Looking for the extension? Read the Pocket Detective privacy notice for browser permissions, page context and limited-use commitments.
Which notice applies?
This notice covers askcarmen.ai, our business communications, account administration and the Carmen service, including Carmen Chats. The Pocket Detective privacy notice adds details about the browser extension, its permissions and Chrome Web Store Limited Use commitments. Those additional limits continue to apply to extension user data.
Sivoham LLC provides AskCarmen. We determine how website inquiries, business contacts and service administration data are handled. Your organization controls its NetSuite business records, users and permissions; we process customer business data to provide Carmen on its behalf and under the applicable customer agreement. For those records, your organization's privacy notice also applies.
Information we handle
- Website and contact information: information you choose to send by email, such as your name, work email, company, inquiry and support correspondence. Visiting the site also sends connection information, such as IP address, browser/request metadata and security events, to our hosting provider.
- Account and service administration: organization and user identifiers, work contact details, NetSuite account and role identifiers, license status, usage, configuration, access decisions and connection credentials needed to operate the service.
- Optional employee-name display: when your NetSuite administrator reviews and approves synchronization, Carmen administration can display assigned employees' names beside their existing license references and source account. This synchronization excludes email addresses, payroll, tax and health fields; names do not determine seat identity.
- Questions and business records: prompts, answers, permitted conversation context and NetSuite records relevant to a request. These may include customer or vendor contact details, transaction identifiers, invoices, bills and financial balances, depending on the question and current user's access.
- Operational records: request references, timestamps, errors, security events and consented diagnostics for support and reliability. Diagnostic content depends on the enabled settings.
Information comes from you, your organization, its configured systems and service interactions. Avoid sending passwords, API keys or unnecessary sensitive personal information in chat or ordinary support email. AskCarmen is intended for organizational users, not children.
Why we use information
We use information to respond to inquiries, provide and administer Carmen, authenticate and authorize access, answer questions, maintain permitted history, enforce license and usage limits, troubleshoot problems, protect the service and meet legal obligations.
Where data protection law requires a lawful basis and we act as a controller, we rely on steps you request before a contract or performance of our contract with you; legitimate interests in business communications, service administration and security, balanced against your rights; legal obligations; or consent where required. Customer business data is processed on the customer's instructions under the applicable agreement. A customer's administrator is responsible for its own lawful basis and user notices.
Carmen uses AI and can make mistakes. Check responses before use; they are not professional advice. AI providers process relevant content to generate responses. Our assistant does not itself make legally binding decisions about individuals.
Storage, retention and security
Customer chat and request history may be stored in the customer's NetSuite account. Hosted service records include configuration, licensing, usage, security and operational information. We retain information for the time needed to provide the service, resolve support requests, maintain security and satisfy contractual, dispute or legal requirements. The applicable customer agreement, enabled retention settings, record type and purpose determine the period; contact us for details for your account.
The optional employee-name projection is encrypted separately from usage records and expires from the administration display after seven days. Administrators can refresh or remove that display through NetSuite Carmen Access. Synchronized directory names are not added to AI prompts or metering events. Backups follow their existing lifecycle, so display expiry is not a promise of immediate physical deletion from every copy.
Removing an extension or disconnecting an account does not delete existing customer or server records. Deletion requests may require coordination with your administrator. Backups, security holds and legal obligations may delay final deletion.
We use HTTPS and access controls, and business queries are checked under the user's current NetSuite role. No system is guaranteed secure. Carmen's current cloud infrastructure is in the United States; NetSuite, email, website and selected AI providers may process information in other countries. Where applicable, international transfers require legally recognized safeguards, such as appropriate contractual protections. Contact us for information about the arrangements relevant to your account.
Website cookies and your choices
The current public website does not run advertising or analytics scripts and does not set application tracking cookies. Our delivery and security provider may process connection information and use necessary security technologies. A linked NetSuite, Google sign-in or other provider page has its own cookies and notice.
You may choose whether to contact us or supply optional information. Your organization controls Carmen access, cloud processing, history and diagnostics. Available conversation and page-context controls govern their use. You can ask us to stop optional communications. Pocket Detective's browser permissions and removal options are explained in its separate notice.
Privacy requests and complaints
Email privacy@askcarmen.ai and address your request to Sivoham LLC / AskCarmen. You may ask about access, correction, deletion, retention or a privacy concern. Depending on applicable law, you may also have rights to portability, restriction, objection, withdrawal of consent and a complaint to your privacy regulator. Withdrawal does not affect earlier lawful processing.
For organization-controlled NetSuite records, contact your administrator as well. We may verify identity and coordinate with your organization before acting. Please describe your concern and the account or service involved without emailing unnecessary sensitive records. We will investigate and respond within the period required by applicable law. You can also contact your applicable regulator, including the UK Information Commissioner's Office or the Office of the Australian Information Commissioner.
Changes to this notice
We update this notice as our practices change and revise the date above. Material changes requiring notice or consent will be communicated before the changed collection or use. The linked Pocket Detective notice continues to explain extension-specific practices.