Terms of Service

These Terms of Service (the “Terms”) govern access to and use of the Carter AI platform, websites and on-site software (together, the “Service”), provided by Carter AI LLC, a Maryland limited liability company (“Carter AI,” “we” or “us”).

They are an agreement between Carter AI and the business that signs an order form for, or otherwise uses, the Service (“Customer,” “you”). If you accept these Terms for a company, you confirm that you have authority to bind it.

01The Service

What it is. Carter AI provides monitoring and verification software for restaurant operators with more than one location. Depending on the modules you use, the Service connects to systems you already run (such as your Toast point-of-sale account), watches them, and shows you or alerts you to what it finds. Examples include receipt lookup and 86 (out-of-stock) tracking and, where installed, kitchen-ticket timing alerts from a small program at your site (the “on-site agent”).

Business use only. The Service is a business-to-business service. There are no consumer accounts, and you agree to use the Service only for your business operations.

A monitoring aid, not a guarantee. The Service helps your team notice problems. It relies on data and availability from systems we do not control, so it can miss, delay or misreport an event, and an alert may not arrive. You remain responsible for running your restaurants and for decisions you make using what the Service shows you.

No duty to detect. Alerts and findings from the Service are informational only. We do not guarantee that any error, misconfiguration, discrepancy or violation (for example, an incorrect tax rate or setting in a system you run) will be detected or reported, and we have no duty to detect or report any particular issue. The absence of an alert is not confirmation that no issue exists. You remain solely responsible for your own tax, payroll, compliance and operational obligations, whether or not you use the Service.

Not professional advice. Nothing in the Service is tax, legal, accounting or other professional advice. Confirm any finding with your own qualified professional before you act on it.

Changes to the Service. We may add, change or retire features and modules. We will give you reasonable notice before we remove a feature you are paying for.

02Accounts and users

Your organization’s account owner decides who in your organization gets an account, what role each person has, and which locations each person can see. You are responsible for the people you add, for keeping sign-in credentials confidential, and for activity under your accounts. Tell us promptly at support@carterai.io if you believe an account has been used without permission.

Sign-in is handled by a third-party authentication provider (see the subprocessor list in section 04).

03Your data and our access to your systems

Customer Data. “Customer Data” means the data and content that you or your users submit to the Service or that we collect from your connected systems on your behalf. This includes order, menu, scheduling and labor records from your point-of-sale and related systems, telemetry from the on-site agent, and information about your users.

You own it. As between you and us, you own Customer Data. You give us a limited right to access, store, process, display and transmit it only to provide, secure and support the Service for you, and as the law requires.

Authorized, read-only access. We connect to your systems only with credentials or authorization that you provide. Our connections to your point-of-sale data are read-only: we read your records, we do not change them. Where a system has no API, we may sign in with a login you provide; there, read-only is enforced by how our software is built (it has no way to submit changes), not by the rights on the login.

Your authority. You confirm that you have the right to give us that access, including under your agreements with your point-of-sale vendor and any other provider, and that doing so does not breach those agreements. Where a system allows it, provide credentials limited to the read-only access the Service needs.

Revoking access. You can revoke our access at any time, either by revoking the credential in the source system or by telling us at support@carterai.io. We store the system credentials you give us (for example Toast API keys) in encrypted form and use them only to run the Service for you. Service credentials used by our monitoring workers are held in access-restricted configuration on those systems.

Service information. We also collect technical information about how the Service performs, such as uptime, error rates and feature usage. We use it to operate, secure and improve the Service. It does not include the content of Customer Data.

04Data processing

This section sets out how we handle Customer Data. This section is the data processing agreement between us.

Roles. You decide why and how Customer Data is used. We process it on your behalf, on your instructions, to provide the Service. These Terms, your order form and your use of the Service’s settings are your instructions.

What we process.

• Records from your point-of-sale and related systems: orders and checks, menus and item availability, schedules and labor data, and location settings.
• Limited payment details that appear on a check. For receipt lookup, the point-of-sale record can include the card brand, the last four digits and, where your POS provides it, the cardholder name. These are shown to your authorized user and are not stored in our database. They appear in the receipt email your staff send, which our email provider processes (see “Card data” below and the subprocessor list).
• Guest email addresses typed by your staff to send a receipt. We use the address to send that receipt.
• On-site agent telemetry: store and agent identifiers, agent health reports, and kitchen-ticket timing, check number, table, item names, the name of the server on the ticket, and the box’s hostname, read from the kitchen display files.
• Your users: name, email address, role and location access.

Card data. Full card numbers, card security codes and magnetic-stripe data are not accessed by our Service by design: we do not request them, and the point-of-sale data we read does not include them. The on-site agent reads two kitchen-ticket files. In the installations we have inspected they contain no card numbers, and the agent does not parse payment fields. It reads those files without modifying them, opens no inbound connections and sends data outbound only. We are not a payment processor and we do not hold a PCI DSS certification or attestation.

What we do not do. We do not sell Customer Data and we do not use it for advertising. Customer data is separated by account, and we test that separation automatically. No system is perfectly secure.

AI processing. We may use artificial-intelligence tools, including AI models run by our subprocessors (see the list below), to process Customer Data in providing, supporting and securing the Service. Examples include analyzing or summarizing what the Service finds and diagnosing problems. By using the Service you consent to that processing, and you confirm that you have the right to give that consent for the Customer Data you provide or connect. AI output can be wrong or incomplete, and sections 01, 11 and 12 apply to it. The rest of this section 04 applies to Customer Data processed this way.

Subprocessors. You authorize us to use the following subprocessors to deliver the Service.

Subprocessor	Purpose
Vercel	Application hosting and content delivery
Neon	Managed database (primary data store)
Clerk	Authentication and user account management
Resend	Email delivery (receipts, alerts and notification emails)
DigitalOcean	Cloud infrastructure for background monitoring workers and internal operations
Google Workspace	Business email and collaboration; nightly database backup copies are mirrored to Google Drive, kept 14 days
GitHub	Incident tracking for our monitoring workers (issue titles can include a store name)
Anthropic (Claude)	AI engineering and support tooling; may process customer data during diagnostics and support work
Wave	Accounting and invoicing (customer billing contact details once invoicing begins)

Your point-of-sale vendor (for example Toast) is the source of your data and is not our subprocessor. Destinations that you configure yourself, such as a Microsoft Teams channel that receives your alerts, receive data at your direction. We will give notice of a new subprocessor by updating this list and by emailing your account owner at least 15 days before the new subprocessor handles Customer Data. If you object on reasonable grounds, we will work with you in good faith, and you may terminate as described in section 14.

Security. We use reasonable administrative, technical and organizational measures to protect Customer Data. They include role-based and per-location access controls, encrypted connections for data in transit, encrypted storage of the system credentials customers give us (for example Toast API keys), and monitoring of the Service. We do not hold a SOC 2 report or similar third-party certification. No system is perfectly secure, and we cannot guarantee that Customer Data will never be accessed without authorization.

Security incidents. If we learn that Customer Data has been accessed or disclosed without authorization, we will tell your account owner without undue delay and within 72 hours of confirming an incident affecting Customer Data, and give you the information we have that you reasonably need to respond.

Requests about your data. If someone asks us for access to, correction of or deletion of data we hold for you, we will refer them to you where we can, and we will help you respond within reason. People can also write to us at support@carterai.io, and we will reply to data requests there within 30 days.

Data location. Customer Data is stored in the United States.

Return and deletion. We keep Customer Data for as long as you are a customer, according to the retention schedules described in this section. Before termination takes effect you can ask for a copy of your Customer Data in a common format, and you should export anything you need by then. After termination takes effect, we will delete Customer Data from our production systems, and delete the integration credentials you gave us, within 60 days. The exceptions are billing and tax records that the law requires us to keep, and security audit logs, which we keep for 12 months. Copies in backups are deleted as the backups age out, within the same 60 days. Once Customer Data is deleted it cannot be recovered, so export what you need before termination takes effect. You should also revoke the integration credentials at the source. During the relationship, on your written request, we will delete specific Customer Data within 30 days. We may also keep a record that we did business with you.

Retention while you are a customer. A few logs are pruned on a fixed schedule: receipt lookup audit entries and alert delivery logs once they are more than 90 days old, and on-site agent telemetry once it is more than 90 days old (routine health reports after 14 days). Cleanup runs on a rolling basis, so a record can linger a few days. Other monitoring history is kept for as long as you are a customer.

05Acceptable use

You will not, and will not let anyone else:

• use the Service unlawfully, or to access a system or data you do not have the right to access;
• try to access another customer’s data, or probe, scan or test the Service’s security without our written permission;
• interfere with or overload the Service, or bypass its limits or access controls;
• copy, reverse engineer or attempt to extract the source code of the Service, except where the law allows it despite this restriction;
• resell the Service or use it to build a competing product, except under a written reseller or partner agreement with us; or
• install the on-site agent on equipment you do not own or control, or without authority to do so.

We may suspend access if we reasonably believe use of the Service threatens its security or breaks this section. We will tell you why and restore access once the problem is fixed.

06Fees and payment

Fees, the locations and modules covered, and the billing period are set out in your order form or written proposal. Invoices are due net 30 days from the invoice date. Fees exclude taxes, which you are responsible for, other than taxes on our income. Fees are non-refundable except as stated in section 14.

07Availability and support

We run the Service on a best-effort basis. There is no uptime commitment or service level agreement in this version of the Terms, and no credit or refund is owed for downtime. We may take the Service down for maintenance and will try to do so at quiet times.

Support is by email at support@carterai.io. Send the location and what you saw; we will try to answer promptly but do not promise a response time.

08Third-party systems

The Service depends on systems run by others, such as your point-of-sale provider. Their availability, data, rules and changes are outside our control, and a change on their side can affect the Service. Your use of those systems stays subject to your own agreements with them. Product and company names are used only to identify compatibility and belong to their owners.

09Ownership

We own the Service, including its software, design and documentation, and we keep all rights not expressly given to you. During the Term you may use the Service for your internal business operations. You keep ownership of your Customer Data, your trademarks and your logos, and you give us the right to display your name and branding inside your own account where you ask us to.

If you send us suggestions or feedback, we may use them without obligation to you.

10Confidentiality

Each of us may receive the other’s non-public business or technical information. The receiving party will use it only to perform or use the Service, protect it with the care it uses for its own similar information (and no less than reasonable care), and not disclose it except to people who need it and are bound to confidentiality. This does not cover information that is public through no fault of the receiver, was already known to it, was independently developed, or was lawfully received from a third party. A party may disclose information that the law or a legal process requires it to disclose, after giving the other party notice where permitted. Customer Data is also governed by section 04.

11Warranty disclaimer

The Service is provided “as is” and “as available.” To the fullest extent the law allows, Carter AI disclaims all warranties, express or implied, including warranties of merchantability, fitness for a particular purpose, title and non-infringement. Carter AI does not warrant that the Service will be uninterrupted, error-free or secure, that it will detect every problem, or that any alert, figure or report will be accurate, complete or timely.

These disclaimers apply to any claim that the Service failed to detect, report or alert on an error, misconfiguration, discrepancy or violation, or did so late, incompletely or inaccurately.

12Limitation of liability

To the fullest extent the law allows, neither party will be liable to the other for any indirect, incidental, special, consequential or punitive damages, or for lost profits, lost revenue, lost data or loss of goodwill, arising out of or related to these Terms or the Service, even if advised of the possibility.

Those exclusions include, whether the law would call the loss direct or indirect, any under-collected or underpaid taxes, penalties, interest and fines, and any other amount assessed by a tax or other government authority, arising out of or related to the Service, including a failure to detect, report or alert.

Each party’s total liability arising out of or related to these Terms and the Service will not exceed the greater of (a) the fees you paid to Carter AI for the Service in the twelve months before the event that gave rise to the claim and (b) $100.

That limit covers all claims together, however they arise, whether in contract, tort (including negligence), strict liability or otherwise. It expressly includes any claim that the Service failed to detect, report or alert on an error, misconfiguration, discrepancy or violation, or did so late, incompletely or inaccurately. Claims of that kind are not in addition to the limit.

These limits do not apply to liability that the law does not allow to be limited, or to your payment obligations. They apply even if a limited remedy fails of its essential purpose.

13Indemnification

Indemnification runs both ways.

By us. We will defend and indemnify you against third-party claims, and the resulting damages and reasonable costs, alleging that the Service as we provide it infringes that party’s intellectual-property rights. This does not cover claims arising from your data, from systems you connect to the Service, or from use of the Service in breach of these Terms. If such a claim arises, we may modify the Service to be non-infringing, obtain the rights needed, or terminate the affected part and refund prepaid fees for the unused period.

By you. You will defend and indemnify Carter AI against third-party claims, and the resulting damages and reasonable costs, that arise from (a) your use of the Service in breach of these Terms, or (b) a claim that you did not have the right to give us access to a system or to Customer Data as these Terms describe.

The party seeking protection will tell the other promptly of the claim, let the indemnifying party control the defense and settlement (but no settlement may admit fault for the protected party without its consent), and give reasonable help at the indemnifying party’s cost.

14Term and termination

These Terms start when you first use the Service or sign an order form, whichever is first, and continue until the term in your order form ends (or, if none is stated, until either of us terminates them) (the “Term”).

• Either party may terminate for convenience by giving the other 30 days’ written notice, which may be by email.
• Either party may terminate for material breach if the other has not fixed the breach within 30 days of written notice describing it.
• We may suspend or terminate immediately if needed to protect the Service or other customers, or where the law requires.

When the Term ends, your access stops and section 04 (return and deletion) applies: we delete Customer Data within 60 days after termination takes effect, and it cannot be recovered afterwards, so export anything you need before termination takes effect. You owe fees for the period up to termination. If we terminate for convenience, or you terminate because of our uncured breach, we will refund any fees you prepaid for the period after termination. If you terminate for convenience, fees already paid are not refunded. Where your order form includes a minimum term — for example where we build custom monitoring for you with no separate build charge in consideration of that term — terminating for convenience before the minimum term ends does not relieve you of the remaining fees for that term, unless your order form says otherwise. If we terminate for your uncured material breach before the minimum term ends, you likewise owe the remaining fees for that term (less any you have already paid for it), unless your order form says otherwise. Sections that by their nature should survive will survive, including sections 04, 09 to 13, 16 and 17.

15Changes to these Terms

We may update these Terms. For a material change we will email your account owner at least 30 days before it takes effect, and the updated Terms will be posted here with a new effective date. If you do not accept the change, you may terminate by written notice before it takes effect. Termination then takes effect on the date the change would have started, and we will refund any fees you prepaid for the period after that date. Using the Service after the effective date means you accept the updated Terms.

16Governing law

Maryland law governs these Terms and any dispute about them or the Service, without regard to its conflict-of-laws rules. If a dispute arises, each of us will first try in good faith to resolve it informally for at least 30 days after one tells the other in writing. After that, the state and federal courts located in Maryland have exclusive jurisdiction, and each of us consents to their jurisdiction and venue.

17General

• Entire agreement. These Terms, your order form and, where we have signed one, a mutual confidentiality agreement are the whole agreement about the Service and replace earlier discussions about it. If an order form signed by both of us conflicts with these Terms, the order form controls.
• Assignment. You may not assign these Terms without our written consent. We may assign them in a merger, acquisition or sale of substantially all our assets, and will tell you when we do.
• Notices. We may give notice by email to your account owner or by posting in the Service. You may give notice to support@carterai.io.
• Events beyond our control. Neither of us is liable for a delay or failure caused by events beyond reasonable control, such as outages of internet, power, or third-party platforms, natural disasters or labor disputes. This does not excuse a payment obligation.
• Severability and waiver. If a provision is unenforceable, the rest stays in effect. Not enforcing a right is not a waiver of it.
• Independent parties. We are independent contractors. These Terms create no partnership, agency or employment, and no third party has rights under them.

18Contact

Carter AI LLC
Email: support@carterai.io
Mail: 1418 Rowe Drive, Glen Burnie, MD 21061

See also our Privacy Policy.