Privacy Policy

1. Who We Are

Carrot Labs AI, Inc. ("Carrot Labs," "we," "us," or "our") operates 3GPP Scout, an AI-powered co-pilot that helps engineers navigate and understand 3GPP standards. We democratize access to the world's most complex technology specifications.

This Privacy Policy explains how Carrot Labs collects, uses, stores, and shares your personal information when you use 3GPP Scout, our website, and any related services (collectively, the "Services").

If you have questions about this policy or your data, contact us at [email protected].

2. Information We Collect

2.1 Information You Provide

• Account Information: When you create an account, we collect your name, email address, and authentication credentials.
• Communications: When you contact us for support or inquiries, we collect the content of your messages and contact details.

2.2 Information from Google APIs

Certain features of our Services may request access to your Google account data through Google APIs. When you authenticate with Google, we may access:

• Basic Profile Information: Your name, email address, and profile photo, used to create and manage your account.
• Google Workspace Data: Depending on the features and the permissions you grant, we may access specific Google Workspace data (such as Google Sheets or Google Drive files) solely to provide the functionality you requested.

We only request the minimum scopes necessary for the features you use. You can review and revoke permissions at any time through your Google Account settings.

2.3 Chat & Query Data

When you use 3GPP Scout's chat interface with an account, we process your questions and the AI responses to provide the service. Conversation content may be retained to improve the product and for debugging purposes, in accordance with our data retention practices. Questions asked on the homepage without an account are covered in section 2.4.

2.4 Homepage Questions Without an Account

To answer a question asked on the 3gppscout.com homepage, we send it to OpenRouter, which passes it to an OpenAI model. The search terms the model chooses go to Scout's search service and to Voyage AI for embeddings. Cloudflare Turnstile checks that the request comes from a person, and receives your IP address and browser signals for that check.

We do not keep your question or the answer after the answer is sent. We keep only:

• Limit counters: daily counts that enforce the free question limits, keyed by hashes of your IP address and of a random ID stored in your browser. The hashes change every day, so they cannot be linked across days.
• Funnel events: page viewed, box shown, question submitted, answer shown and sign-up clicked, keyed by a hash of the same browser ID, with categorical details such as the number of sources and the response time. These events, and our PostHog analytics, never contain question or answer text.
• Sign-up cookie: a 30-day cookie with the time of your last answer. If you then create an account, we record on your account that you signed up after an answer, and how long after.

Model-call metadata (model, token counts, cost and timing) goes to SuperPenguin, the service we use to track model costs. Any prompt or answer content it receives is discarded.

2.5 API and MCP Requests

When you connect Scout to ChatGPT, Codex or another MCP client, Scout receives the tool name and arguments needed for the request, together with your authenticated Scout account. Scout does not request the rest of your conversation. OAuth uses your account identity, email and basic profile to link your account.

We record the account, endpoint or tool, a limited query or filter summary, time, result count, status and client information. We use these records to meter requests, investigate failures and understand which clients are used. Following a topic stores the targets and delivery settings you confirm. Email digests are sent only when your follow settings enable them.

We do not use API or MCP queries to train general-purpose AI models, sell them, or build advertising profiles. We send queries to search and embedding providers only as needed to fulfill the request. Product analytics events omit query content.

2.6 Automatically Collected Information

• Usage Data: Pages visited, features used, interactions with our Services, timestamps, and referring URLs.
• Device Information: Browser type, operating system, device identifiers, and IP address.
• Cookies & Analytics: We may use analytics tools to understand how our Services are used and to improve the user experience.

3. How We Use Your Information

We use the information we collect to:

• Provide, operate, and improve 3GPP Scout and our Services.
• Authenticate your identity and manage your account.
• Respond to your support requests and inquiries.
• Analyze usage patterns to improve product functionality and user experience.
• Comply with legal obligations and enforce our Terms of Service.

4. How We Share Your Information

We do not sell your personal information. We may share your information only in the following circumstances:

• Service Providers: With trusted third-party vendors who perform services on our behalf (e.g., hosting, analytics, AI model providers), bound by contractual obligations to protect your data.
• Legal Requirements: When required by law, legal process, or to protect the rights, property, or safety of Carrot Labs, our users, or others.
• Business Transfers: In connection with a merger, acquisition, or sale of assets, in which case your data would remain subject to this Privacy Policy.

Providers involved in API and MCP delivery include Supabase for authentication and database storage, Fly.io and Google Cloud for hosting and search infrastructure, and Voyage AI for query embeddings and relevance ranking. PostHog receives product analytics events without API or MCP query text. Resend delivers email digests when enabled. The client you connect, including ChatGPT or Codex, handles the conversation and tool results under its own policies.

For homepage questions, Vercel hosts the app that answers them, OpenRouter and OpenAI write the answer, Voyage AI embeds the search terms, Cloudflare Turnstile checks for automated traffic, Supabase stores the hashed counters and funnel events, and SuperPenguin receives model-call metadata without content.

We do not share Google user data with third parties for advertising, market research, or with data brokers.

5. Google API Services: Limited Use Disclosure

Carrot Labs' use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically, we limit our use of Google user data as follows:

• We only access Google user data that is necessary to provide or improve the specific features you use.
• We do not use Google user data for serving advertisements.
• We do not transfer or sell Google user data to third parties unless necessary to provide the Service, comply with applicable laws, or as part of a merger or acquisition.
• We do not use Google user data for purposes unrelated to the functionality of the Services.
• Human access to Google user data is limited to the minimum necessary for security, compliance, legal obligations, or to provide support you have explicitly requested.

6. Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required by law. Specifically:

• Account Data: Retained for the duration of your account. When you delete your account, we will delete or anonymize your data within 30 days, unless retention is required for legal or compliance reasons.
• Google API Data: Data obtained from Google APIs is retained only as long as needed to provide the requested functionality. We delete cached Google data when you revoke access or delete your account.
• API and MCP Records: Account-linked request logs, including limited query summaries and failure records, are retained for the duration of your account. They are deleted or anonymized within 30 days of an account deletion request, subject to legal obligations. Follow settings and saved targets are retained until you remove them or delete your account. Removing an MCP connection stops new access; it does not itself delete your Scout account or its records.
• Chat Data: Conversation data is retained only as long as needed to provide the service and improve the product.
• Homepage Questions: Question and answer text is not kept once the answer is sent. The limit counters and funnel events described in section 2.4 hold no question text and no raw IP address or browser ID, and are kept for product analysis.
• Usage Analytics: Aggregated, anonymized usage data may be retained indefinitely for product improvement purposes.

7. Data Deletion & Your Rights

You have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Delete your personal data.
• Revoke Google API permissions at any time through your Google Account settings.
• Export your data in a portable format.

To exercise any of these rights, contact us at [email protected]. We will respond to your request within 30 days.

8. Data Security

We implement industry-standard security measures to protect your data, including encryption in transit (TLS) and at rest, access controls, and regular security reviews. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

9. Third-Party Services

Our Services may contain links to third-party websites (such as 3GPP.org) or integrate with third-party services. This Privacy Policy does not apply to those services. We encourage you to review the privacy policies of any third-party service you interact with.

10. Children's Privacy

Our Services are not directed to individuals under the age of 16. We do not knowingly collect personal information from children. If we learn that we have collected data from a child under 16, we will take steps to delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last Updated" date at the top of this page. For material changes, we will provide notice through our Services or by email. Your continued use of the Services after changes are posted constitutes your acceptance of the updated policy.

12. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us:

• Email: [email protected]
• General Support: [email protected]
• Website: 3gppscout.com