Keeping your data safe and sound

What we ask for

When you connect a mailbox, you authorize Carom through your email provider (Google or Microsoft). Your provider gives us a token rather than your password, and you can revoke it from your provider’s security settings at any time. Here is exactly what we ask for and why:

• Read your mail: to sync, display, search, and summarize your conversations
• Update read and starred state: so marking something read or starred in Carom does the same in your mailbox
• Send mail: so you can reply from Carom
• Read your calendar: to show events and connect them to the people and threads they relate to
• Read your contacts: to fill in names and details for the people you correspond with

Read and starred status are the only things we ever write back. We never delete your mail, and never move, archive, or re-label it.

What we store

We never store data that isn’t directly shown in Carom (email subjects, contacts, etc.) or used to power the screens we display (internal IDs that allow us to identify emails sent to multiple mailboxes, for example). In practical terms, that data includes:

• People: the names and email addresses of people you’ve corresponded with
• Conversations: subjects, short snippets, dates, recipients, and the like
• Files: file names, sizes, senders, recipients, and dates
• Events: calendar events, times, locations, and attendees
• Contacts: names and addresses from your address book

We fetch and store full message text and attachments when we need them—to display a thread, preview or download a file, or let an agent summarize a conversation. We never sell your data, and we never share your content with anyone beyond the vendors listed in our Privacy Policy—or where we’re legally compelled to, in which case we’ll tell you unless we’re prohibited from doing so.

Who can see what

We’re always balancing privacy and transparency: our goal is to enable collaboration, after all. But we follow the principle that anything you share with colleagues is done explicitly. You (or your account administrator) can create shared mailboxes, like sales@yourorganization.example, which you can choose to show to people in your organization. Carom never shares your own emails, files, and events within your account unless you explicitly choose to share them, and you can limit that sharing to certain individuals or groups and revoke access at any time.

One thing worth being direct about: that promise governs what Carom does, not who controls your mailbox. If your employer administers your Google Workspace or Microsoft 365 account, they can reach it at the provider, and no setting here changes that. What we can promise is that we won’t hand your data to anyone else on request—including an employer asking for a departed colleague’s. We say no.

What about the AI?

Carom’s agents—the ones that summarize threads, tag conversations, and turn emails into tasks—need access to your information to work. They run inside our own infrastructure, and every AI vendor we use is contractually barred from training on your data. If you don’t want the agents to see this data, you can turn them off. Your data is not used to train any AI models.

Machines reading your mail is how the product works. People are a different matter: nobody at Carom reads your email unless you ask us to look at something. We hold no standing access to your content. If you report a problem we can’t solve without looking, we’ll ask first and you can say no—and when you say yes, access is scoped, time-boxed, and logged.

Where your data lives

Carom runs on infrastructure hosted with Ubicloud and Amazon Web Services, with stored content encrypted and access to our servers tightly restricted. The complete, current list of vendors we partner with to deliver our services is always in our Privacy Policy.

When you leave

Cancel whenever you like. We’ll terminate billing as soon as you cancel, and you can choose to end your access then or at the end of your current billing period. After a short recovery window, we delete the data you provided and everything we imported from your mailboxes.

Encrypted backups take a little longer to age out—up to 45 days. A backup can’t be selectively edited, so we record every deletion outside the database and re-apply it to any restore. Data you deleted doesn’t come back to life.