Privacy Policy

Last updated: June 27, 2026

Carlo.AI ("Carlo," "we," "us") provides an AI-assisted bookkeeping assistant that helps you record money transfers and categorize transactions. This policy explains what we collect, how we use it, and the choices you have. By using Carlo.AI you agree to this policy.

Information we collect

Account information — your email address and, if you sign in with Google, your basic Google profile identifier.
Information you enter — business name, jurisdiction, chart of accounts, locations, transfers, and notes you provide.
Connected-service data (with your authorization) — when you connect QuickBooks Online (Intuit) or Google, we access only the data needed to provide the service: your chart of accounts, transactions you ask us to review or categorize, and the Google Sheet Carlo creates for you. We never receive your QuickBooks or Google password.
Usage data — basic logs needed to operate and secure the service.

How we use your information

To provide the service: suggest GL accounts, build journal entries, and (with your confirmation) push categorizations back to QuickBooks and log entries to your Google Sheet.
To improve Carlo's suggestions for your own account — your past choices train a model scoped to you.
To authenticate you, secure your account, enforce usage limits, and provide support.

QuickBooks & Intuit data

Data obtained through the Intuit/QuickBooks API is used solely to provide features you request (importing your chart of accounts and reviewing/categorizing transactions). We do not sell it or use it for advertising. You can disconnect QuickBooks at any time from Books → Disconnect, after which we stop accessing your QuickBooks data.

Bank & card data (Plaid)

If you connect a bank or card account, we use Plaid Inc. to securely retrieve your transactions. Plaid connects to your financial institution on your behalf; Carlo never sees or stores your online-banking username or password — those go directly to Plaid. We receive read-only transaction data (date, amount, merchant/description, account name and mask) which we use only to help you review, categorize, and post entries to your books. We do not use your financial data for advertising and do not sell it. Plaid's own handling of your data is governed by the Plaid End User Privacy Policy. You can disconnect a bank/card connection at any time from Books → Bank connections, after which we stop retrieving new transactions; access tokens are encrypted at rest (AES-256-GCM) and revoked on disconnect.

How we share information

We do not sell your data. We share it only with service providers ("subprocessors") that help us run Carlo, each bound to protect it: Intuit (QuickBooks), Plaid (bank/card transaction data), Google (sign-in & Sheets), Anthropic (the AI model that powers suggestions), Render (hosting & database), Stripe (billing, if you subscribe), and, where enabled, Resend (email), Twilio (SMS alerts), and Sentry (error monitoring). A current subprocessor list and our Data Processing Agreement are available on request. We may disclose information if required by law.

Data retention & security

Your data is stored in an access-controlled database and isolated per account so other users cannot see it. Connections use encrypted tokens. We retain your data while your account is active. You can request export or deletion at any time.

Your choices & rights

Access or export your data, or ask us to delete your account and data.
Disconnect QuickBooks or Google at any time.
Contact us with any privacy request.

Children

Carlo.AI is for business use and is not directed to children under 13.

Changes

We may update this policy; material changes will be reflected by the "Last updated" date above.

Contact

Questions or requests: afshin@allfacetsconsulting.com.

← Back to Carlo.AI