified below.

Changes to this section do not apply to disputes that arose before the change, and a material change to it gives you a fresh 30-day right to opt out.

Severability. If the class action waiver is found unenforceable for a particular claim, that claim proceeds in court and this section continues to apply to all others.

Courts. For anything not subject to arbitration, including where you have opted out, you and Carom submit to the exclusive jurisdiction of the state and federal courts located in Delaware, and each party waives the right to a jury trial.

General

Governing law. Delaware law governs this agreement, without regard to its conflict-of-law rules. Nothing here removes protections available to you under the law of your state that cannot be waived.

Notices. We send notices to your account email. You send them to legal@carom.io or to Bankshot Software, LLC, c/o Legalinc Corporate Services Inc., 131 Continental Drive, Suite 305, Newark, DE 19713. Email constitutes written notice for both parties.

Publicity. We will not use your name or logo in our marketing without your prior consent.

Assignment. Neither party may transfer this agreement without the other’s written consent, except in a merger, acquisition, reorganization, or sale of substantially all assets. Data obtained through Google Workspace APIs will not transfer in any such transaction without the explicit prior consent of the relevant users, as Google’s policies require. Any other attempted transfer is void.

Force majeure. Neither party is liable for delays or failures caused by events outside its reasonable control: denial-of-service attacks, failures of hosting or utility providers, natural disasters, war, terrorism, epidemics, labor disputes, or government action. The affected party must take reasonable steps to mitigate. This does not excuse payment for services received, and it does not excuse either party’s confidentiality, privacy, or security obligations.

No waiver. Failure to enforce a right is not a waiver of it. Waivers are effective only in writing.

Severability. If any part of this agreement is held unenforceable, it is limited or removed to the minimum extent necessary and the remainder stays in force.

Independent contractors. Nothing here creates a partnership, joint venture, employment, or agency relationship.

Entire agreement. These terms, the Data Processing Addendum, and any signed order form constitute the entire agreement between you and us regarding the Services and supersede prior discussions and agreements, subject to the order of precedence set out above. The User Terms are a separate agreement between us and each individual User.

Survival. The following sections survive termination: Your rights to Carom and ours, Your data, fees already owed, Cancellation and deletion, What we commit to and what we don’t, Confidentiality, Indemnity, Limits on liability, Resolving disputes, and General.