Privacy
How we use personal data, how long we keep it and your rights.
Doing something about it
Every one of these opens a case with a deadline. Write to us and it starts the same clock as a button would.
Who is responsible for your information
The data controller is MZ Corp Limited, trading as Carqo. Company number 17351738.
Our registered office is 128 City Road, London, EC1V 2NX.
Our ICO registration number is ZC208622.
What this notice covers
It covers information you provide, information generated when you use Carqo, and public information used for reports.
The free AI visibility report
We use your website, business name and email. We read the public page title and description, and the town or region in a local business’s address details, to prepare four report questions. A model reads that text to choose the kind of business, from a fixed list. It also lists the businesses the answers named.
An AI answer collection service sends the questions to ChatGPT and Gemini and searches Google for them. The questions may identify a sole trader.
The free AI visibility report
To show whether ChatGPT, Gemini and Google AI Overviews mention your business when customers ask, which websites they rely on, and what to fix.
Our legitimate interests. Answering the report the visitor asked for, and stopping one address running reports in volume.
Deleted 30 days after it was made, with the email held on it. Anyone with your report link can read it until then.
Data and sharing
- Personal data
- your website, business name and email address, the public page title and description, the town or region on the home page, and up to five rival websites if you add them, four questions built from those, which can identify a sole trader, the answers ChatGPT, Gemini and Google gave, which can name other businesses, with the addresses of their sources, the addresses of up to 25 pages of your website, read only where its robots.txt allows, and the problems found, with the page text dropped, the kind of business and the business names a model picked out of the answers, which can name people.
- Also shared with
- AI answer collection services, Email delivery services, AI model providers
- Automated decisions
- It helps, a person or a fixed rule decides. A model is involved, within the limits in the AI section.
- Your choices
- Ask us to delete a report before its time is up.
Marketing email after a free report
To email a business about Carqo, once a few days after its free report, only if it ticked the box asking us to. We email only an address on the website’s own domain.
Your consent. This is optional.
Kept for 1 year from the latest report, then deleted. The stop link in the email deletes it at once.
Data and sharing
- Personal data
- email address, business name and website, when we emailed, and a record that lets a stop link be honoured.
- Also shared with
- Email delivery services
- Your choices
- Press the stop link in any email. Turn marketing off in your Carqo account.
Confirming your email address for a free report
To check that the address typed into the form is the sender’s, with a code or a link in an email, and that a person and not an automated program is starting the report.
Our legitimate interests. Making sure a report starts only for an address whose owner asked for it, and stopping automated programs from starting reports.
The request is deleted about an hour after the form is sent, whether or not it was confirmed.
Data and sharing
- Personal data
- email address, business name, website and marketing choice, held as one request, a six-digit code and a link sent to the address, browser details read by a challenge on the page, which our website delivery service checks and we do not store, your place in the form, kept only in your browser for the session.
- Also shared with
- Email delivery services
Reading a business website
We read public business website pages and keep findings, page addresses and short extracts. Public pages can contain names or other personal data. We follow the website’s crawler restrictions.
The free AI readiness check is the exception. It reads the website you type, shows the result in your browser and keeps neither the address nor the result.
Scanning a business website
To report how well automated systems can read a business’s own website.
Our legitimate interests. Telling a business how machine-readable its published website is, at its own request.
Kept while the site is a live prospect or a customer, then deleted with the site record. Page extracts are capped at 200 characters each.
Data and sharing
- Personal data
- the website address, the facts the business published such as what it offers, prices and locations, and short extracts of page text with contact details and full postcodes removed.
- Your choices
- Ask us to delete a scan of your website.
Asking Carqo to check your website
To reply to you with what the check found, and to talk to you about it.
Our legitimate interests. Replying to a business that asked for a report about its own website. This is optional.
Kept while you are a prospect or a customer, and deleted when the enquiry is closed.
Data and sharing
- Personal data
- business name, your name, email address, and the website address and phone number where you give them.
The free AI readiness check
To read the robots.txt file, home page and one sitemap of the website you type, and show the result in your browser.
Our legitimate interests. Giving a visitor the check they asked for, and limiting how often one caller can use it. This is optional.
We keep neither the address you typed nor the result. The record of your network address is removed within two days.
Data and sharing
- Personal data
- a limited record of your network address, with a count and times, to limit use.
Your account
You can create an account with your email address or your Google account. We send a single-use link or code to prove the address is yours, and one strictly necessary cookie keeps you signed in. Creating an account sends nothing to an AI provider and does not put you on a marketing list.
We keep your account until you ask us to close it, then erase it within 30 days. Use the contact form under Privacy and my data for a copy, a correction or deletion.
Your account and signing in
To create your email-verified account and let you sign in and out, with a single-use link or six-digit code in an email, or with your Google account.
To provide what you asked for.
The link and the code last 15 minutes and work once. The account is kept until you ask us to close it, then erased within 30 days. We keep no Google access token.
Data and sharing
- Personal data
- email address, account identifier, when you signed up and last signed in, and your name and company if you give them, the link and the code, held in a protected form, and a limited record of the network address you asked from, from Google, the verified email address and name on your Google account.
- Also shared with
- Email delivery services, Sign-in services a person chooses
- Your choices
- Ask for a copy, a correction or deletion. Use email sign-in instead of Google.
Measuring the site
There is no Google Analytics here, no Meta pixel and no advertising identifier. Pages on this site do not ask your browser to contact another company, apart from the page where you start a free report. On that page your browser loads a check from our website delivery service. Your browser also goes to another company when you choose something that needs it. If you choose Continue with Google, you go to Google.
Cookies
We set no cookies while you are signed out. Signing in sets one strictly necessary cookie containing a session reference.
We ask for consent before using cookies that require it. You can sign out to end your session.
Staying signed in
To keep you signed in until the session ends or you sign out.
To provide what you asked for.
Ends 30 days after it was issued, or when you sign out.
Data and sharing
- Personal data
- one strictly necessary cookie holding a session reference, and the session record behind it.
Emails, and turning them off
You can withdraw your consent to marketing, or object to it, at any time using the unsubscribe link in any email, the marketing setting in your Carqo account, or by contacting us.
We keep a limited record of your preference after deletion so we do not contact you again. Service messages and replies to your requests continue.
| Stops | Keeps coming |
|---|---|
| Launch news and anything promoting Carqo | A reply to something you asked us |
| Anything about a product we would like you to use | A notice we are required to send you |
Who else sees it
We share personal data with the service categories below to provide Carqo. We do not sell it or share it for third-party advertising.
We name the specific suppliers on request.
| Who | What they do | Where and safeguards |
|---|---|---|
| Website delivery and security services | Deliver the website, handle requests and protect it from misuse. Acts only on our instructions. Requests may be handled worldwide. If its certification lapsed, its agreement applies the standard contractual clauses with the UK Addendum. | Wherever you are. Their machines are worldwide UK Extension to the EU-US Data Privacy Framework |
| Data storage services | Store and manage the information needed to provide Carqo. Acts only on our instructions. UK storage does not establish that support access from outside the UK is excluded. | United Kingdom No restricted transfer recorded |
| Email delivery services | Deliver service messages and permitted marketing emails. Acts only on our instructions. It processes mainly in the United States. | United States Standard contractual clauses with the UK Addendum |
| Email inbox services | Host the Carqo inbox and the mail sent to Carqo addresses, so a person can reply to a request. Acts only on our instructions. If its certification lapsed, its terms apply the standard contractual clauses with the UK Addendum. | Wherever you are. Their machines are worldwide UK Extension to the EU-US Data Privacy Framework |
| AI answer collection services | Send questions to ChatGPT, Gemini and Google and return their answers. Acts only on our instructions. Receives the free report questions, and the questions a paying business or a business on a free trial sets up or builds from its own description, but not your email address. For the free report, the questions also reach ChatGPT, Gemini and Google. For a paying business or a business on a free trial, they reach ChatGPT, Gemini and Google AI Overviews. The questions may contain personal data. The company has its seat in Estonia. Where it processes the questions and the data processing agreement are not confirmed. | Not confirmed. The company has its seat in Estonia. Safeguard not yet confirmed |
| AI model providers | Write short explanations of findings, read the AI answers Carqo captured, and choose which figures answer a question on Ask Carqo, each only where a workspace allows it. Acts only on our instructions. It reads the free report’s home page text and answers. In the signed-in product it writes short explanations and chooses which figures answer a question on Ask Carqo, only where the workspace allows it. Ask Carqo is on for a paid workspace until it is switched off. It never receives a payment detail or a sign-in link. | United States Standard contractual clauses with the UK Addendum |
| Courts, police and regulators | Where the law requires or permits it. A public body, where the law requires it. This has never happened. | United Kingdom No restricted transfer recorded |
The law, courts and the police
We would disclose information where the law requires it, for example under a court order, or where it is necessary to prevent or detect a crime. That has never happened.
We disclose what the request lawfully reaches and no more, and we tell you unless we are prohibited from doing so.
If Carqo is sold or closes
If the business were sold or merged, your information would transfer with it and the buyer would be bound by this notice until they told you otherwise.
Where your information goes
Records are stored in the United Kingdom. This does not mean all handling or support stays in the UK.
The table above gives the region and the transfer safeguard for each recipient. Where a safeguard has not been confirmed, we say so and do not claim it is in place.
Contact us for details or a copy of applicable safeguards.
Security measures
We protect personal data using encryption in transit and at rest, restricted access and safeguards against misuse.
We notify affected people and the regulator of personal data breaches where the law requires.
The record of sign-ins and actions on your account
So a dispute about who did what has an answer, and so we can investigate abuse.
Our legitimate interests. Being able to answer what happened on an account, which protects the account holder as much as us.
365 days from the event. The record that an erasure happened is kept after the erasure.
Data and sharing
- Personal data
- the action, the account, the time, and the member of staff where one acted.
Limiting how often one caller can ask
To stop one source flooding a form or a route, so the site stays usable for everybody else.
Our legitimate interests. Keeping forms and routes available.
Kept for up to two days, then deleted.
Data and sharing
- Personal data
- a limited record of the network address, account or workspace, a count, and the time the window closes.
How long we keep things
The table gives the retention period for each type of information. Contact us to request deletion where your rights apply.
| What | How long | From when, and why |
|---|---|---|
| Early-access requests | 24 months at most | Counted from the day we received the request. The form is closed and takes no new requests. Or earlier, when the enquiry is closed or you ask us to delete it. The copy emailed to the Carqo inbox is not covered by that period, and we delete it by hand when you ask |
| Your account | For as long as you have one | Erased within 30 days of asking |
| A sign-in link | 15 minutes | Single use, then deleted |
| Staying signed in | 30 days from issue | Sign-out ends the session immediately. An erasure request revokes it. |
| The record of sign-ins and actions | 365 days | From the event. No account is flagged for fraud, so every record is kept for the same period |
| A demo request | 1 year | From the day you made it. The copy in the Carqo inbox is deleted by hand when you ask |
| A free AI visibility report, with the findings from your pages | 30 days | From when the report was made, with the email held on it |
| The email address kept for marketing after a free report | 1 year | From the latest report, and only if you ticked the box |
| Backups | 35 days | An erased record is never restored to live from one |
| Request-limit records | Up to two days | Then deleted |
What you can ask us to do
These are free, you do not have to give a reason, and we will not ask for one. We answer within one month.
See what we hold about you
Ask us for a copy of everything we hold about you, and we will send it.
UK GDPR Article 15
Correct something that is wrong
Tell us what is wrong and what it should say, and we will fix it.
UK GDPR Article 16
Delete what we hold about you
Ask us and we delete it. You do not have to give a reason.
UK GDPR Article 17
Pause what we do with it
Ask us to keep your information but stop using it while something is being sorted out.
UK GDPR Article 18
Take it somewhere else
Get the information you gave us in a machine-readable file you can hand to somebody else.
This right covers what you gave us.
UK GDPR Article 20
Object to something we do
Where we rely on our own legitimate interests, you can object and we have to stop unless we can show a compelling reason not to.
UK GDPR Article 21
Stop the marketing
An absolute right, with no balancing and no reason needed. It takes effect at once.
It stops marketing. It does not stop a reply to something you asked us, because that is not marketing.
UK GDPR Article 21(2)
Ask about an automated decision
Ask us to explain a decision, tell us why you think it is wrong, and have a person look at it again.
Nothing on Carqo currently decides something significant about you without a person or a fixed rule in the path.
UK GDPR Article 22
Complain about how we handled your information
Open a complaint with us. It gets a reference and a deadline, and you can see where it is up to.
UK GDPR Article 77 gives you the separate right to complain to the ICO
Where we need to be sure it is you, we ask for the least that will do. We do not ask for identity documents to answer a request about an email address you can already prove you control.
If you are unhappy with us
You can complain to us and we have to take it. There is a form rather than an email address you have to hunt for, and it creates a case with a reference so you can see where it is up to.
You do not have to complain to us first. Going to the regulator instead costs you nothing and affects nothing else. The Information Commissioner's Office regulates data protection in the UK.
- Our ICO registration number is ZC208622
- Helpline 0303 123 1113
- Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Age
Carqo is for adults. The paid parts are for people 18 or over. We do not ask your age or verify it, and we do not knowingly hold information about a child.
If you believe we hold information about a child, tell us and we will delete it.
Changes to this notice
We publish the updated version and explain changes. We inform affected people before a material change takes effect.
Browsing the site is not consent. A notice update does not change consent you already gave.
Contacting us about your information
For privacy questions or requests, email hello@carqo.co.uk or use the contact form under Privacy and my data.
You can also write to MZ Corp Limited, 128 City Road, London, EC1V 2NX.
Asking for a demo
To arrange the demo you ask for, and to keep a record of what was asked and answered.
Our legitimate interests. Answering the person who asked for a demo. This is optional.
Kept as a support case for 1 year, then deleted. The copy in the Carqo inbox is deleted by hand when you ask.
Data and sharing
- Personal data
- your name, email address, business name and website, and what you tell us you would like to see, a copy of the request emailed to the Carqo inbox once you confirm your address.
- Also shared with
- Email delivery services, Email inbox services
- Your choices
- Ask us to delete your request.
Early-access requests
The early-access form is closed and takes no new requests. These are the requests made before it closed. We use your email and optional business website to respond, and a request did not create an account or authorise access to your website.
A copy of your request is emailed to the Carqo inbox, which an email service hosts. That copy is not removed when the enquiry is deleted, and we delete it by hand when you ask.
Early-access requests
To keep and answer the requests made before the form closed.
Our legitimate interests. Responding to the request you made. This is optional.
Kept for up to 24 months from the day we received it, or until the enquiry is closed or you ask us to delete it. The copy in the Carqo inbox is deleted by hand when you ask.
Data and sharing
- Personal data
- email address, optional business website.
- Also shared with
- Email delivery services, Email inbox services