CARLA HQ
Add to Chrome
DATA PROTECTION

Privacy Policy

1. General Information on Data Processing

This Privacy Policy explains how Carla ("we", "us", "our") handles personal data and document variables when you use the Carla Chrome Extension and the Carla HQ web services.

2. Local-First Processing (WebGPU Inference)

Carla is designed to prioritize your privacy. When training model nodes or running predictions inside the Google Sheets sidebar panel:

  • All computations execute locally in your browser using WebGPU and WebAssembly.
  • Your clear-text spreadsheet rows, cells, and document values never leave your local machine.
  • Feature attributions (SHAP calculations) are computed entirely on-device.

3. Cloud Uploads & Hosted Model Registry (Carla HQ)

If you opt-in to publish your trained model parameters to the Carla HQ hosted registry:

  • Only the compiled model weights (KV cache matrices) are transmitted and securely stored on our cloud containers.
  • The underlying source data rows and tables remain strictly offline in your browser and are never uploaded.
  • Model endpoints are protected by OAuth 2.1 authentication, ensuring only authorized LLM agents or pipelines can query prediction gates.

4. Google Workspace API Data Usage

The Carla HQ Chrome Extension accesses and processes Google user data under the following guidelines:

4.1. What Google User Data is Accessed

4.1.1. The Carla Chrome Extension accesses your active Google Sheet. Specifically, it requests read and write access to the tabular data (rows and cell contents) within the specific spreadsheet tab you have open when you activate the extension.

4.2. How Your Application Uses Google User Data

4.2.1. The accessed spreadsheet data is loaded directly into your local browser's memory (using WebAssembly/WebGPU) to execute our offline, local machine learning inference models. The extension also uses this access to write the resulting classification labels back into a new column on your active spreadsheet.

4.3. With Whom We Share, Transfer, or Disclose Google User Data

4.3.1. We do not share, transfer, or disclose your Google user data with anyone. All spreadsheet data processing happens entirely locally on your device. We do not transmit your clear-text spreadsheet data to our servers, nor do we transfer it to any third-party AI or ML services.

4.4. Limited Use Compliance Statement

4.4.1. Carla operates a strictly offline/self-hosted model architecture within your local browser environment. The use of raw or derived user data received from Workspace APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

5. Marketing Waitlist & Email Processing (Google Cloud Platform)

If you subscribe to our waitlist to receive launch notifications and updates:

  • Your submitted email address is processed solely for queue placement and product launch communications, based on your consent (Art. 6(1)(a) GDPR).
  • This data is processed and stored securely using Google Cloud Platform (Google Cloud EMEA Limited).
  • All servers and databases for waitlist records are hosted exclusively on infrastructure within the European Economic Area (EEA).
  • You can revoke your consent and request immediate deletion of your email record at any time.

6. Referral Tracking & UTM Analytics (Marketing)

To understand which marketing campaigns are successfully driving beta signups:

  • We capture incoming UTM parameters (such as utm_source, utm_medium, utm_campaign) from the URL on the landing page via JavaScript.
  • These parameters are stored temporarily in your browser's sessionStorage.
  • When you join the waitlist, they are written to your Firestore waitlist document to help us evaluate campaign performance.

7. Privacy-First Web Analytics (Umami)

We use Umami Analytics to analyze traffic and usage patterns on our website:

  • Umami is a privacy-focused web analytics platform that does not use cookies, collect personal data, or track users across different websites.
  • All collected data is anonymized and aggregated to help us improve the website experience and understand general visitor interest.

8. Your Rights under GDPR

Under the General Data Protection Regulation (GDPR), you have the right to access, rectify, restrict processing, or request erasure of your stored account details (waitlist emails, user profile information, and uploaded weights) at any time. To exercise these rights, contact us at: contact@carlahq.eu.