Privacy Policy

Last updated: October 20, 2026

Carvr LLC ("Carvr", "we", "our", "us"), a Texas limited liability company, operates the Carvr web application and Figma plugin (collectively, the "Service"). This Privacy Policy explains how we collect, use, and protect your information when you use our Service. Carvr is the successor to the service previously operated as "Grotto Slice"; this policy applies to all accounts, including those created under the previous name.

1. Information We Collect

Account Information: When you create an account, we collect your email address and password. Passwords are securely hashed and never stored in plain text. If you sign in with Google, we receive your email address from Google.

Design Images: When you use the Service, you upload email design images for processing. These images are stored to perform slicing, compression, alt-text generation, and template creation, and to power your Email History.

Brand Configuration: If you connect a Klaviyo account, we store your brand settings (brand name, website URL, Klaviyo API key) to generate email templates on your behalf.

Billing Information: Payments are processed by Stripe. Your card details are collected and stored by Stripe. They never touch our servers. We store your subscription status and plan.

Usage Data: We collect product usage information (feature usage, upload counts, error logs) to operate quotas and improve the Service.

Cookies and Advertising Tags: Our website uses cookies and similar technologies from our advertising partners to measure how our ads perform (see Section 5).

2. How We Use Your Information

  • Authentication: Your email and password (or Google sign-in) authenticate you and secure your account.
  • Image Processing: Uploaded design images are processed to slice them into sections and generate Klaviyo email templates.
  • AI Features: Uploaded images are sent to AI providers (Anthropic for slice-point analysis, OpenAI for alt-text generation) solely to provide those features. They are not used to train those providers' models under our API agreements.
  • Klaviyo Integration: Your Klaviyo API key is used server-side to upload image sections and create email templates in your Klaviyo account.
  • Billing: Stripe processes subscription payments; we use subscription status to control plan limits.
  • Service Improvement: Aggregated, non-identifying usage data may be used to improve performance and reliability.
  • Advertising: Your email address and name, hashed, keep our ads away from existing customers and help us reach similar businesses, and advertising cookies measure our ads (see Section 5).

3. Legal Bases for Processing (GDPR)

Where the EU or UK General Data Protection Regulation applies, we rely on the following legal bases under Article 6(1) for each processing purpose:

  • Providing the Service (account creation, authentication, image processing and slicing, AI features, template creation, and the Klaviyo integration): performance of a contract, Art. 6(1)(b).
  • Billing and subscription management: performance of a contract, Art. 6(1)(b), and compliance with legal obligations (tax and accounting records), Art. 6(1)(c).
  • Service improvement, analytics, and error monitoring: our legitimate interests in operating, securing, and improving the Service, Art. 6(1)(f).
  • Security, fraud, and abuse prevention: our legitimate interests in protecting the Service and its users, Art. 6(1)(f).
  • Advertising (audience matching and ad measurement, see Section 5): our legitimate interests in promoting Carvr to businesses, Art. 6(1)(f).
  • Product and marketing communications: your consent, Art. 6(1)(a), which you may withdraw at any time.

Where we rely on legitimate interests, we have balanced them against your rights; you may object to that processing as described in Section 9.

4. Data Storage and Security

Your data is stored on Supabase infrastructure, which provides encryption at rest and in transit. We use Row Level Security (RLS) to ensure users can only access their own data.

Authentication tokens in the Figma plugin are stored using Figma's encrypted client storage, which is sandboxed per plugin and inaccessible to other plugins or extensions.

5. Third-Party Services and Advertising Partners

We use the following third-party services (sub-processors) to operate:

Advertising partners: We advertise Carvr on Meta (Facebook and Instagram), Google, and LinkedIn, and use them in two ways:

  • Audience matching: we may upload the email address and name of Carvr account holders to these platforms, hashed (SHA-256) so that the platform can only compare them with its own users. We use the matches to avoid showing our ads to people who already use Carvr, and to reach businesses similar to our customers (for example, lookalike audiences). The platforms do not tell us who matched.
  • Ad measurement: our website uses advertising tags (currently Google's tag and Meta's Pixel) that set cookies to measure whether our ads lead to sign-ups. We may add LinkedIn's equivalent tag for the same purpose. When you sign up, connect a brand, send emails through Carvr, start a trial or subscribe, our servers also tell Meta, with your email address, name and account ID hashed (SHA-256), your browser's IP address and user agent, and Meta's own ad cookies, so Meta can count which ads led there.

To be left out of audience matching, email support@carvr.ai from your account email. We will leave you out of every future upload and remove you from audiences we have already uploaded. You can also limit ad personalization in each platform's ad settings, and block advertising cookies in your browser. See the Meta Privacy Policy, How Google uses information in advertising, and the LinkedIn Privacy Policy.

We do not sell or rent your personal information, and apart from the advertising partners above, we do not share it with third parties for marketing.

6. International Data Transfers

Carvr is based in the United States and our primary infrastructure is located in the United States (AWS us-west-1). If you use the Service from the European Economic Area, the United Kingdom, or Switzerland, your personal data is transferred to and processed in the United States.

For those transfers we rely on appropriate safeguards: several of our sub-processors are certified under the EU-U.S. Data Privacy Framework and its UK and Swiss extensions (including Stripe, Klaviyo, PostHog, and Google), and for our other sub-processors (including Supabase and our AI providers) we rely on Standard Contractual Clauses incorporated into their data processing agreements. You may request more information about these safeguards at support@carvr.ai.

7. Data Retention

Uploaded design images are retained in storage as long as your account is active. You may request deletion of your data at any time by contacting us. Upon account deletion, all associated images, brand configurations, and personal data will be permanently removed.

8. Content License

By uploading design images to the Service, you grant Carvr LLC a non-exclusive, worldwide, royalty-free license to use, reproduce, modify, display, and distribute the uploaded content for purposes including but not limited to marketing, promotional materials, portfolio showcases, case studies, and social media. If your account is deleted, this license ends for any content not already incorporated into published materials; materials already published (for example, an existing case study) may remain in use. If you do not wish for specific content to be used in this manner, please contact us and we will exclude it.

9. Your Rights (GDPR)

Depending on your location, you have the right to:

  • Access the personal data we hold about you and receive a copy in a portable format
  • Request correction of inaccurate data
  • Request erasure of your account and associated data
  • Request restriction of processing, or object to processing based on legitimate interests
  • Withdraw consent at any time, without affecting prior processing
  • Lodge a complaint with your local data protection supervisory authority

To exercise any of these rights, email support@carvr.ai. We may verify your identity via your account email, and we respond within 30 days.

10. California Privacy Rights (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act, as amended by the CPRA, provides the following disclosures and rights.

Categories of personal information we collect (and have collected in the preceding 12 months):

  • Identifiers: name (if provided) and email address — collected directly from you.
  • Commercial information: subscription plan, purchase and billing records — collected from you and from our payment processor.
  • Internet or other electronic network activity: product usage data, feature interactions, and error logs — collected automatically from your use of the Service.
  • Visual information: email design images you upload — collected directly from you.

We collect these for the business purposes described in Section 2, and disclose them to the service providers listed in Section 5 under contracts limiting their use. We do not sell personal information. We do "share" personal information, as the CCPA/CPRA defines that term, with the advertising partners described in Section 5: identifiers (email address and name, hashed) for audience matching, and internet activity on our website through advertising cookies. We do not knowingly sell or share the personal information of anyone under 16. We do not collect or use sensitive personal information beyond what is necessary to provide the Service.

Your rights: to know/access the personal information we hold, to delete it, to correct it, to opt out of its sharing, and to not be discriminated against for exercising any of these rights.

How to exercise them: to opt out of sharing, email support@carvr.ai with "Do not share my personal information", and we will leave you out of audience matching. For any right, email support@carvr.ai from your account email (or have an authorized agent provide written permission to act for you). We verify requests against the account email and respond within 45 days, extendable once by a further 45 days where reasonably necessary.

11. Figma Plugin Specifics

The Carvr Figma plugin:

  • Reads only the currently selected Figma frame (with your explicit action)
  • Does not modify your Figma files
  • Does not access other files, pages, or projects in your Figma account
  • Stores authentication tokens in Figma's encrypted client storage only
  • Communicates only with the Carvr backend and Google Fonts (no other external services)

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by updating the "Last updated" date at the top of this page.

13. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data rights, please contact us at support@carvr.ai.

© 2026 Carvr LLC. All rights reserved.