Privacy
How we use personal data, how long we keep it and your rights.
Doing something about it
Two of your rights are buttons rather than requests. The rest open a case with a deadline.
Who is responsible for your information
The data controller is MZ Corp Limited, trading as Carqo. Company number 17351738.
Our registered office is 128 City Road, London, EC1V 2NX.
Our ICO registration number is ZC208622.
What this notice covers
It covers information you provide, information generated when you use Carqo, and public information used for reports.
The earlier join-the-list form
This form was on an earlier version of the Carqo site. It is closed and takes no new registrations. We deleted what it collected on 23 September 2026. What follows is what that form would keep, and for how long, wherever it is switched on.
The earlier join-the-list form
To tell you when Carqo opens. The form is closed and takes no new registrations.
Your consent. This is optional.
24 months from signing up, or the moment you unsubscribe.
Data and sharing
- Personal data
- name, email address, phone number, the first part of your postcode, the link you arrived from, the exact consent wording you agreed to, and when.
- Also shared with
- Email delivery services
- Deletion
- a limited address record stays so a later import cannot bring you back.
- Your choices
- Unsubscribe from any email. Ask us to delete it at any time.
Confirming your email address
So that nobody can add somebody else’s address to the list.
Your consent. This is optional.
The token expires in hours and is deleted once used.
Data and sharing
- Personal data
- email address, a single-use token.
- Also shared with
- Email delivery services
Giving us any of this is optional. There is no contract and no legal obligation behind it, nothing on the site is withheld from you for declining, and the only consequence of not giving it is that we cannot tell you when we open.
The exact sentence you agreed to is stored word for word alongside your signup, so what we say you agreed to is what you were actually shown. A later edit to this page cannot rewrite it.
The free AI visibility report
We use your website, business name and email. We read the public page title and description, and the town or region in a local business’s address details, to prepare four report questions. A model reads that text to choose the kind of business, from a fixed list. It also lists the businesses the answers named.
An AI answer collection service sends the questions to ChatGPT and Gemini and searches Google for them. The questions may identify a sole trader.
The free AI visibility report
To show whether ChatGPT, Gemini and Google AI Overviews mention your business when customers ask, which websites they rely on, and what to fix.
Our legitimate interests. Answering the report the visitor asked for, and stopping one address running reports in volume.
Deleted 30 days after it was made, with the email held on it. Anyone with your report link can read it until then.
Data and sharing
- Personal data
- your website, business name and email address, the public page title and description, the town or region on the home page, and up to five rival websites if you add them, four questions built from those, which can identify a sole trader, the answers ChatGPT, Gemini and Google gave, which can name other businesses, with the addresses of their sources, the addresses of up to 25 pages of your website, read only where its robots.txt allows, and the problems found, with the page text dropped, the kind of business and the business names a model picked out of the answers, which can name people.
- Also shared with
- AI answer collection services, Email delivery services, AI model providers
- Automated decisions
- It helps, a person or a fixed rule decides. A model is involved, within the limits in the AI section.
- Your choices
- Ask us to delete a report before its time is up.
Marketing email after a free report
To email a business about Carqo, once a few days after its free report, only if it ticked the box asking us to. We email only an address on the website’s own domain.
Your consent. This is optional.
Kept for 1 year from the latest report, then deleted. The stop link in the email deletes it at once.
Data and sharing
- Personal data
- email address, business name and website, when we emailed, and a record that lets a stop link be honoured.
- Also shared with
- Email delivery services
- Your choices
- Press the stop link in any email. Turn marketing off in your Carqo account.
Confirming your email address for a free report
To check that the address typed into the form is the sender’s, with a code or a link in an email, and that a person and not an automated program is starting the report.
Our legitimate interests. Making sure a report starts only for an address whose owner asked for it, and stopping automated programs from starting reports.
The request is deleted about an hour after the form is sent, whether or not it was confirmed.
Data and sharing
- Personal data
- email address, business name, website and marketing choice, held as one request, a six-digit code and a link sent to the address, browser details read by a challenge on the page, which our website delivery service checks and we do not store, your place in the form, kept only in your browser for the session.
- Also shared with
- Email delivery services
Reading a business website
We read public business website pages and keep findings, page addresses and short extracts. Public pages can contain names or other personal data. We follow the website’s crawler restrictions.
The free AI readiness check is the exception. It reads the website you type, shows the result in your browser and keeps neither the address nor the result.
Scanning a business website
To report how well automated systems can read a business’s own website.
Our legitimate interests. Telling a business how machine-readable its published website is, at its own request.
Kept while the site is a live prospect or a customer, then deleted with the site record. Page extracts are capped at 200 characters each.
Data and sharing
- Personal data
- the website address, the facts the business published such as what it offers, prices and locations, and short extracts of page text with contact details and full postcodes removed.
- Your choices
- Ask us to delete a scan of your website.
Reading the public pages of a website you have verified
To record what is on a business’s own public pages, so it can see what automated readers get and whether it changes. It also reads the front page when it asks that business’s questions, so an answer can be compared with the page as it stood.
Our legitimate interests. Reading the public pages of a website at the recorded request of the business that proved it controls the domain, and reporting back what was found.
Each page read, and the findings about it, is kept for 1 year from the day it was read, so one scan can be compared with the next. The scan record is kept for 3 years. It holds who asked, under which permission, the limits that applied, the addresses found along the way and any finding about the website as a whole. The permission, and the proof of control behind it, are kept until the website is deleted. A job that removes whatever is past its period runs once a day wherever scheduled jobs are switched on.
Data and sharing
- Personal data
- the website address, the parts of it you approved, who approved them and when, the record name and one-time token you published to prove you control the domain, the address of each page read and of each redirect it passed through, as they were requested, what each request returned, the type and size of the response, how long it took, and the last-modified date the site claimed, whether a page asked not to be indexed, and what the site’s robots rules said about it, page titles, with registration-style codes, telephone numbers, email addresses and full postcodes removed before storage, short extracts of page text of up to 200 characters, such as headings and the canonical and robots tags, with the same things removed, the addresses Carqo found along the way, and the last error from any that failed, a one-way hash of the visible text, which cannot be turned back into the text.
- Deletion
- Deleting the website removes all of it at once, in full, apart from the business domain. Disconnecting stops any further reading and keeps what was read until its period ends. The address of a page is stored as it is, so an address that holds a name is stored with it.
- Your choices
- Disconnect a website. Delete a website and everything recorded about it, apart from the business domain.
Reading what your own pages say about your business
To record the facts a business publishes about itself on its own site, so that machine-readable representations say the same thing the business already says.
Our legitimate interests. Reading the public pages of a website at the recorded request of the business that proved it controls the domain, and recording what those pages already say so it can be represented accurately.
What each page said is kept until the website is deleted, so one read can be compared with the next. The record of each read, which pages were fetched and what could not be read, is kept for 1 year.
Data and sharing
- Personal data
- the address of each page read, and what the request returned, the names the pages give the business, which can be a sole trader’s own name, and a legal name where one is stated, a VAT number, a street address, a postcode, a town, a country and map coordinates, where the pages state them, the contact details the pages publish, which on a small business site can be a personal telephone number or email address, what the business offers, with its descriptions, products and services, prices, availability and stock levels, and the date it says it was founded, page titles, kept as they are written, and the address and the caption or alt text of each image, but never the image itself, facts read from a PDF or spreadsheet that a page links to, where on the page each fact was found, and a one-way hash of the visible text, the validators the server returned, so the next read can ask whether anything changed.
- Deletion
- Deleting the website removes all of it, immediately and in full, apart from the business domain. Disconnecting stops Carqo reading, and the facts stop being used. A contact number on a small business site is stored exactly as the page publishes it.
- Your choices
- Disconnect a website, which stops any further reading. Delete a website and everything recorded about it, apart from the business domain. See every fact Carqo read and where on your site it came from.
Asking Carqo to check your website
To reply to you with what the check found, and to talk to you about it.
Our legitimate interests. Replying to a business that asked for a report about its own website. This is optional.
Kept while you are a prospect or a customer, and deleted when the enquiry is closed.
Data and sharing
- Personal data
- business name, your name, email address, and the website address and phone number where you give them.
Checking what Carqo read, and auditing pages you name
To tell a business what is wrong or missing on its own website for machines, and what to change.
Our legitimate interests. Telling a business, at its own request, what is wrong with its own published pages, using only what Carqo has read from them. This is optional.
Findings are kept for 1 year, with the read they were made from. A page audit and what it found are kept until the website is deleted.
Data and sharing
- Personal data
- findings about a page or about the whole website, with short extracts of what the page said as evidence, for a page audit, the addresses you asked for and what Carqo found on each, what each finding means and what to change.
- Deletion
- Deleting the website removes all of it at once, in full, apart from the business domain.
- Your choices
- Ask for an audit of only the pages you choose. Delete the website and everything recorded about it, apart from the business domain.
Auditing public pages during paid onboarding
To audit the public pages of the website you add, on your recorded instruction, and show findings with their evidence.
Our legitimate interests. Auditing a business website at the recorded request of the customer who added it. Carqo keeps to robots.txt and limits the evidence it stores. This is optional.
The audit, instruction and coverage record stay until the website is deleted. Read evidence is kept for 1 year.
Data and sharing
- Personal data
- the requesting account reference, recorded instruction, wording version, website scope and request time, discovered public addresses, request outcomes, crawl progress, redirects, byte counts and reasons content could not be checked, page titles and declared organisation names, which may contain personal names, metadata observations and structured-data summaries, supported document extraction results and audit findings, with their source page addresses and read references.
- Deletion
- Deleting the website removes its audit and coverage records. Stopping the audit revokes its instruction and stops subsequent requests.
- Your choices
- Stop the audit. See unread URLs and limitations. Delete the website and its records.
Reading the public pages of your website when you add it
To read the public pages of the website you add, as soon as you add it, so your workspace does not start empty. To suggest an area and first questions from what those pages say, for you to confirm.
Our legitimate interests. Starting a customer’s workspace from what their website already says, at their recorded request. Carqo keeps to robots.txt, one request a second and a page limit set by the plan. This is optional.
The instruction and the coverage record stay until the website is deleted. Read evidence is kept for 1 year.
Data and sharing
- Personal data
- the account that added the website, the sentence it saw, the version of that sentence, the website scope and the time, every public address found on the website, and whether each was read. Also how each responded, its size and why a page could not be read, page titles, headings and declared organisation names, which may contain personal names, and the metadata and structured data on the page, supported document extraction results and findings, each with its source page address, a draft of the business name, the services and towns its pages declare, and its contact page addresses. Each item names the page it came from. The draft is built when a set-up step is shown and is not stored, the areas and questions you choose from that draft on the set-up steps, which are saved only when you submit the step.
- Deletion
- Deleting the website removes its crawl and coverage records. Stopping the audit revokes the instruction and ends every later request.
- Your choices
- Stop the audit. See unread addresses and limitations. Delete the website and its records.
The free AI readiness check
To read the robots.txt file, home page and one sitemap of the website you type, and show the result in your browser.
Our legitimate interests. Giving a visitor the check they asked for, and limiting how often one caller can use it. This is optional.
We keep neither the address you typed nor the result. The record of your network address is removed within two days.
Data and sharing
- Personal data
- a limited record of your network address, with a count and times, to limit use.
Asking AI assistants about your business
A business sets up questions, such as the ones its customers might ask an AI assistant. Carqo can ask them on a schedule and keeps each answer, the sources it cited and the businesses it named. For a paying business or a business on a free trial Carqo can also send the questions to our AI answer collection service. Our AI answer collection service puts them to ChatGPT and Gemini, searches Google for them, and returns their answers.
The questions a business sets up about itself
To keep the questions a business wants asked of AI assistants, where each is asked and how often.
To provide what you asked for. This is optional.
Kept until the website is deleted. A question you retire is kept with the wording it had, because it is the label on the answers it produced.
Data and sharing
- Personal data
- the text of each question, which is free text and can name a person, the country a question is asked in, a town where you chose one, the language, and the timezone of its schedule, when the questions are asked, and how often, the name your own business goes by in answers, and any other names it is known by, who set a question up or changed it, and when.
- Deletion
- Deleting the website removes the questions at once, in full.
- Your choices
- Retire a question, which stops it being asked. Delete the website and everything recorded about it, apart from the business domain.
The answers AI assistants give about a business
To show a business what AI assistants say about it, which sources they cite and which businesses they name.
Our legitimate interests. Showing a business what AI assistants say about it. An answer can name other people and businesses, so Carqo keeps it as it came back, adds nothing to it and deletes it after 2 years. This is optional.
Kept for 2 years from the run that produced it, then deleted with everything worked out from it. A run that a saved summary still covers is kept until that summary’s own period ends. Where a pasted answer also records who it named instead and the website it linked to, those are kept until the workspace is deleted.
Data and sharing
- Personal data
- what is sent to an AI model provider when Carqo asks a question for you, which is the question, the country, a town where you chose one, and the timezone of the schedule, the answer as it came back, the sources it cited and the businesses it mentioned, kept as they arrived and never edited, the name of the model that answered, how much text it handled and what the call cost, for an answer a person pastes in, the wording they pasted, the date they gave, which assistant they say it came from, who pasted it, whether it named the business, who it named instead and the website it linked to, what Carqo worked out from an answer by fixed rules, such as whether and how a business was named.
- Also shared with
- AI model providers
- Deletion
- Deleting the website removes the answers, and what was worked out from them, at once. An answer is kept as it came back, so a name inside it cannot be taken out on its own. Nothing is sent to an AI model provider unless collection has been switched on.
- Automated decisions
- No. A model is involved, within the limits in the AI section.
- Your choices
- Retire a question, which stops it being asked. Delete the website and everything recorded about it, apart from the business domain.
The other businesses you ask Carqo to watch for
To show how often each business you watch was named in the same answers as yours.
Our legitimate interests. Letting a business see which other businesses AI assistants name beside it, using only names the business chose or that an answer already mentioned. This is optional.
Kept until the website is deleted.
Data and sharing
- Personal data
- the names of other businesses you add, and the other names they go by, where Automatic tracking is switched on, the names of businesses an answer mentioned, as the answer wrote them, your decision about each suggested name, whether you added, ignored, blocked or merged it, and who decided.
- Deletion
- Deleting the website removes them at once, in full. If you erase your account, your name comes off the decisions you made, and the decisions stay.
- Automated decisions
- It helps, a person or a fixed rule decides.
- Your choices
- Leave Automatic tracking switched off, which is how it starts. Remove a business from the list. Delete the website and everything recorded about it, apart from the business domain.
Sharing a one-page summary by link
So a business owner can show somebody one page of their AI figures without giving them an account.
To provide what you asked for. This is optional.
The row stays until the website is deleted. A link stops working when it ends or is switched off. Each lasts about a month, and never more than three months.
Data and sharing
- Personal data
- a random link code, stored as it appears in the link, the dates the link was made, ends and, if it was switched off, was revoked, which workspace and website it belongs to.
- Deletion
- The owner can switch a link off at any time. Deleting the website deletes its links.
- Your choices
- Switch a link off.
Asking ChatGPT about your business through our AI answer collection service
To show a paying business or a business on a free trial what ChatGPT says about it, and which sources, searches and compared businesses it names.
Our legitimate interests. Showing a business what AI assistants say about it. An answer can name other people and businesses, so Carqo keeps it as it came back, adds nothing to it and deletes it after 2 years. This is optional.
Kept for 2 years from the run that produced it, then deleted with everything worked out from it. A run that a saved summary still covers is kept until that summary’s own period ends.
Data and sharing
- Personal data
- the questions Carqo sends to our AI answer collection service for you, which puts them to ChatGPT. They are built from your question set and from what you wrote about your business, which can include your business name and the towns you serve, the United Kingdom as the place each question is asked in, a town where you chose one, and the language, each answer as it came back, the sources it cited, the searches ChatGPT ran and the businesses it mentioned, with the full record our AI answer collection service returned for it, kept as it arrived and never edited, which of the businesses you compare yourself with an answer named, found by fixed rules and not by a person or a model.
- Also shared with
- AI answer collection services
- Deletion
- Deleting the website removes the answers, and what was worked out from them, at once. An answer is kept as it came back, so a name inside it cannot be taken out on its own.
- Your choices
- Delete the website and its records. Ask for correction, access or erasure through the Privacy Centre.
Asking AI assistants about your business when you add your website
To show a new customer what ChatGPT and Gemini say about the business by name. This includes the sources and businesses they name, so the workspace does not start empty.
Our legitimate interests. Showing a new customer what AI assistants say about their business, at their recorded request when they add their website. An answer can name other people and businesses. Carqo keeps it as it came back, adds nothing to it and deletes it after the period below. This is optional.
Kept for 2 years from the run that produced it, then deleted with everything worked out from it.
Data and sharing
- Personal data
- a fixed set of questions about your business, built from the business name you entered and your website address, and nothing else you wrote, each answer as it came back, with the sources it cited and the businesses it mentioned. We keep the full record our AI answer collection service returns, as it arrived and never edited, which businesses an answer names besides yours, found by fixed rules and offered to you as suggestions to confirm or ignore, whether each answer was collected, so a failure is recorded as not collected and never as nothing said.
- Also shared with
- AI answer collection services
- Deletion
- Deleting the website removes the answers, and what was worked out from them, at once. An answer is kept as it came back, so a name inside it cannot be taken out on its own.
- Your choices
- Stop the audit. Delete the website and its records. Ask for correction, access or erasure through the Privacy Centre.
Using your free report answers in your first audit
To start your first audit from the answers your free AI visibility report already collected for the same website. Each question is then asked once.
To provide what you asked for. This is optional.
Each copy is kept for 2 years from the audit that took it, like any other answer in your workspace. The free report itself is deleted after 30 days as before.
Data and sharing
- Personal data
- the free report you ran with the same email address and the same website, only while the report is still kept, the questions that report asked, the answers it collected from ChatGPT and Gemini and the sources those answers cited, the date the report collected each answer, which stays the date shown on the answer, the report reference, kept with each answer so it can be traced back to the report.
- Deletion
- Deleting the website removes the copied answers and what was worked out from them. A copy is not changed when the free report is deleted.
- Your choices
- Stop the audit. Delete the website and its records. Ask for correction, access or erasure through the Privacy Centre.
Asking Gemini about your business through our AI answer collection service
To show a paying business or a business on a free trial what Gemini says about it, and which sources and compared businesses it names.
Our legitimate interests. Showing a business what AI assistants say about it. An answer can name other people and businesses. Carqo keeps it as it came back, adds nothing to it and deletes it after 2 years. This is optional.
Kept for 2 years from the run that produced it, then deleted with everything worked out from it. A run that a saved summary still covers is kept until that summary’s own period ends.
Data and sharing
- Personal data
- the questions Carqo sends to our AI answer collection service for you, which puts them to Gemini. They are built from your question set and what you wrote about your business. That can include your business name and the towns you serve, the United Kingdom as the place each question is asked in, a town where you chose one, and the language, each answer as it came back, with the sources it cited and the businesses it mentioned. We keep the full record our AI answer collection service returned, as it arrived and never edited, which of the businesses you compare yourself with an answer named, found by fixed rules and not by a person or a model.
- Also shared with
- AI answer collection services
- Deletion
- Deleting the website removes the answers, and what was worked out from them, at once. An answer is kept as it came back, so a name inside it cannot be taken out on its own.
- Your choices
- Delete the website and its records. Ask for correction, access or erasure through the Privacy Centre.
The website you say a business you compare with uses
To show which sources an AI answer cited when it named a business you compare with and left you out. To mark the ones on the website you gave for that business.
Our legitimate interests. Letting a business see which sources AI answers cite when they name a business it compares with, using only an address the business typed. This is optional.
Kept until the compared business, its question set or the website is deleted. Removing the website you typed keeps a dated record that it was removed.
Data and sharing
- Personal data
- the website address you type for a business you compare with, as a domain only, and each time you add, change or remove it, who typed it and when. It is your statement and not a check that the business owns the website, which cited sources in a recorded answer match that domain, worked out by comparing text. Carqo does not visit the website.
- Deletion
- Deleting the website, the question set or the compared business deletes the addresses and their history. The person who typed one is cleared if that person is erased.
- Your choices
- Remove the website you typed for a business. Stop comparing with the business.
Checking what an answer says about your contact details, opening times and trading status
To check what an AI assistant said about your business against your own website and what you told Carqo. To show you where they differ.
Our legitimate interests. Letting a business see where an AI answer contradicts what it has published, using only its own website facts and what it typed in. This is optional.
A check goes with the answer it is about, which is kept for 2 years from its run. A trading status or service you type in is kept until you withdraw it or the website is deleted.
Data and sharing
- Personal data
- a telephone number, street address, postcode, opening time, service or trading statement found in a recorded answer, with where in the answer it was, a star rating or review count an answer states about your business on Google, with the answer’s date. It is listed when you open the reviews screen. Nothing from Google is compared with it or stored, and nothing is kept for it, which fact of yours each statement was checked against, by reference only, and whether it agreed, differed or could not be checked and why, a trading status, or a service you do not offer, that you type in. We keep the date you say it began and the date you told us.
- Deletion
- Withdrawing an input deletes it and the checks that rested on it. Deleting the website deletes its inputs and checks. A fact erased from your website record stops being used and its checks are removed. The value is not copied into a check.
- Your choices
- Withdraw a trading status or service you typed in. Delete the website and everything recorded about it, apart from the business domain.
Your business name in the words an AI tool searched for
To show whether the words an AI tool searched for, behind a recorded answer, contained a name your business goes by.
Our legitimate interests. Letting a business see whether an AI tool already searched for it by name, using the names it gave and searches the tool itself reported. This is optional.
Nothing new is stored. The result is worked out each time the page is read, from the answer and the names, and goes when they go.
Data and sharing
- Personal data
- whether a search an AI tool reported contained a name your business goes by, worked out by comparing text with the names you gave, the names you gave for your business, and the names you said are not yours, read to do the comparison and not copied.
- Deletion
- Nothing is kept apart from the answer and the names, which are deleted as they are today.
- Your choices
- Change or remove the other names your business goes by.
Your business locations
To keep each place and its questions apart. Each place shows only its own answers.
Our legitimate interests. Keeping a business’s own places and the answers about them apart. This is optional.
Kept with your website until you delete it. Archiving keeps past answers but stops new checks for that place.
Data and sharing
- Personal data
- the place name and business name you give us, and which questions belong to that place, the saved place record you choose, if any. It may lead to a sole trader’s address or phone number you already hold here, who added a place, when they did so, and when it was archived.
- Deletion
- Delete the website to remove its places and links. Erasing a person removes who added a place. Erasing a saved place record removes its link.
- Your choices
- Archive a place. Delete the website. Ask for a copy or removal.
Sharing a frozen dashboard
Let an authorised member share selected aggregate figures and their exact scope, with an optional password. Other compared businesses are not named in the snapshot.
To provide what you asked for. This is optional.
The snapshot follows its report-share row and stays until the website or workspace is deleted. Access ends at the existing link expiry or when revoked. Password verification uses the existing durable limiter and its cleanup. No guest session or visitor history is added.
Data and sharing
- Personal data
- a frozen aggregate dashboard, collection mode, dates, filter wording and chosen widgets, a digest of a random link token, a salted scrypt password hash when requested, and link dates, which workspace and website own the link, and short-lived per-link verification counters.
- Deletion
- An Analyst or manager can revoke a link. Deleting the website or workspace deletes its snapshot, password hash and link record.
- Your choices
- Preview the selected figures before creating a link. Use an optional password. Revoke a link without needing payment or completed setup. Delete the website or workspace.
Your record of business listings
To keep your own record beside the sites AI answers linked to. Carqo does not check that you are listed.
Our legitimate interests. Letting a business keep its own notes beside the sites AI answers linked to. This is optional.
Until you clear it or delete your website. A blank record stays until you delete the website.
Data and sharing
- Personal data
- your website, the site AI linked to, your choice and your listing link. Carqo does not open the address, when someone in your business saved the record, and who they were. Your business link may show a person’s name, a blank record after you clear a link. It keeps no link or name. It stops an old tab from bringing the link back.
- Deletion
- Clearing takes out the link and who saved it. Deleting the website or workspace removes the record. Erasing a person takes their name off the record.
- Your choices
- Change or clear the business record. Delete the website and its records.
Asking Google AI Overviews about your business through our AI answer collection service
To show a paying business or a business on a free trial what the Google AI Overview says about it, and which sources and compared businesses it names.
Our legitimate interests. Showing a business what Google says about it. An overview can name other people and businesses. Carqo keeps it as it came back, adds nothing to it and deletes it after 2 years. This is optional.
Kept for 2 years from the run that produced it, then deleted with everything worked out from it. A run that a saved summary still covers is kept until that summary’s own period ends.
Data and sharing
- Personal data
- the questions Carqo sends to our AI answer collection service for you, which searches Google for each one. They are built from your question set and what you wrote about your business. That can include your business name and the towns you serve, the United Kingdom as the place each question is searched from, a town where you chose one, and the language, the AI Overview Google showed for each question, as it came back, with the sources it listed and the businesses it mentioned. Where Google showed no overview, we record that and nothing else, which of the businesses you compare yourself with an overview named, found by fixed rules and not by a person or a model.
- Also shared with
- AI answer collection services
- Deletion
- Deleting the website removes the answers, and what was worked out from them, at once. An answer is kept as it came back, so a name inside it cannot be taken out on its own.
- Your choices
- Delete the website and its records. Ask for correction, access or erasure through the Privacy Centre.
Your mark on a statement an AI answer made about your business
To keep your mark on what an AI answer said about you. To show that mark to you on the Brand facts screen.
To provide what you asked for. This is optional.
A mark goes with the statement it is about, which is kept with its answer for 2 years from its run. A newer mark on the same statement replaces the older one.
Data and sharing
- Personal data
- if you said a statement is right or wrong, and when, which statement and website the mark is for, by their IDs only. The words of the statement are not copied.
- Deletion
- Deleting the website or the workspace deletes the marks. The statement and the AI answer it came from are not changed or removed when you mark them.
- Your choices
- Only a person who can change the workspace can mark a statement. Delete the website and everything recorded about it, apart from the business domain.
A question is free text. Nothing stops somebody typing a name into one, and an answer can name people as well as businesses. We keep an answer exactly as it came back and never edit it.
A person can also paste in an answer they saw. We record who pasted it, the date they gave and the words they gave. We do not check that an assistant said it.
Answers and what is worked out from them are kept for 2 years from the run. Deleting the website deletes the questions at once.
An owner can make a link to a one-page summary of the website’s AI figures, to show somebody who has no account. Anyone who has the link can read that page until it ends or the owner switches it off. It shows the business name, the website address and the same figures the owner sees on Home, and no person, email address or question. The link code is stored as it appears in the link, so anyone who can read our database could read it too.
Server logs a business uploads
A web server records every request it answers. A business can give Carqo that log, or its content network can send it, so Carqo can tell crawlers from people and see where visitors came from.
Server logs a business uploads
To show a business which AI crawlers and assistants reached its own website, and whether anybody arrived from an AI answer.
Our legitimate interests. Showing a business which AI crawlers reached its own website, using logs it chose to upload, without keeping a visitor’s address in a column of its own. This is optional.
395 days after the end of the period a log covers, then deleted. What survives are counts with no visitor code, no path and no address in them.
Data and sharing
- Personal data
- for each request in a log, the time, the page path without its query string, the method, the response status and size, and the browser or crawler details the request gave, where the request came from, as the host of a referring site or the name of an assistant, a keyed one-way code made from the network address and those browser details, so one visitor counts as one session, a second one-way code on each request, made from the request’s own details including the address, so the same line is not counted twice., the address itself is not kept in a column of its own, the label you give an upload, a checksum of the file and the period it covers, who uploaded it, and when.
- Deletion
- Deleting the website removes the logs at once. Both codes are still personal data, so they go on the same period as the log they came from. We cannot tell one person from another from a log, and we never count people.
- Your choices
- Upload only the logs you choose to. Delete the website and everything recorded about it, apart from the business domain.
The visitors in a log never dealt with Carqo. We cannot tell one person from another from it and we never count people. We count requests and sessions.
Content you write and save
The writer lets a business save drafts for its own website, such as questions and answers, a service page or an article. We keep what you write, your notes on where it came from and earlier saved versions of each draft.
Your saved content drafts
To keep the content you write for your website, with saved versions and your review dates.
To provide what you asked for. This is optional.
Until the draft, website or workspace is deleted. Up to 20 saved versions are kept for each draft. A deleted draft leaves only its random id behind, to refuse an old save retry, until the website or workspace is deleted.
Data and sharing
- Personal data
- the text you write, with a title and the kind of page it is for, which can name other people, the question a draft answers and your notes on where it came from, saved versions, with the dates they were saved and marked reviewed.
- Deletion
- Delete a draft to remove its text and all its saved versions. Website and workspace deletion removes all their drafts.
- Your choices
- Edit, download or delete saved drafts. Request a scoped personal data review through the Privacy Centre.
People in your workspace whose role allows it can read, download and change a draft. Nothing in a draft is published, Carqo writes nothing to your website and no model reads a draft.
Your business knowledge base
A business can add reference text about itself, with its source and a review date. It can also upload a text, Markdown or PDF file. We keep the text we read from the file and not the file.
Your private business knowledge base
To keep the reference material you add about your business, with its sources and review history.
To provide what you asked for. This is optional.
Until the record, website or workspace is deleted. Up to 20 revisions are kept for each record. A deleted record leaves only its random id behind, to stop an old retry bringing it back, until the website or workspace is deleted.
Data and sharing
- Personal data
- business reference text, which can include public business contact details such as an address, phone number or email, text read from an uploaded TXT, Markdown or PDF file, and a one-way code of the file, but not the file, text suggested from pages Carqo has already read on your website, kept only if you add it, source links and filenames, review dates and revision history.
- Deletion
- Delete the record and all its revisions. Website and workspace deletion removes their entire knowledge base.
- Your choices
- Edit or delete records. Export the selected website knowledge base. Ask for correction, access or erasure through the Privacy Centre.
Contact details in this text can identify people, so add public business details only. Nothing in the knowledge base is published, Carqo writes nothing to your website and no model receives it.
Writing to us, and your requests
You can write to us without an account. Where you are signed in, the case is attached to your account and to the workspace it is about.
Writing to us, and support cases
To answer you when you write to us or open a case, and to keep a record of what was asked and answered.
Our legitimate interests. Answering the person who wrote to us, and keeping a record of what was asked and answered, which protects them as much as it protects us. This is optional.
No period has been decided for an ordinary case. A case is kept until you ask us to delete it or the workspace it belongs to is deleted, and nothing deletes one automatically. A snapshot you attach is kept for 180 days. The one exception is a demo request, which has its own entry and period.
Data and sharing
- Personal data
- the address you wrote from, the subject and what you wrote, with any credential in it blanked, which workspace and website the case is about, where there is one, an image or a text log you attach, which is kept as a file, a snapshot of your workspace’s state that you choose to attach, built from states, counts and times and never page content, what we replied, and notes our own staff made.
- Also shared with
- Email delivery services, File storage services
- Deletion
- If you erase your account, the address on your cases is replaced, what you wrote is removed and your files are deleted. The case itself stays, so we can say what was asked. Image attachments are rebuilt from their pixels when you upload them, so the location a phone wrote into the file is gone.
- Your choices
- Ask us to delete a case. Ask for a copy of what we hold about you.
A request about your information, or a complaint
To answer a request you make about your information, and to show we answered it on time.
The law requires it. This is optional.
A request that is still open is kept until it is closed. The periods after we close it are in the entry for how long we keep a privacy request. We keep it so we can show it was answered in time.
Data and sharing
- Personal data
- the kind of request, and what you wrote, the part of Carqo it is about, where you say, the address to reply to, or your account where you were signed in, when it arrived, the date it is due, and what we did about it and who did it.
- Also shared with
- Email delivery services
- Deletion
- A daily job removes a closed request made through the privacy rights form, as the entry for how long we keep a privacy request says. An open request is never removed. A message sent through the contact form is a support case. Nothing deletes a support case automatically, except a demo request.
- Your choices
- Complain to the ICO whether or not you complain to us first.
How long we keep a privacy request
To delete what you wrote once we no longer need it, and to keep only the record that we answered.
The law requires it. This is optional.
What you wrote, your address and our reply are removed 365 days after we close the request. The reference, the kind of request, the part of Carqo it was about, the dates, how it ended, any legal ground for refusing it, the account it was linked to and who handled it are deleted after 6 years.
Data and sharing
- Personal data
- the same details as a request about your information, made through the privacy rights form.
- Deletion
- Removed by a daily job. A request still open is never removed. This covers a request made through the privacy rights form. A message sent through the contact form is a support case. Nothing deletes a support case automatically, except a demo request.
Support answers are written by fixed rules from our help articles and the state of your workspace, and a person picks up what the rules cannot answer. No model writes a support answer.
Ask Carqo writes every answer by fixed rules from what Carqo already holds, except in a free account. In a free account a model writes a short answer from your report, and Carqo checks it before you see it. When the model is not available or fails that check, fixed rules write the answer instead. Outside a free account, it keeps a question only in a saved conversation, which you can delete. A free account keeps its questions with the workspace until the workspace is deleted. A model helps choose which figures answer the question for a paid workspace that has not switched it off, or another workspace that switched it on. The AI section explains how.
Your account
You can create an account with your email address or your Google account. We send a single-use link or code to prove the address is yours, and one strictly necessary cookie keeps you signed in. Creating an account sends nothing to an AI provider and does not put you on a marketing list.
We keep your account until you ask us to close it, then erase it within 30 days. Use the contact form under Privacy and my data for a copy, a correction or deletion.
The people in a workspace, and inviting somebody
To let the person who runs a workspace invite a colleague, give them a role, and take it away again.
Our legitimate interests. Letting a workspace owner bring a colleague in by email, which the colleague can ignore, and keeping a record of who was let in and by whom. This is optional.
An invitation stops working after seven days. Nothing deletes an old invitation, so it is kept until the workspace is deleted. A membership is kept for as long as the workspace exists.
Data and sharing
- Personal data
- the email address of the person invited, the role offered and who invited them, whether and when the invitation was accepted, withdrawn or expired, which workspace each signed-in person belongs to, the role they hold, and when it was withdrawn.
- Also shared with
- Email delivery services
- Deletion
- An invitation to your address that nobody accepted is deleted if you erase your account. One that was accepted stays as the record of who let somebody in, with your address replaced.
- Your choices
- Ignore an invitation and nothing is created. Withdraw an invitation, or take somebody out of the workspace.
Your account and signing in
To create your email-verified account and let you sign in and out, with a single-use link or six-digit code in an email, or with your Google account.
To provide what you asked for.
The link and the code last 15 minutes and work once. The account is kept until you ask us to close it, then erased within 30 days. We keep no Google access token.
Data and sharing
- Personal data
- email address, account identifier, when you signed up and last signed in, and your name and company if you give them, the link and the code, held in a protected form, and a limited record of the network address you asked from, from Google, the verified email address and name on your Google account.
- Also shared with
- Email delivery services, Sign-in services a person chooses
- Your choices
- Ask for a copy, a correction or deletion. Use email sign-in instead of Google.
Describing your business in your workspace
So Carqo can recognise the business under other names in an AI answer, show the owner what they wrote, and show how AI did in each town they named.
To provide what you asked for. This is optional.
Until the website is deleted. The owner can change or clear it at any time.
Data and sharing
- Personal data
- other names the business is known by, and names it is not, a sentence on what it sells, the towns it serves and the tone it prefers.
- Deletion
- Deleting the website deletes the profile.
- Your choices
- Change your business profile.
Emails about your workspace
To tell you when something needs you, such as a permission about to lapse or a website Carqo could not read.
To provide what you asked for.
400 days once settled, so there is a record of what Carqo told you and when.
Data and sharing
- Personal data
- your email address, to send it to, what happened and when, in the subject and the text of the email, whether it was sent, and the provider’s reference for it, the settings you chose for how often each kind arrives.
- Also shared with
- Email delivery services
- Deletion
- Swept on that period, and deleted with your settings if you erase your account. A bounce or complaint is kept as a limited address record and nothing else, so nothing is sent there again.
- Your choices
- Choose how often each kind arrives, except the ones that need your decision.
Workspace account details
To sign you in and keep your work attached to you.
To provide what you asked for.
For as long as you have an account.
Data and sharing
- Personal data
- name where you give one, the name a workspace was opened under, and a VAT number if you give one.
- Also shared with
- Email delivery services
- Deletion
- Closed at once on request and erased within 30 days. A workspace is removed in full when it is deleted.
- Your choices
- Download a copy. Close and delete it. Ask us to correct it.
The Monday email you chose
To send you, each Monday, how often AI named your business in the answers Carqo collected that week, and one next step.
To provide what you asked for. This is optional.
400 days once settled, the same as every other email about your workspace.
Data and sharing
- Personal data
- your email address, to send it to, the counts for that week and the week before, the website they are about, and the next step offered, whether it was sent, and the provider reference for it, your choice to receive it.
- Also shared with
- Email delivery services
- Deletion
- Choose Never and nothing more is sent. Erasing your account deletes your settings and what was sent to you.
- Your choices
- It is off until you choose Every Monday on the Emails screen. Choose Never at any time and nothing more is sent.
Integration keys, and who made each one
To let a member of your workspace make a key for an integration or an AI agent. To stop a key whose maker is recorded when that person leaves or can no longer make keys.
Our legitimate interests. Stopping a key from reading a business’s data once the person who made it has left the workspace or lost the right to make keys. This is optional.
A key and its record stay until the workspace is deleted. Turning a key off keeps its record, so the owner can see it was turned off. The maker’s account reference comes off the key when that person’s account is erased.
Data and sharing
- Personal data
- the member who made each key, as an account reference, the label the member typed for the key, and the key’s first characters, so it can be told apart on screen, what the key may read, when it was made, when it was last used and when it was turned off, a one-way digest of the key. The key itself is shown once and never kept.
- Deletion
- Turn a key off at any time. Deleting the workspace deletes every key record. Erasing your account removes your account reference from the keys you made, and those keys stop working. Your download of account data lists the keys you made, by label, first characters, what each may read and its dates, and never the key.
- Your choices
- Turn a key off. Download your account data. Close and delete your account.
Saved dashboard views
To keep your dashboard filters and widgets under a name you choose. You can then use them again.
To provide what you asked for. This is optional.
A view stays until it is deleted. It goes if its member, website or workspace is removed. Workspace Analysts and above can delete their own views. Viewers cannot save or delete. A view saved before a role change stays until one of these deletions applies. A member may keep up to twenty in each workspace.
Data and sharing
- Personal data
- the name you give the view, the choices saved in it. These are the period, how answers were collected, the AI tool, the kind of question, the place and a label, the question set and website it was saved for, who saved it and when, which of the existing overview widgets you show, their order and their widths.
- Deletion
- Deleting a view removes it at once. Your views are deleted if you are removed from a workspace. They are deleted with your account within 30 days of an erasure request. They are deleted with the website they were saved for. They are deleted with the workspace.
- Your choices
- Workspace Analysts and above can delete a view they saved. Delete your account, which deletes every view you saved.
A list of your recent notification emails inside your workspace
To show you, inside your workspace, the subjects of the notification emails Carqo sent you, and which ones you have marked as read.
To provide what you asked for. This is optional.
The same as the emails themselves. Your read marks are removed with the email they refer to.
Data and sharing
- Personal data
- the subject and date of the notification emails sent to you, which of those emails you marked as read, and when.
- Deletion
- Erasing your account or deleting your workspace removes your read marks. Choosing Never for a kind of email stops new ones appearing.
- Your choices
- Only you see your list. Choose Never for a kind of email on the Emails screen and it stops appearing.
Emails as you set up and use your workspace
To welcome you and remind you at one, three and seven days if setup is not finished. Also to tell you when the first AI answers are in, a teammate joins or a payment goes through.
To provide what you asked for. This is optional.
400 days once settled, the same as every other email about your workspace.
Data and sharing
- Personal data
- your email address, to send it to, your workspace’s name, and for a teammate’s email the name or address of the person who joined and the role they were given, the day the workspace was opened, whether setup is finished, and how many AI answers have been collected, for a payment, the date, the amount paid in pounds and the link our payment service gives for the invoice, whether it was sent, and the provider’s reference for it, the settings you chose for how often each kind arrives.
- Also shared with
- Email delivery services, Payment services
- Deletion
- Switch the setup kind to never and the welcome, the reminders and the notes about teammates and first answers stop. A payment note stays with billing emails. Erasing your account deletes your settings and what was sent to you.
- Your choices
- Choose never for setup progress on the Emails screen and the welcome and reminders stop. Every email says why it was sent and how to change it.
Sign in with a linked work identity
To let you link a work sign-in your workspace chose to your existing account, after a fresh email sign-in. No email or group claim creates an account or grants access.
To provide what you asked for. This is optional.
Connection settings last until stopped or the workspace is removed. The external identifier hash is destroyed on unlink or when your account is erased. Link records survive so an old backup cannot reopen a link. Sign-in checks expire after 10 minutes and are swept. Sessions keep the existing account-session retention.
Data and sharing
- Personal data
- the work sign-in service’s issuer and its public client and key settings, and an optional client secret kept sealed, a hashed external identifier bound to an existing user, with the link revision and dates, a short-lived sign-in check, and the session method, the service your workspace chose receives the sign-in request from your browser. When you return, our server sends it a one-time code and a matching check value. It also sends our callback address and the workspace’s client ID, and its client secret if the workspace set one. It replies with a signed proof of who you are, which we check and keep only as a hashed identifier. It is the workspace’s own service and not a Carqo supplier.
- Deletion
- Unlink your work identity, stop the workspace connection or erase your account. Email sign-in stays available. A sign-in already admitted may finish before the unlink commits.
- Your choices
- Unlink your own work identity. Stop the work sign-in connection. Use email sign-in. Erase your account.
More detail in the Monday email you chose
To show, in the Monday email, which of your questions named your business and which did not. Also which compared businesses AI named most, and which websites the answers linked most.
To provide what you asked for. This is optional.
400 days once settled, the same as the rest of the Monday email.
Data and sharing
- Personal data
- the wording of up to three of your questions that did not name your business, the names of up to three businesses you compare with, and how often an answer named each, up to three websites the week’s answers linked, and how many answers linked each.
- Also shared with
- Email delivery services
- Deletion
- Choose Never for the Monday email and nothing more is sent. Erasing your account deletes your settings and what was sent to you.
- Your choices
- It is off until you choose Every Monday on the Emails screen. Choose Never at any time and nothing more is sent.
A free account from your free report
To let you look around Carqo for 72 hours after your free report, before you decide to pay.
To provide what you asked for. This is optional.
The account locks 72 hours after it starts. The workspace and everything in it is deleted 90 days after that. It is kept for as long as it has any payment record, including a declined first payment. It is also kept while it has an open support case or files sent to support. It is also kept while another person belongs to it, or while you belong to another workspace. Where we are able to, we email you a warning first and delete no sooner than seven days after it.
Data and sharing
- Personal data
- your email address, to which we send a sign-in code that you type before the account opens, the website and business name from your free report, which become your workspace, when your free account started, when it ends and when it will be deleted, whether the reminder before the account locks and the warning before it is deleted have been sent, up to 3 questions you ask Ask Carqo about your report, with the answers, described in the entry for Ask Carqo in a free account.
- Also shared with
- Email delivery services
- Deletion
- When the workspace is deleted, so are its website and your Ask questions. So is your sign-in, unless you asked for erasure, which is handled on its own. You can ask for your account to be erased sooner through the Privacy Centre.
- Your choices
- Choose not to open it, and your report is shown as before. Ask for your account to be erased through the Privacy Centre. Ask for correction or access through the Privacy Centre.
Ask Carqo about your free report
To let you ask up to 3 questions about your free report while your free account lasts.
To provide what you asked for. This is optional.
Your questions and answers stay in your workspace. A free account's workspace is deleted 90 days after the account locks, apart from the cases the free account entry gives for keeping it. If the workspace moves to a paid plan, they stay with it under the paid terms. They go when the workspace is deleted or when you ask for them to be erased.
Data and sharing
- Personal data
- the questions you type, up to 500 characters each, the sentences from your free report that a question is answered from, which are sent to our AI model provider with the question, the answers, which are checked against those sentences before you see them, how many of your questions you have used.
- Also shared with
- AI model providers
- Deletion
- They are deleted when the workspace is deleted. You can ask for them to be erased sooner through the Privacy Centre. That applies whether your workspace is still free or has moved to a paid plan.
- Automated decisions
- It helps, a person or a fixed rule decides. A model is involved, within the limits in the AI section.
- Your choices
- Do not ask, and nothing is sent. Ask for your questions to be erased through the Privacy Centre.
Remembering that an email address or website has had a free account
To keep a free account to one for each person and one for each website. This stops the offer being used again and again after an account is deleted.
Our legitimate interests. A free account costs Carqo money to run. It has to be kept to one for each person and website, including after an earlier one has been deleted.
The two codes are kept to stop repeat free accounts, for 2 years from the day they are saved. They are saved when your free account is deleted. Only the day they were saved is kept with them.
Data and sharing
- Personal data
- a coded version of your email address, made with a secret key, so the address itself is not kept, a coded version of your website’s domain, made the same way, the day the codes were saved.
- Deletion
- Each code is deleted 2 years after the day it was saved. If you ask for your account to be erased, the code for your email address is deleted when the erasure is carried out, within 30 days of your request. If you object, or you no longer have a sign-in, email us at hello@carqo.co.uk. We delete the code for your email address and the code for your website. A website’s code can identify a sole trader, so we delete it on request. The codes are not linked to your name, your workspace or your report, and the email address and the website are kept as separate codes.
- Your choices
- Choose not to open a free account, and nothing is kept. Ask for correction, access or erasure through the Privacy Centre. Object, or ask for the codes for your email address and your website to be deleted without signing in, by emailing hello@carqo.co.uk.
The owner of Carqo looking at your workspace to run and support the service
To let the person who runs Carqo look at your workspace, read only, to answer a support request or find a fault.
Our legitimate interests. Running the service and answering a support request needs somebody to see what the customer sees. The view is read only, and it hides people’s details and most text the customer typed.
The record of a view is kept for 365 days. Nothing from the screens is copied or stored.
Data and sharing
- Personal data
- the screens and figures of your workspace, including the questions you track and the reports already written, which are not hidden and can name people, the names, email addresses, telephone numbers and postal addresses of people, which are hidden from the view, the telephone number, email address and address of your business, which are hidden from the view, most text you typed, such as support messages, Ask Carqo questions and answers, saved knowledge and notes, which is hidden from the view, a record that a view took place, which Carqo administrator account looked, the reason typed, and when it started and ended.
- Deletion
- The record of a view is deleted with the other security records when its period ends. A view stores no copy of your screens.
- Your choices
- A view is read only and ends after 30 minutes, when the administrator stops it, or when they sign out. People's names, email addresses, telephone numbers and postal addresses, your business's contact details, and most text you typed are hidden in a view. The questions you track and the reports already written are not hidden, and a report can name people. Object by switching on Do not let Carqo staff view this workspace in your workspace settings. Only an owner can, and no view of the workspace can start while it is on. A view already open ends on the staff member’s next request.
Remembering the address of your first website after it is deleted
To keep a plan to one business and its website. This stops one plan being used for a different business after the first website is disconnected or deleted.
Our legitimate interests. A plan is priced for one business and its website. It has to stay with that business after its website is disconnected or deleted.
The address is kept for as long as the workspace exists, including after the website it came from is deleted.
Data and sharing
- Personal data
- the address of the first website you added to the workspace, without a leading www..
- Deletion
- Deleting your workspace removes it. Deleting a website does not remove it. To have it removed sooner, write to us through the Privacy Centre.
- Your choices
- Delete your workspace, and the address goes with it. Ask for correction, access or erasure through the Privacy Centre.
Paying us
When a business subscribes, it is sent to a payment page run by our payment service. The card details are entered there. We receive our payment service’s references, the status of the subscription and the amount of each invoice. We have never held a card number and there is nowhere in our database to put one.
We send our payment service the business’s name and the email address of the person who started the payment, so it can invoice them. If you save company details on the Billing screen, we also send our payment service the company name, billing address, VAT number and purchase order reference you typed. The plans cost £99, £249 and £599 a month, and each is paid monthly. MZ Corp Limited is not registered for VAT, so no VAT is charged.
If a business starts the free trial on Starter, it gives its card on the same page. Nothing is taken if it cancels before the trial ends. If it does not cancel, the first payment is taken when the trial ends.
Our invoices are kept for at least 6 years from the end of the financial year, because tax law requires it. They outlive an erasure request and the deletion of a workspace, and they hold the date, the amount, the status and our payment service’s references, not your account. No job deletes an invoice automatically. The rest of the payment records stay for as long as the workspace does.
Paying for a Carqo plan
To take payment for the plan a business chooses, and to keep the books.
To provide what you asked for.
The plan, the references and the record of our payment service’s messages stay for as long as the workspace does. Invoices are kept for at least 6 years from the end of the financial year, because tax law requires it, and they stay if the workspace is deleted. No job deletes an invoice automatically.
Data and sharing
- Personal data
- the business’s name and the email address of the person who starts the payment, which we send to our payment service so it can invoice, the plan chosen and its status, and the dates it runs from and to, Our payment service’s own references for the customer and the subscription, each invoice, with the amount due, paid and refunded, its dates and its status, a record of each message our payment service sends us about the subscription, with its type, the references it names and a one-way fingerprint of its body.
- Also shared with
- Payment services
- Deletion
- Invoices are the one thing that outlives an erasure or the deletion of a workspace. The date, the amount, the status and our payment service’s references stay. The invoice’s web address is removed when the workspace is deleted, and when its only owner is erased. That erasure also clears The payment service customer reference from the workspace and its billing record. While a subscription has not ended, the erasure is refused, and you ask again once it has ended.
Subscription referral codes and rewards
To apply the referral discount you request and the monthly rewards you earn.
To provide what you asked for. This is optional.
Codes, referral links between workspaces and unused rewards stay until the workspace is deleted or its sole owner is erased. Invoice amounts remain under the payment-record retention policy.
Data and sharing
- Personal data
- a random referral code linked to your workspace, the workspace that referred a new subscriber, payment references, reward dates and the monthly invoices discounted, the date and support-case reference when a billing discount is checked.
- Also shared with
- Payment services
- Deletion
- Deleting a workspace or erasing its sole owner removes its codes, referral record, rewards and monthly allocations. A reward already earned by another workspace remains. It holds a payment reference, without the referred workspace or a person’s details.
- Your choices
- Enter a code only if you want the referral discount. No contacts upload, invitations or marketing emails.
Additional Ask Carqo credits and spending controls
To sell additional questions for this workspace, enforce its spending limit, and reconcile payments, refunds and disputes.
To provide what you asked for. This is optional.
Operational credit records remain for as long as the workspace does. Our payment service retains its own invoices for its applicable financial record period.
Data and sharing
- Personal data
- The workspace, the credit pack and the exact purchase terms accepted, The credit balance, question reservation counts and monthly spending limit, Our payment service customer, Checkout, payment and invoice references, amounts, refund and dispute status.
- Also shared with
- Payment services
- Deletion
- Workspace deletion removes credit accounts, purchases and question reservations from Carqo. Our payment service keeps the invoices it already issued. Question text and card details are never stored in these credit records.
- Your choices
- Only members with billing permission can buy credits or change the limit. Additional usage stops at the monthly cap or available prepaid credits. Purchases do not change the cap. Test and live credits are separate.
Your company details on your invoices
To put the company name, billing address, VAT number and purchase order reference you choose on the invoices our payment service sends for your workspace.
To provide what you asked for. This is optional.
Until you change or remove them, or your workspace is deleted. Our payment service keeps its invoices for the tax period.
Data and sharing
- Personal data
- the company name you type, a United Kingdom billing address you type, which may be a home address if you trade from home, a United Kingdom VAT number you type, and a purchase order reference you type.
- Also shared with
- Payment services
- Deletion
- Empty every box and save to remove them from Carqo. Deleting your workspace removes them too. Invoices our payment service already sent keep what they showed.
- Your choices
- Every box is optional. Only the Owner and members given billing access can change them.
A free trial on Starter
To give each business one free trial of 7 days on Starter, to check the answers to its questions while the trial runs, and to remind you before the first payment is taken.
To provide what you asked for. This is optional.
The record that a website has had a free trial stays for as long as Carqo offers the trial. That is so the same business cannot take a second one. The questions and the answers collected during the trial are kept as they are for a paying workspace. The reminder is kept as other emails about your workspace are.
Data and sharing
- Personal data
- your website’s domain, the date the trial was offered and whether payments were in test mode, the card you give on our payment service’s page, which goes to our payment service and never to us, the questions the workspace tracks, which are sent to our AI answer collection service for AI answer checks during the trial, as they are for a paying Starter workspace, up to a limit set for the trial, the day the trial ends and the amount of the first payment, in the reminder we email you.
- Also shared with
- Payment services, Email delivery services, AI answer collection services
- Deletion
- Deleting a workspace removes its link to the record. The website’s domain and the date stay, with no person’s details, until Carqo stops offering the trial.
- Your choices
- Cancel from Billing in your workspace before the trial ends and nothing is taken.
AI, and what it is and is not allowed to touch
Carqo can send an AI model provider the questions a business has set up, so it can answer them, and records what it answers. Carqo can send the same questions to our AI answer collection service, which puts them to ChatGPT and Gemini and searches Google for them. Carqo can also send our AI model provider three things. Evidence from the business’s own pages, to explain a finding. The AI answers Carqo captured, to read what they say. And a question asked on Ask Carqo, to choose which of the business’s figures answer it. Outside a free account, Carqo writes that answer itself. A follow-up sends up to six earlier questions along too, read from the saved conversation or, when nothing is saved, from the page. Of those three things for our AI model provider, the first two happen only where a business has allowed them. Ask Carqo’s model is on for a paid workspace until the business switches it off, and any other workspace can switch it on. A free account adds one more. Its Ask sends your question and the sentences of your free report to our AI model provider. Our AI model provider writes a short answer, and Carqo checks it before you see it. When our AI model provider is not available or the answer fails that check, fixed rules write it from the report. The boundary around all of this is a set of tests over the code rather than a paragraph of intent.
A short explanation of a finding, written by a model
To explain, in a few sentences, one thing Carqo found on a business’s own website and what to do about it.
Our legitimate interests. Explaining a finding about a business’s own pages to that business, at its request and only where it has allowed a model to do so. This is optional.
Deleted with the finding it explains, and findings are deleted after 1 year.
Data and sharing
- Personal data
- the rule that raised the finding, how serious it is and how many pages it affects, short text lifted from the business’s own pages as evidence, which can be a heading or a line of copy, the explanation the model wrote, or the reason none was kept.
- Also shared with
- AI model providers
- Deletion
- Deleting the website removes it at once. Nothing is sent unless the workspace has allowed explanations on its Connections screen, and withdrawing that stops the next call.
- Automated decisions
- No. A model is involved, within the limits in the AI section.
- Your choices
- Leave explanations switched off, which is how every workspace starts. Withdraw it at any time, and the next call does not happen.
A model reading the AI answers Carqo captured
To read the answers captured about a business more closely than fixed rules can, so it can see what they say about it.
Our legitimate interests. Showing a business what AI assistants say about it, where the business has asked for a closer reading than fixed rules give. This is optional.
Deleted with the answer it came from, and answers are deleted after 2 years.
Data and sharing
- Personal data
- the AI answers Carqo captured about the business, which can name people as well as businesses, what the model found in each, as a fixed set of labels, such as which business was named and how, the name of the model and how much text it handled.
- Also shared with
- AI model providers
- Deletion
- Deleting the website removes it at once. Nothing is sent unless the workspace has turned this on, and withdrawing that stops the next call.
- Automated decisions
- No. A model is involved, within the limits in the AI section.
- Your choices
- Leave it switched off, which is how every workspace starts. Withdraw it at any time, and the next call does not happen.
A model choosing which figures answer a question asked on Ask Carqo
To understand a question a person asks on Ask Carqo in their own words, and choose which of the business’s own figures answer it. Carqo writes the answer itself from those figures.
Our legitimate interests. Answering a question a business asked about its own figures, in its own words. It is on with a paid plan until the business switches it off, and any other workspace can switch it on. This is optional.
The model call itself keeps no question, and the count of model calls holds none. Outside a free account, Carqo keeps a question only in a saved Ask Carqo conversation, which is described under its own heading. A free account has its own entry.
Data and sharing
- Personal data
- the question a person types on Ask Carqo, which can name anyone they choose to mention, the business’s own figures for the website and period chosen, such as how often it was named, the wording of the questions the business set up, the names of its topics and of the businesses it compares itself with, and the websites AI linked to, where a check reads them. A question the business set up can name a person, how many model calls a workspace made, which is counted without the question.
- Also shared with
- AI model providers
- Deletion
- Nothing is sent for a workspace that has switched this off, or for one not on a paid plan that has not switched it on. Switching it off means the next question is answered by fixed rules instead.
- Automated decisions
- No. A model is involved, within the limits in the AI section.
- Your choices
- It is on for a paid workspace until you switch it off. Any other workspace starts with it off and can switch it on from the Connections screen. Switch it off at any time on the Connections screen, and the next question is answered by fixed rules.
Your saved Ask Carqo conversations
To keep your Ask Carqo questions and replies, so you can return to a conversation.
To provide what you asked for. This is optional.
Up to 90 days after the last reply.
Data and sharing
- Personal data
- the questions you ask, which can name anyone you choose to mention, replies built from your workspace figures, which can name the businesses you compare yourself with and the websites AI linked to, conversation titles, taken from the start of your first question, with times, the website and the question set, up to six earlier questions in a conversation, which are sent with a follow-up to the model that chooses which figures answer it, where Ask Carqo’s model is on for the workspace.
- Also shared with
- AI model providers
- Deletion
- Delete one conversation at any time. Closing your account, or removing you from a workspace, deletes your conversations. Website and workspace deletion also removes theirs.
- Automated decisions
- No. A model is involved, within the limits in the AI section.
- Your choices
- Delete a conversation. Download a copy with your account data. Close and delete your account.
The record of each Ask Carqo question you send
To let you stop a question and follow its progress. To keep a record that a question was asked, how it ended and what an approved change did.
Our legitimate interests. Letting the person who asked stop a running question, follow it, and have a verifiable record of any change they approved. This is optional.
90 days after the question ends.
Data and sharing
- Personal data
- that you asked a question, with its time, the website and question set, and how it ended, a numbered list of the steps Carqo took, each by name, with its outcome and how long it took, for a change you approved, the change as you approved it, which is ids, choices from a fixed list, and any listing link you gave, for a tracked question or a business you compare with, the words of the question or the name you typed, for a change you approved, a receipt naming what changed and the version it changed to. These hold references and digests, and none of your words, a one-way digest of each approval code. The code itself is never kept.
- Deletion
- Removal from a workspace deletes your records for it at once, and an approval you have not used with them. A listing link, a tracked question or a business name in an approval stays in Ask records for the 90 days of its run. That holds even if you clear the checklist entry or take the business off your comparison. Closing your account, deleting the website or the workspace deletes them too. Deleting a conversation does not delete them, because deleting a chat never reverses an action and a receipt outlives the chat. Nobody else in the workspace can read them.
- Your choices
- Stop a question. Download your account data. Close and delete your account.
Your Ask goals and checks
Check a Carqo figure for your website against a goal you save, on a schedule you allow. Tell you in Carqo when it is met.
Our legitimate interests. Continuity for the member who expressly saves one goal and separately allows Carqo to check it for a short, renewable period. This is optional.
A goal goes 90 days after you save or edit it. The permission to check it lasts 30 days at most. Each check, and the notice it sent, goes 90 days after it was made, or sooner if its goal goes first. Ending the permission does not delete the checks it made.
Data and sharing
- Personal data
- the goal you choose, which is the figure, how its answers were collected, a target, how often to check and your time zone, the website and workspace, with save, permission and expiry times, each check made, with its time, its result and the figure it found.
- Deletion
- You can revoke the goal or the permission while you are a current member and the workspace is not being restored. The next check then does not run. Expiry denies use before cleanup. Removal from the workspace, account erasure or website or workspace deletion removes the goal, the permission, the checks and the notices. Deletion control identifiers stay under the existing recovery schedule, without the values.
- Your choices
- Save explicitly. Edit or revoke a goal. Revoke the permission while you are a current member. Download your account data.
Answers you keep from Ask Carqo, and share with named colleagues
To let you keep a copy of an Ask Carqo answer. To show it to colleagues in your workspace whom you name, for a short time.
Our legitimate interests. Letting a member keep an answer they were shown and show it to colleagues who could already see the same figures. This is optional.
90 days after you keep it. A share ends when you end it, when it passes 7 days, or when the copy ends, whichever comes first.
Data and sharing
- Personal data
- the answer as it was shown to you, with the figures it cited, what each figure means and when the copy was made, which website and question set it came from, for a copy you share, which colleague you named, who shared it, and when the share starts and ends, that a colleague was told, inside Carqo, that a copy was shared with them.
- Deletion
- Delete a copy or end a share at any time. Removal from a workspace deletes your copies and ends every share given to you or by you. Closing your account, deleting the website or the workspace deletes them too. Nobody outside the workspace can read a copy, and there is no public link.
- Your choices
- Delete a kept answer. End a share. Download your account data. Close and delete your account.
Your private Ask preferences
Remember the answer detail and business focus you explicitly save for yourself and this website.
Our legitimate interests. Private continuity for the member who expressly chooses to save two bounded preferences. This is optional.
Up to 90 days after you save or edit. Reading does not extend this.
Data and sharing
- Personal data
- your selected answer detail and business focus, the website and workspace, with save and expiry times.
- Deletion
- Clear at any time. Expiry denies use before cleanup. Removal from the workspace, account erasure or website/workspace deletion removes the values. Deletion control identifiers stay under the existing recovery schedule, without the values.
- Your choices
- Save explicitly. Edit or clear. Download your account data.
Earlier questions in Ask Carqo
To use up to six of your earlier questions to understand what you mean. Each reply checks your current figures again.
To provide what you asked for. This is optional.
No extra copy is kept. Saved questions use your saved conversation’s existing life. If you do not save, this context leaves when you close or reload the page.
Data and sharing
- Personal data
- up to six of your earlier questions in the same conversation. A question may name anyone you choose to mention, your current website, questions and business choice. Earlier replies are not used as current facts.
- Also shared with
- AI model providers
- Deletion
- Delete the saved conversation or close your account. Do not save to keep the context on this page only.
- Automated decisions
- No. A model is involved, within the limits in the AI section.
- Your choices
- Choose not to save. Delete a saved conversation. Download your data.
What Carqo’s library says, in Ask Carqo
To answer a question from Carqo’s own reviewed library about search and AI search. Each answer says who said it and when it was checked.
Our legitimate interests. Answering a question from a library that says who published each claim. A publisher who is a person is named only as the source of what they published. This is optional.
The words are not kept in your Ask record or in any log. The line in the operating log holds the topics, the AI tools and a word count. It is kept for as long as our website delivery service keeps that log. Carqo sets no longer period.
Data and sharing
- Personal data
- up to six words taken from your question, with the topics and AI tools it is about. The model makes them from the question it already holds, the library entries that match, which name the organisation or person who published each one. They are given to the model so it can choose which to use, when no entry matches, the topics, the AI tools and how many words were used are written to Carqo’s operating log with the number of the question. The words themselves are not written there, and are not kept in your Ask record.
- Also shared with
- AI model providers
- Deletion
- The library is the same for every workspace and holds nothing about you. Your question follows the retention described for Ask Carqo. Deleting a website or your account does not remove a line already written to the operating log, which holds no words from your question. That line goes when the log’s own period ends, which Carqo does not set.
- Automated decisions
- It helps, a person or a fixed rule decides. A model is involved, within the limits in the AI section.
- Your choices
- Switch Ask Carqo off on the Connections screen.
Count your own Ask questions in a report
To show you how many Ask questions you started in the period of a report, and how they ended. Nothing you asked or were told is read.
To provide what you asked for. This is optional.
The count is worked out when you open the report and is not kept. A copy of a report that you keep leaves it out.
Data and sharing
- Personal data
- a count of your own Ask questions in the period, by how each ended, worked out from the record of each question when you open the report.
- Deletion
- Nothing is stored for this, so there is nothing to delete. The record of each question follows its own deletion.
- Your choices
- Download your account data. Close and delete your account.
Small changes Ask can make when an owner or administrator has allowed them
To let Ask make a small change without a card when an owner or administrator has allowed that change and a member asks for it. To keep a record of who allowed it and how often it was used.
Our legitimate interests. Letting an owner or administrator decide which small changes in their workspace need no card. Keeping a verifiable record of what that allowed. This is optional.
An allowance ends when it expires or is ended, and is deleted 90 days after that. Each use is deleted with the change it ran, 90 days after the question ends.
Data and sharing
- Personal data
- which change an owner or administrator allowed, who allowed it, when, until when and how many times a day, if they ended it, who did and when, each time the allowance was used, the member it was for, the change and the day, for each change that ran, the same record as a change you approved with a card, which holds ids, choices from a fixed list and a receipt.
- Deletion
- An owner or administrator can end an allowance at any time, and it stops at once. Removing a member from a workspace deletes their uses with their other Ask records, and any allowance they set stops working. Closing your account ends any allowance you set and clears your id from it and from the uses, and deletes your Ask records. Deleting the workspace deletes them too. Nobody is switched on by default, and no allowance lasts more than ninety days.
- Your choices
- End an allowance at any time. Download your account data. Close and delete your account.
Saved Ask Carqo conversations you show to named colleagues
To let you show one saved Ask Carqo conversation to colleagues in your workspace whom you name, for a short time.
Our legitimate interests. Letting a member show a colleague a conversation about figures that colleague could already see in the same workspace. This is optional.
A share ends when you end it, after the days you chose, which is at most 30, or when the conversation ends, whichever comes first.
Data and sharing
- Personal data
- which conversation you chose to show, which colleague you named, who gave the share, and when the share starts and ends, the colleague reading that conversation as it stood when you confirmed, which means the questions you typed, which can name anyone you chose to mention, and the replies built from your workspace figures.
- Deletion
- End a share or delete the conversation at any time. Removal from a workspace, closing your account, and deleting the website or workspace end every share given to you or by you. Nobody outside the workspace can read a shared conversation, and there is no public link.
- Your choices
- Confirm what is shared and who sees it. End a share. Delete the conversation. Download your account data. Close and delete your account.
Whether an Ask Carqo answer helped you
To record whether you found an Ask Carqo answer helpful, so you can see and change your own choice.
Our legitimate interests. Letting a member say whether an answer helped, tied to the one run that made it. This is optional.
The same as the record of the question it rates, which is 90 days. You can change your choice at any time before that.
Data and sharing
- Personal data
- your choice of helpful or not helpful for one answer, with which answer of the question it was and when you chose.
- Deletion
- A rating goes with its question record. Removal from a workspace, closing your account, and deleting the website or workspace delete it too.
- Your choices
- Change your choice. Download your account data. Close and delete your account.
Skills you save in Ask Carqo
To keep a named set of instructions you wrote, so you and your colleagues can put it in the Ask Carqo box again.
Our legitimate interests. Letting a member keep a question they ask often and share it with colleagues in the same workspace. This is optional.
Until you or an owner or Administrator deletes the skill, or you leave the workspace or close your account.
Data and sharing
- Personal data
- the name and the instructions you typed, which can name anyone you choose to mention, who saved them, and when they were saved or changed.
- Deletion
- Delete a skill at any time. It is also deleted when the person who saved it is removed from the workspace or their account is erased. Closing the workspace deletes it too.
- Your choices
- Edit or delete a skill. Download your account data. Close and delete your account.
A model may extract a fact, transcribe, classify into a fixed list of allowed answers, or write prose over a table of facts it was handed. It may not compute, compare, rank, score, decide or estimate.
- No model output ever reaches a price, a fee or a payment. A module that computes money cannot import a model client at all, and a test proves it by walking the real import graph.
- No model output ever sets a status. Nothing that changes what state your account is in can reach one.
- Payment details are never sent to a model provider.
We do not train models on anything you give us, and we never send a model your payment details. What our model providers are contractually permitted to do with what we do send is being confirmed in writing, and until it is we are not going to tell you it is settled.
Automated decisions and profiling
Several things on Carqo are automatic, such as a finding about a website, how an AI answer is classified, and a name an answer mentioned being suggested for a list of businesses to watch, or added to it where a workspace has switched that on. None of them is a decision with a legal or similarly significant effect made without a human, and that is a property we hold rather than a claim we make. The register this page is generated from records the automation level of every activity, and a test fails if any of them becomes a significant automated decision without a route for you to contest it arriving in the same change.
If that ever changes, this section changes with it and you will be told what decides, on what, and how to ask for a person to look again.
You can always ask us to explain a decision about your account, tell us why you think it is wrong, and have a person review it. That is true today whether or not the law requires it.
Measuring the site
There is no Google Analytics here, no Meta pixel and no advertising identifier. Pages on this site do not ask your browser to contact another company, apart from the page where you start a free report. On that page your browser loads a check from our website delivery service. Your browser also goes to another company when you choose something that needs it. If you choose Continue with Google, you go to Google.
In a workspace, some choices take your browser to another company as well. Paying, or managing your payment details, takes you to our payment service. Connecting Google Search Console, Google Analytics or your Google reviews takes you to Google. If your workspace set up its own work sign-in, using it takes you to the service your workspace chose.
A business can also let Carqo read the counts its own Google Analytics and Search Console already hold. That is not a measure of this site. Carqo adds nothing to anybody’s website to do it, and what comes back identifies no visitor.
Reading the analytics a business already runs
So a business can see how many people arrived and where from, using the figures their own analytics already collected, without Carqo adding anything to their website.
To provide what you asked for. This is optional.
The daily counts are kept for 395 days, so a business can compare this month with the same month last year. The long-run figures that survive that are counts with nothing in them belonging to anybody.
Data and sharing
- Personal data
- the identifier of an Analytics or Search Console property the business owns, a date range, and the names of the breakdowns Carqo asked for, the counts that come back, which are sessions by channel, clicks and times a page appeared, nothing that identifies any visitor, so no cookie, no visitor identifier, no IP address and no user agent.
- Also shared with
- Search data services the customer connects, Website analytics services the customer connects
- Deletion
- Withdrawing the connection stops Carqo reading immediately and cancels the collection that was queued. The counts already collected go with the website when it is disconnected.
- Your choices
- Carqo puts nothing on your website. There is no tag, no cookie and no banner, so there is nothing for a visitor to accept or clear. Withdraw the connection on the Connections screen and Carqo stops reading that moment, not at the end of a cycle. Every permission carries an end date. Carqo cannot give itself an open-ended one. Carqo asks for the read-only scope. It cannot change anything in your Analytics or ask Google to index a page.
The enquiries and sales a business’s own system reports
So a business can see whether the work Carqo did was followed by any actual business, using their own system’s figures rather than an estimate.
To provide what you asked for. This is optional.
Kept for 6 years, because these are a copy of the business’s own accounting records and they have their own legal obligation to keep them for that long.
Data and sharing
- Personal data
- the order or enquiry reference the business’s own system issued, when it happened, what kind it was, and the amount with its currency, whether it was later refunded or cancelled, the source the business’s own system recorded, where it recorded one, nothing about the buyer, so no name, no email address, no delivery address and no card detail.
- Deletion
- Disconnecting the business system removes them immediately. Nothing here is kept past the period above, and the long-run counts that survive hold no reference, no amount and nothing belonging to anybody.
- Your choices
- Disconnect the shop or booking system and Carqo stops receiving them and cancels what was queued. Carqo never claims an AI answer caused a sale. The figures sit in their own section and are not added to anything else. An enquiry or sale with no source recorded is counted under its own heading rather than shared out across the others.
Connecting your own Google accounts
To read, with your permission, what Google already reports about your website in Search Console, Analytics and, if you choose, Business Profile.
To provide what you asked for. This is optional.
The connection lasts until you withdraw it. Daily counts and profile reads are kept for 395 days, then deleted.
Data and sharing
- Personal data
- which Google permissions you granted, and when, but not your Google account name or email address, a sealed refresh token, kept only while the connection is live and deleted when you withdraw it, the property or location you chose, and the counts and business details Google returns for it, for Business Profile, the business name, address, telephone number, categories and hours on your profile, which for a sole trader can be personal.
- Also shared with
- Search data services the customer connects, Website analytics services the customer connects, Business listing services the customer connects
- Deletion
- Withdrawing the connection deletes Carqo’s token, stops every read at once and asks Google to revoke it. Deleting the website removes everything read through it.
- Your choices
- Choose which Google products to connect, one by one. Withdraw the connection on the Connections screen at any time. Carqo only reads. Business Profile has no read-only permission, and Carqo’s client refuses every write.
Your Search Console AI report file
To show the impressions Google reports for your website in AI Overviews and AI Mode, from the export you upload.
To provide what you asked for. This is optional.
Kept for 395 days from the upload, or until you delete it.
Data and sharing
- Personal data
- the rows of the file you upload, which are your own pages, countries, devices or dates and their impression counts, the property, period and filters you say the file covers, who uploaded it and when, and a fingerprint of the file so the same file is not imported twice.
- Deletion
- Delete an upload on the Connections screen and its rows go with it. Deleting the website removes every upload.
- Your choices
- Delete an upload at any time. Upload nothing, and Carqo shows nothing from this report.
Keep dated reports on a schedule
To keep a dated copy of the figures you have. You choose when it is made. No new AI check or email is sent.
To provide what you asked for. This is optional.
We keep a report for up to 400 days. We then delete it. We keep its saved times until the workspace ends. Stop keeps a record so an old backup cannot start it again.
Data and sharing
- Personal data
- The name you give a report. Its time zone and dates. The kind of answers it uses. The ID of the person who set it up., Kept counts and limits. Dates and IDs of kept answers. A business name may be a person’s name..
- Deletion
- You can stop new reports at any time. One already in progress may finish. We remove the saved times and reports when the workspace ends. If you erase your account, we clear your ID as their author.
- Your choices
- Save switched off. Start when ready. Stop for good. Read the kept figures. Print or save PDF.
Your Bing AI Performance export file
To show the citations Bing reports for your website in Microsoft Copilot, AI summaries in Bing and partner services, from the export you upload.
Our legitimate interests. Letting a business see the citations Bing reports for its own website, from a file the business exports itself. Bing groups search phrases into summaries. Carqo stores each phrase as Bing gave it, adds nothing to it and deletes it after the period below. This is optional.
Kept for 395 days from the upload, or until you delete it.
Data and sharing
- Personal data
- the rows of the file you upload, which are your own pages, days or grouped search phrases and their citation counts, the grouped search phrases Bing lists, which are summaries rather than anyone’s question, though a phrase could contain a name if people searched for one, the period and the filter you say the file covers, and the header row of the file, who uploaded it and when, and a fingerprint of the file so the same file is not imported twice.
- Deletion
- Delete an upload on the Connections screen and its rows go with it. Deleting the website removes every upload. If a phrase names you, tell us. We search the stored phrases for your name and delete the whole upload that holds it. A single phrase cannot be taken out of an upload on its own.
- Your choices
- Delete an upload at any time. Upload nothing, and Carqo shows nothing from this report. Ask us to delete an upload that holds a phrase naming you.
Google’s AI Assistant traffic figure
To show how many sessions Google Analytics classified as AI Assistant, separately from Carqo’s own attribution and AI answer figures.
To provide what you asked for. This is optional.
Kept for the same period as your other daily Analytics counts. Disconnecting stops new reads. Delete the website to remove its stored counts.
Data and sharing
- Personal data
- Google’s session channel group and aggregate session count for your authorised website. No visitor identity or individual event is requested.
- Also shared with
- Website analytics services the customer connects
- Deletion
- Delete the website to remove stored counts. You can download your current property’s figures from the Analytics report.
- Your choices
- Disconnect Google Analytics. Delete the website. Ask for a copy or removal.
Tell a tool you choose when checks finish
To send a short finished-check notice to the Slack channel or web address you choose, with no answer text or contact detail.
To provide what you asked for. This is optional.
Destination credentials are kept until stopped, erased or the site is removed. Sent receipts are kept 30 days. Failed or uncertain receipts are kept 90 days. No remote response body is kept.
Data and sharing
- Personal data
- a sealed credential for the destination you choose, the identifiers of the workspace website, question set and run, how the answers were captured, the finished state and time, and a link to who set it up, the delivery state and the HTTP status the destination answered with, the Slack channel or web address you choose is your own recipient and not a Carqo supplier. Carqo does not choose it and keeps no reply body from it.
- Deletion
- Stop the destination in Connections. Its credential is destroyed and queued sends are cancelled. A send already admitted may be in flight. Remove copies at the destination yourself.
- Your choices
- Stop the destination. Turn notifications off. Remove the website. Ask for a copy or erasure.
Read your figures in a tool you choose
To let you connect a local assistant or a report tool to your existing aggregate AI answer figures with a separate read-only key. You choose the client and check its terms before sharing.
To provide what you asked for. This is optional.
No new Carqo copy is kept. You control the copies your chosen tool holds, under its own terms. A Looker report is held by Google.
Data and sharing
- Personal data
- Workspace and question-set identifiers, measured counts, periods, cited domains and run status. They also give the wording of the questions in your set, whether you wrote them or they came from a ready-made set. They give the names of the businesses the answers named, with a count and a rate for each. A name can be a person who trades under their own name. No captured answer text is offered by these tools.
- Deletion
- Turn off the analytics key in Connections to stop new reads. Remove copies held by your chosen client there. Existing Carqo removal and export paths are unchanged.
- Your choices
- Turn off the key. Remove the client connection. Delete data held by the chosen client.
Cookies
We set no cookies while you are signed out. Signing in sets one strictly necessary cookie containing a session reference.
We ask for consent before using cookies that require it. You can sign out to end your session.
Staying signed in
To keep you signed in until the session ends or you sign out.
To provide what you asked for.
Ends 30 days after it was issued, or when you sign out.
Data and sharing
- Personal data
- one strictly necessary cookie holding a session reference, and the session record behind it.
Emails, and turning them off
You can withdraw your consent to marketing, or object to it, at any time using the unsubscribe link in any email, the marketing setting in your Carqo account, or by contacting us.
We keep a limited record of your preference after deletion so we do not contact you again. Service messages and replies to your requests continue.
| Stops | Keeps coming |
|---|---|
| Launch news and anything promoting Carqo | Your sign-in link |
| Anything about a product we would like you to use | A reply to something you asked us |
| A security notice about your account | |
| An email about your workspace that needs your decision, such as a permission about to lapse |
Remembering that you asked us to stop
So an unsubscribe cannot be undone by a later import of the same address.
The law requires it.
Kept for as long as we hold any list at all. Deleting it is how an opt-out gets lost.
Data and sharing
- Personal data
- a limited record to honour your email preferences, the date and the reason.
- Deletion
- Survives an erasure on purpose, and holds no readable address.
- Your choices
- Ask us to lift it if you want to hear from us again.
Who else sees it
We share personal data with the service categories below to provide Carqo. We do not sell it or share it for third-party advertising.
We name the specific suppliers on request.
| Who | What they do | Where and safeguards |
|---|---|---|
| Website delivery and security services | Deliver the website, handle requests and protect it from misuse. Acts only on our instructions. Requests may be handled worldwide. If its certification lapsed, its agreement applies the standard contractual clauses with the UK Addendum. | Wherever you are. Their machines are worldwide UK Extension to the EU-US Data Privacy Framework |
| Data storage services | Store and manage the information needed to provide Carqo. Acts only on our instructions. UK storage does not establish that support access from outside the UK is excluded. | United Kingdom No restricted transfer recorded |
| Email delivery services | Deliver service messages and permitted marketing emails. Acts only on our instructions. It processes mainly in the United States. | United States Standard contractual clauses with the UK Addendum |
| Email inbox services | Host the Carqo inbox and the mail sent to Carqo addresses, so a person can reply to a request. Acts only on our instructions. If its certification lapsed, its terms apply the standard contractual clauses with the UK Addendum. | Wherever you are. Their machines are worldwide UK Extension to the EU-US Data Privacy Framework |
| AI answer collection services | Send questions to ChatGPT, Gemini and Google and return their answers. Acts only on our instructions. Receives the free report questions, and the questions a paying business or a business on a free trial sets up or builds from its own description, but not your email address. For the free report, the questions also reach ChatGPT, Gemini and Google. For a paying business or a business on a free trial, they reach ChatGPT, Gemini and Google AI Overviews. The questions may contain personal data. The company has its seat in Estonia. Where it processes the questions and the data processing agreement are not confirmed. | Not confirmed. The company has its seat in Estonia. Safeguard not yet confirmed |
| AI model providers | Write short explanations of findings, read the AI answers Carqo captured, and choose which figures answer a question on Ask Carqo, each only where a workspace allows it. Acts only on our instructions. It reads the free report’s home page text and answers. In the signed-in product it writes short explanations and chooses which figures answer a question on Ask Carqo, only where the workspace allows it. Ask Carqo is on for a paid workspace until it is switched off. It never receives a payment detail or a sign-in link. | United States Standard contractual clauses with the UK Addendum |
| Payment services | Take payment for a Carqo plan and send invoices for it. Acts only on our instructions. The contracting entity, and whether a restricted transfer applies, has not been established. | United States and Ireland Safeguard not yet confirmed |
| Courts, police and regulators | Where the law requires or permits it. A public body, where the law requires it. This has never happened. | United Kingdom No restricted transfer recorded |
Information we get from somewhere other than you
Most of what we hold, you gave us. What did not come from you is listed here.
- The public pages of a business’s own website, read on that business’s recorded instruction.
- The name and email address on a Google account, from Google, where that person chooses to sign in with it.
- What an AI assistant said when a business’s question was put to it, and the businesses and sources it named.
- Counts from a business’s own Google Analytics and Search Console, where that business connects them. The service provider holds them, and they identify no visitor.
- A connected shop’s own catalogue and shop details, from Shopify, where that business connects one. We ask for nothing about the shop’s customers or orders.
We have never taken another company’s data, and we never will. That is somebody else’s database and personal data we would have no lawful reason to hold.
The law, courts and the police
We would disclose information where the law requires it, for example under a court order, or where it is necessary to prevent or detect a crime. That has never happened.
We disclose what the request lawfully reaches and no more, and we tell you unless we are prohibited from doing so.
If Carqo is sold or closes
If the business were sold or merged, your information would transfer with it and the buyer would be bound by this notice until they told you otherwise.
If we decide not to launch Carqo at all, everything on the interest list is deleted within 30 days. This is a young business and not launching is a real possibility, so it is written down rather than left to whoever remembers.
Where your information goes
Records are stored in the United Kingdom. This does not mean all handling or support stays in the UK.
The table above gives the region and the transfer safeguard for each recipient. Where a safeguard has not been confirmed, we say so and do not claim it is in place.
Contact us for details or a copy of applicable safeguards.
Our AI model providers are in the United States, so a question, an answer or a piece of evidence sent to one leaves the United Kingdom. Some rely on the standard contractual clauses with the UK Addendum. For others the safeguard is not yet confirmed.
Security measures
We protect personal data using encryption in transit and at rest, restricted access and safeguards against misuse.
We notify affected people and the regulator of personal data breaches where the law requires.
The record of sign-ins and actions on your account
So a dispute about who did what has an answer, and so we can investigate abuse.
Our legitimate interests. Being able to answer what happened on an account, which protects the account holder as much as us.
365 days from the event. The record that an erasure happened is kept after the erasure.
Data and sharing
- Personal data
- the action, the account, the time, and the member of staff where one acted.
Limiting how often one caller can ask
To stop one source flooding a form or a route, so the site stays usable for everybody else.
Our legitimate interests. Keeping forms and routes available.
Kept for up to two days, then deleted.
Data and sharing
- Personal data
- a limited record of the network address, account or workspace, a count, and the time the window closes.
When a page breaks in your browser
So we find out that it broke, and fix it.
Our legitimate interests. Knowing that our own software has failed, which we otherwise learn only when somebody complains.
The log line stays in our hosting provider’s logs for as long as it keeps them.
Data and sharing
- Personal data
- the message and the stack trace, in a log line, with email addresses and tokens masked, the page it happened on, with any query string dropped whole, the browser and version, in the same log line, an hourly count of each failure, with its message and the page it happened on, and nothing that says who it happened to.
- Deletion
- The oldest counts are dropped by the same job that removes everything else past its period.
How long we keep things
The table gives the retention period for each type of information. Contact us to request deletion where your rights apply.
| What | How long | From when, and why |
|---|---|---|
| Early-access requests | 24 months at most | Counted from the day we received the request. The form is closed and takes no new requests. Or earlier, when the enquiry is closed or you ask us to delete it. The copy emailed to the Carqo inbox is not covered by that period, and we delete it by hand when you ask |
| Your account | For as long as you have one | Erased within 30 days of asking |
| A sign-in link | 15 minutes | Single use, then deleted |
| Staying signed in | 30 days from issue | Sign-out ends the session immediately. An erasure request revokes it. |
| The record of sign-ins and actions | 365 days | From the event. No account is flagged for fraud, so every record is kept for the same period |
| Pages read from a website you connected | 1 year | From the day each page was read, with the findings about it |
| The record of each scan and who authorised it | 3 years | From when the scan finished. The permission behind it is kept until the website is deleted |
| Business details read from your pages | Until you delete the website | Disconnecting stops Carqo reading and using them |
| The record of each read of your pages | 1 year | From when the read started |
| Your questions and the businesses you watch | Until you delete the website | A retired question is kept with its wording, because it labels the answers it produced |
| AI answers, and what is worked out from them | 2 years | From the run that produced them, or longer where a saved summary still covers them |
| Server logs you upload | 395 days | From the end of the period a log covers |
| Counts read from your analytics | 395 days | So this month can sit beside the same month last year |
| Enquiries and sales a business’s system reports | 6 years | A copy of the business’s own accounting records |
| Emails about your workspace | 400 days | Once settled, so there is a record of what Carqo told you |
| A snapshot you attach to a support case | 180 days | Whether or not you attached it |
| Support cases and the files on them | No period decided | A case goes when you ask, or when the workspace is deleted, and nothing deletes one automatically. The exception is a demo request, which has its own row |
| What you wrote in a privacy request or complaint | 1 year | From the day we close a request made through the privacy rights form, with your address and our reply. An open request is never removed. A message sent through the contact form is a support case |
| The record that a privacy request was answered | 6 years | From the day we close it. We keep it to show it was answered in time |
| A demo request | 1 year | From the day you made it. The copy in the Carqo inbox is deleted by hand when you ask |
| A free AI visibility report, with the findings from your pages | 30 days | From when the report was made, with the email held on it |
| The email address kept for marketing after a free report | 1 year | From the latest report, and only if you ticked the box |
| Billing details you save | Until you change or remove them | Or until the workspace is deleted. Our payment service keeps the invoices it sent for the tax period |
| Records of extra Ask Carqo questions you bought | As long as the workspace | Our payment service keeps its own invoices for its financial record period |
| The interest list | 24 months | Or the moment you unsubscribe |
| Payment records and invoices | At least 6 years from the financial year end | Tax law. Invoices stay if the workspace is deleted or its owner is erased, and no job deletes them. The other payment records stay while the workspace does |
| A one-page summary link | Until the website is deleted | It stops working when it ends or is switched off, and never lasts more than three months |
| Your business profile | Until you delete the website | You can change or clear it at any time |
| Content you write and save | Until you delete the draft or the website | Up to 20 saved versions are kept for each draft |
| Your business knowledge base | Until you delete the record or the website | Up to 20 revisions are kept for each record |
| Saved Ask Carqo conversations | 90 days | From the last reply. You can delete a conversation at any time |
| Backups | 35 days | An erased record is never restored to live from one |
| Request-limit records | Up to two days | Then deleted |
What you can ask us to do
These are free, you do not have to give a reason, and we will not ask for one. We answer within one month.
See what we hold about you
Ask us for a copy of everything we hold about you, and we will send it.
UK GDPR Article 15
Correct something that is wrong
Tell us what is wrong and what it should say, and we will fix it.
UK GDPR Article 16
Delete what we hold about you
Ask us and we delete it. You do not have to give a reason.
UK GDPR Article 17
Pause what we do with it
Ask us to keep your information but stop using it while something is being sorted out.
UK GDPR Article 18
Take it somewhere else
Get the information you gave us in a machine-readable file you can hand to somebody else.
This right covers what you gave us.
UK GDPR Article 20
Object to something we do
Where we rely on our own legitimate interests, you can object and we have to stop unless we can show a compelling reason not to.
UK GDPR Article 21
Stop the marketing
An absolute right, with no balancing and no reason needed. It takes effect at once.
It stops marketing. It does not stop a reply to something you asked us, because that is not marketing.
UK GDPR Article 21(2)
Ask about an automated decision
Ask us to explain a decision, tell us why you think it is wrong, and have a person look at it again.
Nothing on Carqo currently decides something significant about you without a person or a fixed rule in the path.
UK GDPR Article 22
Complain about how we handled your information
Open a complaint with us. It gets a reference and a deadline, and you can see where it is up to.
UK GDPR Article 77 gives you the separate right to complain to the ICO
Where we need to be sure it is you, we ask for the least that will do. We do not ask for identity documents to answer a request about an email address you can already prove you control.
If you are unhappy with us
You can complain to us and we have to take it. There is a form rather than an email address you have to hunt for, and it creates a case with a reference so you can see where it is up to.
You do not have to complain to us first. Going to the regulator instead costs you nothing and affects nothing else. The Information Commissioner's Office regulates data protection in the UK.
- Our ICO registration number is ZC208622
- Helpline 0303 123 1113
- Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Age
Carqo is for adults. The paid parts are for people 18 or over. We do not ask your age or verify it, and we do not knowingly hold information about a child.
If you believe we hold information about a child, tell us and we will delete it.
Changes to this notice
We publish the updated version and explain changes. We inform affected people before a material change takes effect.
Browsing the site is not consent. A notice update does not change consent you already gave.
Contacting us about your information
For privacy questions or requests, email hello@carqo.co.uk or use the contact form under Privacy and my data.
You can also write to MZ Corp Limited, 128 City Road, London, EC1V 2NX.
Asking for a demo
To arrange the demo you ask for, and to keep a record of what was asked and answered.
Our legitimate interests. Answering the person who asked for a demo. This is optional.
Kept as a support case for 1 year, then deleted. The copy in the Carqo inbox is deleted by hand when you ask.
Data and sharing
- Personal data
- your name, email address, business name and website, and what you tell us you would like to see, a copy of the request emailed to the Carqo inbox once you confirm your address.
- Also shared with
- Email delivery services, Email inbox services
- Your choices
- Ask us to delete your request.
Early-access requests
The early-access form is closed and takes no new requests. These are the requests made before it closed. We use your email and optional business website to respond, and a request did not create an account or authorise access to your website.
A copy of your request is emailed to the Carqo inbox, which an email service hosts. That copy is not removed when the enquiry is deleted, and we delete it by hand when you ask.
Early-access requests
To keep and answer the requests made before the form closed.
Our legitimate interests. Responding to the request you made. This is optional.
Kept for up to 24 months from the day we received it, or until the enquiry is closed or you ask us to delete it. The copy in the Carqo inbox is deleted by hand when you ask.
Data and sharing
- Personal data
- email address, optional business website.
- Also shared with
- Email delivery services, Email inbox services