Carmen

Carmen Privacy Policy

Updated: August 8, 2025

This privacy notice applies to Carmen, a service that enables users to quickly and simply create social media posts, including through the use of Third-Party Models (defined below) and third party image websites (the “Service”). The Service is owned, licensed, and operated by Mozilla Corporation (referred to herein as "we," "us," "our," or "Mozilla").

When we collect, share, and process information about you on Carmen, this Privacy Notice describes how and why we handle that information. Your use of the Service constitutes your acceptance of this privacy notice, which incorporates by reference our Terms of Use.

Things you should know

We collect the following information directly from you when you use the Service:

  • Accounts & Subscriptions. Our website and services require you to create an account. When you create an account, we receive your email address and user name. You may periodically receive emails in connection with your account or through subscriptions. Our email management vendor is SendGrid. You may opt out of any marketing communications at any time by emailing us at carmen@mozilla.com.
  • Communications. When you contact us in connection with the Service, we may also collect personal information, such as your username, name, email address, or phone number, as well as any other personal information you may provide to us.
  • Information We Receive From You Directly: We may receive information about you and/or your business from you directly or information you explicitly consent to provide, such as your name, business location, and information about your business.
  • Inputs and Outputs. The Service is powered by AI models created by third-parties (“Third-Party Models”). It allows you to submit your own content, including website information, text, images, and your voice (“Inputs), retrieve generated content and create and publish blog posts (“Outputs”). We process these Inputs solely to provide you with the Outputs and are not used for training the Third-Party Models. For clarity, your voice inputs are solely used to offer the transcription service and are not stored by us. If you abandon a query or navigate away from a page with the Service in use, all Inputs and Outputs will be discarded by your browser and irretrievably lost.
  • Third-Party Data: If you provide us with links to third-party public websites, such as your website, we will receive the data about you that appears on that page for inclusion in your post. We may receive data about you that has been made public on third-party websites that you link through the Service.
  • Reports. The Service also allows users to report issues or inaccuracies with the Outputs, which are reviewed by human moderators. If we receive a report, we will retain any personal information shared with us in connection with that report for as long as we need to review, adjudicate, and resolve the case, or as otherwise required by law.

We also automatically receive certain information when you interact with the Service:

  • Technical data. We receive basic telemetry data by default, which we use to improve the performance, stability, and security of the Service, including information about your device, including hardware configuration and device operating system; browser information, such as browser type and settings; log files and usage data; and event information, such as errors or crashes. We may also receive additional information about your device, such as country, language, operator and OEM, which we use to prevent fraud and abuse, enforce our terms, and improve the security of the Service.
  • Interaction data. We receive aggregate data about visits to the Service and other aggregate insights about user interactions with the Service. We use this data to better understand usage of the Service, as well as to add, improve, or remove certain features of the Service. We may also receive HTTP referral data to understand the website or domain that referred you to our site, which we only use for purposes of addressing bugs or other technical issues with our Service. We automatically delete this data after 30 days.
  • Metrics. We may also use cookies, device information, and IP addresses, along with clear GIFs, cookies, and third party services to securely operate the Service, help us understand how users engage with our Service, such as visits to our site and settings preferences, and provide additional functionality, including to assist with user-login and authentication to remember that you’ve logged in on your device so you can bypass re-entering your passwords. We use:
    • Sign in with Google, which places a cookie on your device to assist with sign-in and authentication to the Service. When you sign into the Service, you accept the associated Privacy Policy and Terms of Service from Google.
    • Google Analytics to obtain metrics on how users engage with our websites. This helps us to improve site content. For more information about how Google uses your personal information, please visit Google Analytics’ Privacy & Security. You can install the Google Analytics Opt-out Browser Add-on to prevent data collection about your visits to the Service and prohibit data transmission to Google Analytics.

We may also use information about you to find and address violations of our Terms of Use or other policies; investigate suspicious activity; detect, prevent, and combat harmful or unlawful behavior; and otherwise maintain the integrity of our Service.

When do we share your information with others?

  • When we have asked and received your permission to share it.
  • For processing or providing products and services to you, including with third parties. We use third parties to provide the Service to you, and have contracted with these companies requiring them to protect your information (Third-Party Services) :

    • Google Cloud Provider. Google Cloud Provider (GCP) is a cloud-computing platform. We use GCP to facilitate hosting images you upload to the Services.
    • OpenAI. OpenAI is an AI research and deployment company that offers certain LLMs for individual and enterprise use, APIs, and other services. We use OpenAI to generate content for our customer websites through our Service.

    These entities receiving your information are contractually obligated to handle the data in ways that are approved by us.

  • When the law requires it. We follow the law whenever we receive requests about you from a government or related to a lawsuit. We’ll notify you when we’re asked to hand over your personal information in this way unless we’re legally prohibited from doing so. When we receive requests like this, we’ll only release your personal information if we have a good faith belief that the law requires us to do so. Nothing in this policy is intended to limit any legal defenses or objections that you may have to a third party’s request to disclose your information.

  • When we believe it is necessary to prevent harm to you or someone else. We will only share your information in this way if we have a good faith belief that it is reasonably necessary to protect the rights, property or safety of you, our other users, or the public.
  • If our organizational structure or status changes (if we undergo a restructuring, are acquired, or go bankrupt) we may pass your information to a successor or affiliate.

Third Party Sites & Affiliate Marketing

  • Third Party Websites. The Service may contain links to other websites/applications and other websites/applications may reference or link to our Service. These third-party services are not controlled by us. We encourage our users to read the privacy policies of each website and application with which they interact. We do not endorse, screen, or approve, and are not responsible for, the privacy practices or content of such other websites or applications. Providing personal information to third-party websites or applications is at your own risk.
  • Affiliate Marketing. We partner with third-party businesses through affiliate marketing programs (collectively “Marketing Affiliates”) to offer you product and seller alternatives through the Service. As a result, we may earn commissions from our Marketing Affiliates from some of your interactions with our Service including, but not limited to, clicking on links to third-party websites, clicking on advertising links, or purchasing an item. We do not share or sell any of your personal information generated on our Services to our Marketing Affiliates.

Children

The Service is not directed to children under 13 years of age (or the minimum age we can process your information without parental consent in your province or country), and we do not knowingly collect or solicit personal information from children. If we obtain actual knowledge that we’ve collected personal information from a child under the age of 13 (or minimum age of consent in your province or country), we will delete that information as soon as possible, unless we have a legal obligation to keep it. If you are a parent or guardian and believe your child has uploaded personal information to the Services without your consent, you may contact us as described in “How to Contact Us” below.

Account Information

If you would at any time like to review or change the information in your account or terminate your account with the Service, you can login to your Carmen account:

  • To delete your account, go to Profile settings and click “Delete account”.
  • If you are unable to login to delete your account or change your email address, you can contact us at carmen@mozilla.com.

Upon your request to terminate your account, we will deactivate or delete your account and information from our active databases. We may retain some information in our files to prevent fraud, assist with any investigations, enforce our legal terms, and/or comply with applicable recordkeeping and other legal requirements.

How to Contact Us

To make requests regarding your personal information, please contact us through our Data Subject Access Request Portal. If you have any other questions regarding personal information or our privacy practices, please contact us at compliance@mozilla.com. We respond to all requests we receive from individuals wishing to exercise their rights in accordance with applicable laws.

Supplemental Information for users in Specific Regions

Some regions have data protection laws that require us to specify the following:

Our Privacy Notice describes the purposes for which we process information about you and the categories of information we process. We do not sell personal data.

Our lawful bases for collecting and processing personal information include:

  • Legitimate interests. As described in this Privacy Notice, we also receive technical and interaction data of users, which may include IP addresses, and certain metrics to improve the security and reliability of our services, prevent fraud and abuse, log and address technical problems, and enforce our Terms of Service and Acceptable Use Policy.
  • Consent. Where we ask for your consent to process your information, you can always withdraw this consent.

The following rights are granted by certain laws such as the General Data Protection Regulation ("GDPR") in the EU and the California Consumer Privacy Act ("CCPA") in California:

  • The right to know what personal data is collected
  • The right to know if personal data is being shared, and with whom
  • The right to access your personal data
  • The right to exinercise your privacy rights without being discriminated against

Contact Us

In many cases, you can access, update, or delete your personal information directly from our product settings.

To make requests regarding your personal data, please contact us through our Data Subject Access Request Portal. If you have any other questions regarding personal data or our privacy practices, please contact us at dpo@mozilla.com, or you can contact our DPO by mail at:

Bird & Bird DPO Services SRL
Avenue Louise 235 b 1
1050 Brussels
Belgium

We respond to all requests we receive from individuals wishing to exercise their data protection rights in accordance with applicable data protection laws. You also have the right to lodge a complaint with your local data protection authority.