Carly

GDPR overview

The GDPR is addressed concretely, although the site never uses the words "GDPR compliant". A Data Processing Addendum, including the applicable Standard Contractual Clauses for transfers to the United States, is incorporated into the terms by reference and takes effect automatically on acceptance, with no separate signature required. It applies whenever CalBot processes personal data on behalf of a business customer subject to EU or UK data protection law. The addendum itself and the list of sub-processors are not published: business customers must request them at support@calbotservice.com. No EU representative under Article 27 is designated, and no Data Protection Officer is named — privacy questions and complaints go to the same support address. Both the privacy notice and the terms are dated 13 July 2026.

Who owns the data?

The publisher is SWH LABS LLC, trading as CalBot and now Carly. You keep ownership of your content and, more importantly, control of access: Carly only reaches the Google or Microsoft data you grant her — calendar, contacts, email and Drive — and every permission can be revoked at any time from your account settings or directly with the provider. The wider email and Drive scopes belong to the optional CRM and agent features and are not required for scheduling. Google data is fenced by the Limited Use rules: no advertising, no data brokers or resellers, and human reading only in five narrow cases. Payments run through Stripe, and no card details are stored.

Reuse rights

The terms grant you a limited, personal, non-commercial licence to use the service and its materials: reproducing, modifying, distributing or creating derivative works from the site's own content is not permitted, and automated means of accessing or copying it are expressly forbidden. Your own data is a separate matter — the content you send Carly remains yours and you may reuse it freely. On the vendor's side the permitted use is bounded: personal information serves to deliver and improve the service, to operate the business and to meet legal obligations, and it may be disclosed to affiliates, service providers and a buyer in a merger or sale of assets. Both CalBot and its AI model providers are contractually barred from retaining the data or training models on it.

Data retention & training

Hosting summary

The vendor publishes no trust page, no hosting region and no data-centre list, so the picture has to be assembled from the legal documents. The terms state that the service is operated from the publisher's headquarters in the United States, and the privacy notice confirms that personal information is transferred there under Standard Contractual Clauses. Governing law is that of the State of New York. No European residency option is offered. Security measures are described rather than certified: encryption in transit and at rest, role-based access control, regular security assessments and penetration testing, and a documented incident-response procedure. No SOC 2, ISO 27001 or HIPAA certification is claimed anywhere on the site. For reference, the domain resolves to a United States IP address on Amazon infrastructure, but that is an anycast edge node and says nothing definitive about where the application data itself is stored.