What changed, and when

Version 3.41current

Took effect 11 November 2026. Not a material change.

• The table of who receives personal data now says it is not confirmed where our AI answer collection service processes questions. Before, it listed the United States and Ireland. The company has its seat in Estonia.
• We now describe the free trial on Starter in full. A business on the trial has its questions sent to our AI answer collection service, as a paying business does, up to a limit.
• The plan page says when the trial is open. Version 3.40 said it was not open yet.
• We renamed the security section Security measures. Its words are unchanged.
• We have not changed how long we keep anything.

Version 3.40

Took effect 11 November 2026. A material change to the notice.

• We now use a different AI answer collection service. The company has its seat in Estonia. We have not confirmed where it processes the questions.
• The free report now asks ChatGPT, Gemini and Google AI Overviews. It no longer asks Google AI Mode. For Google AI Overviews the service searches Google for the question and returns the AI Overview Google showed.
• A paying business’s questions go to the same three. They no longer go to Google AI Mode, a further AI assistant or Microsoft Copilot.
• The tick box about marketing email on the free report form now starts unticked. We email you about Carqo after a report only if you tick it.
• We now state the safeguard for information sent outside the UK for our website delivery, email delivery and email inbox services.
• The notice now describes a seven day free trial on Starter. It is not open yet, and the plan page will say when it is.
• We have shortened this notice and moved the closed early-access section to the end. Otherwise what we collect, and how long we keep it, are unchanged.

Version 3.39

Took effect 11 November 2026. A material change to the notice.

• If you mark a statement an AI answer made about your business as correct or incorrect, we keep your mark and the date. We do not copy the statement, and we do not keep who marked it.
• We keep the address of the first website in a workspace after that website is deleted. This holds a plan to one business. Deleting the workspace removes the address.
• An owner or administrator can allow Ask to make some small changes without a confirmation card. Nothing is allowed unless they choose it. We keep who allowed it, until when, and each time it was used.
• You can show one saved Ask Carqo conversation to colleagues in your workspace whom you name, for a time you choose. We keep who it was shown to and when the share ends. There is no public link.
• You can mark an Ask Carqo answer as helpful or not helpful. We keep your choice with the answer and the date, for as long as we keep the question.
• You can save a named set of instructions in Ask Carqo for you and your colleagues to use again. We keep the name, the instructions, who saved them and when.
• Otherwise what we collect, why, and how long we keep it are unchanged.

Version 3.38

Took effect 11 November 2026. A material change to the notice.

• We now describe each organisation that receives personal data by category, such as website delivery, data storage, email delivery, payments and AI model providers. Each shows where it processes information and the safeguard for any transfer.
• We no longer name our suppliers in this notice. We name the specific suppliers on request.
• We now describe what the free report form keeps in your own browser while you fill it in. It no longer keeps your email address or the websites you typed.
• Otherwise what we collect, why, and how long we keep it are unchanged.

Version 3.37

Took effect 8 November 2026. A material change to the notice.

• When a free account is deleted, we keep a coded version of your email address and of your website’s domain for 2 years. That stops the same ones opening another free account.
• You can ask us to remove the codes for your email address and your website, without signing in, by emailing us.
• The person who runs Carqo can view your workspace read only, to answer a support request or find a fault. People’s names, contact details and most text you typed are hidden. The questions you track and the reports already written stay visible, and a report can name people.
• An owner can switch on Do not let Carqo staff view this workspace, and no view of it can start.
• We keep a record that a view took place, with the reason and the times, for a year.
• The early-access form is closed and takes no new requests. We keep the requests already made for up to 24 months from the day we received them.
• The one email we send a business after its free report now says Carqo is open. It no longer says the software is not live.

Version 3.36

Took effect 5 November 2026. A material change to the notice.

• A privacy request made on the privacy rights form now loses what you wrote a set time after we close it. We keep a shorter record that we answered.
• A message sent through the contact form is a support case. Nothing deletes a support case automatically, except a demo request.
• You can buy extra Ask Carqo questions and set a monthly spending limit. Our payment service takes the payment.
• You can ask for a demo. We keep your name, email, business and what you tell us as a support case for a year, and then delete it.
• A copy of a demo request or an early-access request goes to the Carqo inbox, which an email service hosts. We delete that copy by hand when you ask.
• A workspace report can count your own Ask questions. It reads no question and no answer.
• The Monday email can show the wording of your questions, the businesses you compare with and the websites the answers linked.
• You can put a company name, billing address, VAT number and purchase order reference on your invoices.
• The free report can read up to 25 pages of the website you type, and keeps the findings but not the page text.
• If no library entry matches, the topics, the AI tools, the number of words and the question number now go to our operating log. The words themselves no longer do.
• A free AI visibility report can open a free account that lasts 72 hours, with 3 Ask Carqo questions. We keep it for 90 days after it locks, then delete it.
• In a free account, a model writes a short answer to each Ask question from the sentences of your report, and Carqo checks it. If the model is unavailable or the answer fails the check, fixed rules write it. Your questions stay in the workspace.

Version 3.35

Took effect 1 November 2026. A material change to the notice.

• Ask Carqo can answer from Carqo’s own reviewed library, which says who published each entry. Up to six words from your question are used to find entries.
• If nothing in the library matches, those words go to our operating log with the question number. They are not kept in your Ask record.
• You can send a short finished-check notice to a Slack channel or web address you choose. That destination is your own recipient and not a Carqo supplier.
• You can link a work sign-in that your workspace chose to your account, after a fresh email sign-in. That service is your workspace’s own.
• You can connect a local assistant or a Looker Studio report to your figures with a read-only key. You control the copies your tool holds, and Google holds a Looker report.
• The free report now uses a model to choose the kind of business from a fixed list and to list the businesses the answers named.
• A paying business’s questions can now also be searched on Google through our AI answer collection service, to read the AI Overview that Google shows.
• This notice no longer says that no third-party script runs on this site. The page where you start a free report loads a check from our website delivery service. Some choices in a workspace also take you to our payment service, Google or the service your workspace chose for sign-in.
• The free AI readiness check is open on this site. It reads only the main address of the website you type, and reads a second robots.txt file if the home page redirects.

Version 3.34

Took effect 30 October 2026. A material change to the notice.

• You can sign in with a six-digit code from the sign-in email, instead of opening the link. Five wrong tries end the code and its link.
• You can create your account or sign in with your Google account. We keep the email address and name Google gives us, and no Google token.
• When you add your website, Carqo starts reading its public pages straight away. It keeps to robots.txt and stops when you stop the audit.
• When you add your website, Carqo asks ChatGPT and Gemini four fixed questions about your business, through our AI answer collection service.
• If you sign up with the same email and website within 30 days, your first audit can use your free report’s answers.
• A paying business’s questions can now also go to Gemini, through our AI answer collection service.
• You can type the website a business you compare with uses. We show which cited sources match it, and we do not visit that website.
• Carqo can check what an AI answer says about your phone number, address, opening times and trading status. We compare it with your own website and what you tell us.
• We compare the names you give your business with the words an AI tool says it searched for. We store nothing new for this.
• You can set up the places your business works from, so each place keeps its own questions and answers.
• You can share a frozen copy of chosen dashboard figures through a link, with an optional password. You can revoke the link at any time.
• You can have Carqo keep dated copies of your figures on a schedule you choose. No new AI check or email is sent.
• You can save your preferred Ask answer detail and business focus for yourself. You can clear them at any time.
• Ask Carqo can use up to six of your earlier questions in a conversation to understand what you mean. Those questions go to the AI supplier that answers Ask.
• You can upload your Bing AI Performance export. We keep its rows for 395 days, or until you delete the upload.
• Where you have connected Google Analytics, we show the sessions Google counted as AI Assistant traffic. We ask for counts only, with no visitor identity.
• You can save dashboard views under a name you choose, with your filters and widgets. You can delete a view at any time.
• You can keep your own record of the business listings that AI answers link to. Carqo does not check that you are listed.
• Your workspace shows a list of the notification emails we sent you, and which ones you marked as read.
• We email you as you set up your workspace, with reminders at one, three and seven days. You can turn these off on the Emails screen.
• You can confirm your email with a six-digit code instead of the link. We keep the code only as a scrambled value, and it stops working after 15 minutes or five wrong tries.
• The free report asks for your website, your business name, your email and up to five businesses you compare yourself with. It does not ask for your name or your area.
• We read the town or region from the address details on the home page we reach, where a local business gives one. We use it in the questions we ask the AI assistants. If your address redirects, that page can belong to another website.
• Your request stays with us for about an hour. The businesses you named stay with the report for 30 days.
• The report opens on the page when you choose Start my report, and we do not email you the report.
• The free AI readiness check reads a website you type, shows the result in your browser and keeps neither the address nor the result.

Version 3.33

Took effect 26 October 2026. A material change to the notice.

• Website setup now asks for the whole website. The controls for individual sections have been removed.
• The website privacy section lists the available controls to disconnect or delete a website.

Version 3.32

Took effect 22 October 2026. A material change to the notice.

• The free AI visibility report now asks ChatGPT, Google AI Mode and Gemini through our AI answer collection service. It does not ask any other AI assistant.
• Everything else in 3.30 is unchanged.

Version 3.30

Took effect 21 October 2026. A material change to the notice.

• We took two sentences out of how we describe the free report check. The check, what it reads and what we keep are unchanged.
• The free AI visibility report now sends one email. We no longer email a confirmation link, and the check that you are a person is on the form.
• We email you the link to your finished report. Until you open that link, it is the only email we send to the address.
• We email you about Carqo only after you open your report link, and only if you did not tick the box.
• Everything else in 3.29 is unchanged.

Version 3.29

Took effect 20 October 2026. A material change to the notice.

• Ask Carqo keeps a short record of each question you send, so you can stop it and follow its progress. If you approve a change through Ask, it also keeps what you approved and a receipt of what changed. We keep these for 90 days after the question ends.
• You can save a goal for one of your Carqo figures and allow Carqo to check it on a schedule. We keep the goal, your permission and each check, and tell you inside Carqo when the goal is met. A goal goes 90 days after you save or edit it, and the permission lasts 30 days at most.
• You can keep a copy of an Ask answer and show it to colleagues in your workspace whom you name, for up to 7 days. We keep a copy for 90 days. There is no public link.
• We record which member made each integration key. A key with its maker recorded stops working when that person leaves the workspace or can no longer make keys. Your download of account data lists the keys you made.
• Everything else in 3.28 is unchanged.

Version 3.28

Took effect 19 October 2026. A material change to the notice.

• A paying customer can share a personal referral code. A business that uses it gets a discount on its first month.
• We keep the code, which workspace referred which, and the payment references, reward dates and invoices a reward discounts. Our payment service applies the discount to the bill.
• When we check a discounted bill, we keep the date and the support case reference.
• We use this to give you the discount you asked for and the rewards you earn, as part of our contract with you.
• We do not send invitations, upload contacts or send marketing messages for referrals.
• Everything else in 3.27 is unchanged.

Version 3.27

Took effect 19 October 2026. A material change to the notice.

• The free AI visibility report now checks that a person is starting it. A our website delivery service Turnstile check runs on the page where you choose Start my report.
• The check reads information from your browser and device to tell a person from a program. It sets no cookie. We send its one-time result and your network address to our website delivery service to confirm it passed. We keep no record of the check.
• We treat the check as strictly necessary to stop automated programs starting reports that cost money.
• Everything else in 3.26 is unchanged. Supplier transfer safeguards and the email processing region remain unconfirmed.

Version 3.26

Took effect 16 October 2026. A material change to the notice.

• When you create an account on the registration page, we ask for your name and the company you work for.
• We keep them on your account until you erase it. A sign-in link keeps a copy only until it is used or the expiry sweep removes it.
• Nothing else in 3.25 is changed.

Version 3.25

Took effect 15 October 2026. A material change to the notice.

• You can save drafts of text for your website. We keep what you write, with earlier saved versions, until you delete it or the website.
• You can keep a private business knowledge base. We keep the reference text you add, and the text we read from an uploaded file but not the file, until you delete it.
• Ask Carqo can save your conversations for 90 days after the last reply. Before this we did not keep your questions. A follow-up sends the previous question to the model that helps choose which figures answer it.
• A paying business can have its questions asked of ChatGPT, Google AI Mode and a further AI assistant through an AI answer collection service. We keep the answers for 2 years.
• We corrected the entry for the former website service. Its early-access form data was deleted with the site on 25 September 2026.
• We reworded four places to match. Ask Carqo and the support section now say a question is kept only in a saved conversation. The AI sections now cover the three assistants as well as an AI model provider.
• Nothing else in 3.24 is changed. Supplier transfer safeguards and the email processing region remain unconfirmed.

Version 3.24

Took effect 15 October 2026. A material change to the notice.

• The free AI visibility report now asks you to confirm your email first. We email a link to the address you type. We read your website and run the report only after you use that link.
• We hold your request, including your email, business name and website, until you confirm. We delete it after one hour if the link is unused, or one day after it is used.
• When your report is ready we email a second link to the same address, through our email delivery service.
• Everything else in 3.23 is unchanged. Supplier transfer safeguards and the email processing region remain unconfirmed.

Version 3.23

Took effect 15 October 2026. A material change to the notice.

• Free AI visibility report requests are marketing leads again. Unless you tick the opt-out box on the form, we keep your email, business name and website for a year and email you about Carqo.
• You can unsubscribe from the link in any email or from the marketing setting in your Carqo account. Both stop the marketing and are kept as a suppression record.
• The AI answer collection recipient, the privacy contact form links and the 30-day report retention from 3.22 are unchanged.
• Supplier transfer safeguards and the email processing region remain unconfirmed.

Version 3.22

Took effect 15 October 2026. A material change to the notice.

• Added the AI answer collection recipient to the public table and explained the downstream services receiving report questions.
• Linked a working public privacy contact form from the account and contact sections.
• Disabled new free-report marketing leads and automatic follow-up. Report contact details keep the existing 30-day retention.
• Supplier transfer safeguards and the email processing region remain unconfirmed.

Version 3.21

Took effect 14 October 2026. Not a material change.

• Replaced public infrastructure supplier names with specific service categories and removed internal implementation records from the public notice response.
• Shortened the notice and made extra processing detail expandable. Data use, lawful bases, retention, rights and transfer facts are unchanged.
• The public change history uses category-based summaries. Original notices and exact internal supplier records remain available for lawful requests.

Version 3.20

Took effect 14 October 2026. A material change to the notice.

• The free AI visibility report now asks only for a website, business name and email address. Carqo reads the public page title and description to understand what the business does.
• The report asks ChatGPT, Google AI Mode and a further AI assistant through our AI answer collection service. It does not ask any other AI assistant.

Version 3.19

Took effect 14 October 2026. A material change to the notice.

• Carqo sends a Monday email to a person who chooses it. It goes once a week for each connected website and shows how often AI named the business.
• A business can connect its own Google accounts. Carqo reads Search Console and Analytics, and Business Profile where the owner chooses it. Google offers no read-only Business Profile permission, so Carqo’s client refuses every request that is not a read.
• A business can upload its own export of the Search Console generative AI report. It counts impressions only and uses Pacific dates.
• Carqo can audit the public pages of the website a business names during paid onboarding, on that business’s recorded instruction. It records what it could not read, and stopping the audit stops later requests.

Version 3.18

Took effect 12 October 2026. A material change to the notice.

• Carqo sends one email to a business that ran the free AI visibility report. It goes between three and seven days after the report, and only to an address on the same domain as the website the business gave. The email has a link to stop. Pressing it, or replying to ask, deletes what Carqo holds.
• The free AI visibility report now asks ChatGPT and Google AI Mode. It no longer asks a further AI assistant.

Version 3.16

Took effect 11 October 2026. A material change to the notice.

• Email-verified accounts can be created before the analytics software opens. Sign-in links, sessions, account security records and request-limit records are disclosed at the marketing stage.
• Workspace account details remain a discovery-stage activity. Account registration does not open analytics, subscriptions or website connections.

Version 3.14

Took effect 7 October 2026. A material change to the notice.

• Added the free AI visibility report. It sends four questions about a business to AI assistants through our AI answer collection service and keeps the answers for 30 days.
• The report asks for an email address. Unless you tick the box not to hear from us, we keep it for a year and may email you about Carqo, and every email lets you stop.
• Added our AI answer collection service to the list of suppliers. It puts the questions to ChatGPT, a further AI assistant and Google AI Mode, so the questions reach those services too.

Version 3.13

Took effect 7 October 2026. A material change to the notice.

• Ask Carqo’s model is now on for every paid workspace, until the business switches it off on its Connections screen. Until now every workspace started with it off.
• A workspace not on a paid plan starts with Ask Carqo’s model off and can switch it on. Until it does, its questions are answered by fixed rules.
• Every other use of our AI model provider still starts off and happens only where a workspace allows it.

Version 3.12

Took effect 6 October 2026. A material change to the notice.

• Added Ask Carqo’s model. Where a workspace turns it on, a question asked on Ask Carqo is sent to our AI model provider so a model can choose which figures answer it. It goes with the business’s own figures, the wording of its questions, its topics, the businesses it compares itself with and the websites AI linked to. Carqo still writes every sentence of the answer, so no number in it comes from the model.
• Added that the question is not kept. It is used for one answer and then dropped, and the count of model calls holds no question.
• Added our AI model provider to the list of suppliers, which until now left it out because it was not switched on. It is used only where a workspace has allowed it, for explanations of findings, for reading captured AI answers and for Ask Carqo.
• Added that our AI model provider’s terms use the standard contractual clauses with the UK Addendum, as another AI model provider’s terms do. Until now the notice said nothing about this had been confirmed.
• Added our database supplier, our data storage service, to who Ask Carqo shares with, because it keeps the count of model calls.
• Corrected the support section, which said Ask Carqo answers by fixed rules alone. Where a workspace switches it on, a model helps choose which figures answer the question.

Version 3.11

Took effect 6 October 2026. A material change to the notice.

• Changed our contact email address to hello@carqo.co.uk.
• Said that your sign-in also remembers which business you chose to look at, if you work with more than one.
• Said that the towns in your business profile are used to show how AI did in each of them.

Version 3.10

Took effect 6 October 2026. A material change to the notice.

• Corrected what the plan prices include. MZ Corp Limited is not registered for VAT, so no VAT is charged and each price is the total. The earlier draft said VAT was included.
• Added the one-page summary link. An owner can make a link that shows one website’s AI figures to anyone who has it. It ends after a time or when the owner switches it off.
• Added what is kept about that link. A random code, stored as it appears in the link, the dates it runs between and the website it belongs to. The page shows no person and no email address.
• Added the business profile. An owner can write other names the business is known by, and a few lines about it. The names are used to recognise the business in an AI answer. The rest is only shown back to the owner.
• Added paying for a plan. A business pays on our payment service’s own page, so card details never reach us. We send our payment service the business name and the email of the person paying, and keep our payment service’s references and each invoice.
• Added how long payment records are kept. Invoices are kept for at least the tax period and stay if the workspace is deleted. No job deletes them. The other payment records stay while the workspace does.
• Added what erasing an owner clears. The payment service customer reference and the invoices’ web addresses are cleared when the only owner of a workspace is erased. The erasure is refused while a subscription has not ended, and the person asks again once it has.
• Added our payment service to the list of suppliers, which until now only showed from a later stage.

Version 3.9

Took effect 5 October 2026. A material change to the notice.

• Added the one-page summary link. An owner can make a link that shows one website’s AI figures to anyone who has it. It ends after a time or when the owner switches it off.
• Added what is kept about that link. A random code, stored as it appears in the link, the dates it runs between and the website it belongs to. The page shows no person and no email address.
• Added the business profile. An owner can write other names the business is known by, and a few lines about it. The names are used to recognise the business in an AI answer. The rest is only shown back to the owner.
• Added paying for a plan. A business pays on our payment service’s own page, so card details never reach us. We send our payment service the business name and the email of the person paying, and keep our payment service’s references and each invoice.
• Added how long payment records are kept. Invoices are kept for at least the tax period and stay if the workspace is deleted. No job deletes them. The other payment records stay while the workspace does.
• Added what erasing an owner clears. The payment service customer reference and the invoices’ web addresses are cleared when the only owner of a workspace is erased. The erasure is refused while a subscription has not ended, and the person asks again once it has.
• Added our payment service to the list of suppliers, which until now only showed from a later stage.

Version 3.8

Took effect 5 October 2026. A material change to the notice.

• Corrected how often old records are removed. The job that removes records past their period runs once a day. The earlier text said every hour.
• Corrected the record of sign-ins and actions. Every record is kept for 365 days and no account is flagged for fraud. The earlier text said 90 days, or 365 where an account was flagged.
• Corrected how long a model’s explanation of a finding is kept. It is deleted with the finding, and findings are deleted after a year.
• Corrected how long a model’s reading of an AI answer is kept. It is deleted with the answer, and answers are deleted after two years.
• Corrected what is said about server logs a business uploads. The visitor’s address is not kept in a column of its own. A plain one-way code made with it sits beside the details it was made from. It is weak protection and the address could be worked out from it.
• Added the limit on how often one source can ask. Each request writes a row that holds a one-way hash of the route and the caller, a count and a closing time. The daily clean-up deletes it once its window has closed.

Version 3.7

Took effect 5 October 2026. A material change to the notice.

• Said what happens when a business connects its website. Carqo reads the public pages after the business has proved it controls the domain, records what each request returned, and shows it back to that business.
• Said what that reading keeps. It keeps the address of each page and each redirect, and how each request went. It keeps page titles and short extracts, with registration-style codes, phone numbers, email addresses and full postcodes removed. It keeps a one-way hash of the page text and never the page itself.
• Said that a page address is stored as it is, so an address that holds a name keeps it.
• Said how long that reading is kept. Each page and its findings stay for a year, the scan record for three years, and the permission behind it until the website is deleted.
• Said that a scan a person queues is started by a scheduled job that checks every five minutes. Said that Carqo also reads the front page when it asks a business’s questions.
• Said that Carqo reads a connected website for the facts its pages state. These include business names, VAT numbers, addresses, contact details, products, services, prices, and the addresses and captions of images.
• Said plainly that a contact number or email address on a small business site is often personal, and that it is kept exactly as the page publishes it.
• Said that reading a connected website changes nothing on it, that deleting the website deletes the facts read from it, and that disconnecting stops them being used.
• Added the questions a business sets up to ask AI assistants. Carqo can send each one to an AI model provider, with the country, a town if the business chose one, and the timezone of its schedule.
• Said that a question is free text and can name a person, and that an answer can name people too. Answers are kept as they came back, for two years.
• Added answers a person pastes in by hand, who pasted them, and the other businesses a workspace asks Carqo to watch for.
• Added the server logs a business can upload to see which AI crawlers reached its site. Each visitor is kept as a keyed code and never as an address.
• Added the short explanations a model can write for a finding, and a model reading captured answers. Both happen only where the workspace has allowed them, and our AI model provider is the provider.
• Added the people a business invites into its workspace, and the emails that invite them. Added support cases and their files, privacy requests, and the emails Carqo sends about a workspace.
• Said that nothing deletes a support case or a privacy request automatically.
• Corrected one sentence of 3.6. It said a model can draft a support answer. Support answers and Ask Carqo are written by fixed rules, and Ask Carqo does not store the question you type.
• Brought the sign-in link, staying signed in and the record of sign-ins into this notice for a workspace.
• Corrected what the notice says about our website delivery service. For the signed-in product its request logs are switched off, and it keeps only the lines our own software writes.
• Took the company register out of this notice, because nothing in Carqo checks a company against it. Added the full stops that were missing where two sentences ran together.

Version 3.6

Took effect 5 October 2026. Not a material change.

• Took out the old marketplace product, which Carqo no longer runs. That covers number plates, registration lookups with the DVLA and the DVSA, listings, photographs and video, messages between users, price guidance, live broadcasts and the mobile app.
• Took out identity documents, passports, proof of address, trade insurance certificates and the safety and fraud reports that went with the marketplace. Carqo no longer asks for any of them, and the records that held them have been deleted.
• Took out the list of businesses we built from public sources, and the separate page that explained where we got those details. We have deleted the list.
• Took out the founding credit that was offered to people who registered interest, and the second sign-up route for trade businesses. A registration holds a name, an email address and a phone number if you gave one. It also holds the first part of a postcode and a short label for where your link came from.
• Took out the description of counting how many people arrive on this site, because nothing on this site counts them.
• Reworded how Carqo uses AI. Carqo asks AI assistants questions a business wrote and records what they answer. Where a business has allowed it, a model also explains a finding, drafts a support answer or reads the answers Carqo captured.
• Said that the only files we keep for a person are those they attach to a support request, and removed the retention periods for data that is no longer held.
• Reworded what you can ask us to do, so that each right describes only what Carqo holds now. The copy you can download is of your account, the websites you connected, what Carqo found on them, and the questions Carqo asked and the answers it recorded.

Version 3.5

Took effect 1 October 2026. A material change to the notice.

• We now keep the early-access requests people make on this site. We keep the email address you give us, the website address if you choose to give one, and the exact wording you acknowledged.
• Said what an early-access request does not do. It does not create an account, it does not subscribe you to marketing, and it does not give us permission to read your website.
• Said that the website and its forms run on our website delivery service, which also carries every request to it from machines all over the world. What you type passes through it on the way to our database in the United Kingdom, and we have set it up not to keep a copy.
• The former website service ran the website until 25 September 2026. We deleted the site we had there, including any early-access requests made through its form, and it no longer receives anything from this site.
• Added what Carqo does where a business connects the analytics it already runs. Carqo reads counts from Google Analytics and Google Search Console, and the service provider is named as where they come from. The counts identify no visitor.
• Added the enquiries and sales a business’s own system reports. We keep a reference, the date, the amount and where it came from. We keep nothing about the buyer.
• Named Shopify as somewhere Carqo can read a connected shop’s own catalogue from. We ask for nothing about the shop’s customers or orders.
• Reworded what you can ask us to do. Two of your rights are buttons only where you have an account, so each one now says what it does on a site with none.
• Showed each retention period only where that kind of information can exist, and added the period for early-access requests.

Version 2.12

Took effect 10 September 2026. A material change to the notice.

• Corrected what the table says a dealership receives from an assistant’s enquiry: your name, and the email address or telephone number you gave, and your message.
• The section about assistants already said this. The table did not, and the table is the part people check.
• Added that a dealership can also have that enquiry delivered to their own system, so it reaches whoever answers rather than a screen nobody is watching.
• Said that the delivery to their own system carries less than their Carqo screen does: not your name, not your contact details and not your message.

Version 2.11

Took effect 10 September 2026. A material change to the notice.

• Added a section about AI assistants passing on an enquiry, because dealerships can now let one do that.
• Said what reaches us: your name, one way to reach you, your message, and which car it was about.
• Said what does not: nothing about your device, your address or where you were.
• Said that a dealership which has issued no key cannot receive one of these at all, and can withdraw a key at any time.
• Said that we pass it on and answer nothing on the dealership’s behalf.
• Said that we publish none of it, in any feed or file or interface a machine can read.
• Said that after six months your name, your contact details and your message are erased together.

Version 2.10

Took effect 9 September 2026. A material change to the notice.

• Said that a dealership can put a small Carqo script on its own website, and that it counts what happens there.
• Said that the script stores nothing on your device: no cookie, no identifier, and nothing to accept or clear.
• Said that we keep the name of the event, the path of the page and the hostname you came from, and never your IP address or your browser details.
• Said plainly what that means: we count arrivals and events and cannot follow one person between them.
• Said that the script is on the dealership’s website rather than on ours, so blocking it there stops it.

Version 2.9

Took effect 9 September 2026. A material change to the notice.

• Said that we read a dealership’s own website when somebody asks us to check how well machines can read it, and that we keep what we found and short extracts showing why.
• Said we honour that site’s robots.txt before every page, and that a site asking crawlers to stay away is not read at all.
• Said we never copy photographs and never keep a registration number, and that where a plate is on a page we record only that one was there.
• Said that phone numbers, email addresses and postcodes are removed before anything from a scanned page is stored.
• Said plainly that a page title could carry somebody’s name, that no pattern reliably finds one, and that what protects it is how little text we keep rather than a filter.
• Said what we keep about a dealer who asks for a report, and that they can ask us to delete it or tell us to stop.

Version 3.0

Took effect 8 September 2026. A material change to the notice.

• Made consumer and business interest registration complete on first submission, without a confirmation link.
• Described the registration receipt and the internal email sent to Carqo when a new interest record is stored.
• Kept older confirmation links usable until they expire, while making clear that registration no longer depends on them.

Version 2.8

Took effect 8 September 2026. A material change to the notice.

• Said that we count how many people arrive and roughly where from: a search engine, a social network, a link somebody posted, or straight to us.
• Said we keep the name of a search engine or a social network where that is where you came from, and never the name of any other site, because another site can say something about you.
• Said we keep the page you landed on as a kind of page rather than as the address, so a registration you typed into a free check is never part of it.
• Said none of it identifies anybody and none of it puts anything on your device, which is why you are still not asked to accept anything.
• Said that if your browser sends Do Not Track or Global Privacy Control, nothing is counted, and said plainly that not every browser offers either setting.
• The section describing how we measure the site now appears from the first day the site is up, rather than only once the marketplace opens.

Version 2.7

Took effect 30 August 2026. A material change to the notice.

• Added what we record about an enquiry: whether it looked like a real approach to buy the car, and the short list of reasons behind that. We keep the reasons, never the words of the message.
• Said that we count how often an advert appears in search results, alongside the view count we already described. Both are numbers per advert per day and neither says who.
• Said that we count what people search for, as totals rather than as searches belonging to a person, including searches that found nothing.
• Said all of it is deleted with the enquiry, the advert or the account it belongs to.

Version 2.6

Took effect 30 August 2026. A material change to the notice.

• Said what we keep when you appeal a decision: what you wrote, and what we decided about it. The previous version described the decision and never the answer to it.
• Left it under the same heading as reports rather than giving it its own, because a decision and the answer to it are one thing and a person looking for both should find them together.

Version 2.5

Took effect 30 August 2026. A material change to the notice.

• Said that we count what people search for and enquire about, grouped by make, price band and postcode area, to work out which cars the marketplace is short of.
• Said the counts identify nobody, and that a group too small to report without identifying somebody is left out altogether.
• Said nothing is stored: the counts are worked out when somebody at Carqo asks for them, so deleting a saved search removes it from every future count.
• Corrected the trade prospect entry, which said the list was held outside the database. The contact details still are; where Carqo has got to with a business is now a row in the database, and a named individual’s details never enter it.

Version 2.4

Took effect 29 August 2026. A material change to the notice.

• Added the record of whether you told us you are selling privately or as a business. The previous version described how we work it out when you have not said, and never described what we keep when you have.
• Said that what is kept is the exact wording you were shown when you answered, not only which answer you gave, because the wording is the record of the statement you made.
• Said it is kept for as long as the account exists and goes with the account.
• Put a note beside the question itself on the selling pages, which had none.

Version 2.3

Took effect 26 August 2026. A material change to the notice.

• Added a section about Carqo Live, which carries live video and audio of you to the people watching, and keeps a replay where the host chose to keep one. The previous version did not mention it.
• Named the two services that carry it, both our website delivery service, and said what each receives: the live audio and video, and the recording where one is kept.
• Gave them their own rows rather than folding them into the our website delivery service row that was already there, because that one carries requests and stores nothing, and these hold video of a person.
• Said that nothing has been sent to either of them. Carqo Live is not switched on, and no session has ever run.
• Said that a question asked in a session is a message, and is treated as one.
• Said that nothing in a session reaches a model. We do not analyse what you say or how you look.

Version 2.2

Took effect 25 August 2026. A material change to the notice.

• Narrowed what we say about AI. The previous version said we do not permit our provider to train on your content. We can say what WE do, and we were not in a position to promise what they are contractually forbidden from doing, so we now say exactly what we send, what we never send, and that the terms are being confirmed.
• Rewrote the section on your age. It said an account is for people aged 18 or over, and nothing checked. It now says the paid and contractual parts of Carqo are for adults, that a seller passes an identity check against a document carrying a date of birth, and that we do not ask your age or verify it.
• Said that your account, your listings, your messages and every document you upload are kept in the United Kingdom, and that this is our choice rather than something the law requires.
• Named our website delivery service, which carries requests to and from the site and answers the www address, and said that it keeps no account, document or message.
• Said where photographs and documents are stored now that it is decided: the same London project as the database, in a private area nothing on the public web can reach.
• Gave a period to two things that had none: the vehicle records we cache from DVLA and DVSA, and safety reports once they are closed.
• Corrected the one-line summary above the Age section, which still said you have to be 18 to hold an account after the section itself stopped saying it.
• Put back the sentence saying the website you are reading is served from the United States. It went out with the London rewrite and it is still true.
• Stopped saying we look at the camera serial number and the location inside your photograph files to spot a trader. We do not, and we never have: every photograph is rebuilt from its pixels when you upload it, so none of that survives to be looked at. What we actually compare is a fingerprint of the picture.

Version 2.1

Took effect 25 August 2026. A material change to the notice.

• Added a section about the Carqo app, because Carqo has one. The previous version of this notice described the website only.
• Said what the app asks your phone for: your photo library, and only when you tap to add a photograph or a document.
• Said what it does not ask for: your location, your contacts, the camera, an advertising identifier, and no analytics or crash reporting of any kind.
• Said that the app keeps one thing on your phone, the token that keeps you signed in, in the phone’s own keystore.
• Said that when you download your data in the app, your phone’s share sheet decides where it goes and we are not told what you chose.

Version 2.0

Took effect 24 August 2026. A material change to the notice.

• Rebuilt as a privacy centre: a one-screen summary, the full notice, and a page in your account where the rights are buttons rather than an email address.
• The notice is now generated from a register of what Carqo actually does, so it cannot describe something that is not running or omit something that is.
• Added sections covering identity verification, phone numbers and the diverted call, messages, photographs and camera data, payments, AI, automated decisions, fraud checks and where your information goes. Each appears only once that part of Carqo is switched on.
• Added a complaint form, so complaining does not mean finding an email address.
• Said plainly that messages are not end-to-end encrypted and that we can read them when one of you reports the other.
• Said which suppliers are outside the UK, and which contracts are still being confirmed, rather than implying all of them are settled.

Version 1.1

Took effect 9 August 2026. Not a material change.

• Added our ICO registration number.

Version 1.0

Took effect 7 August 2026. Not a material change.

The first version.