Privacy Policy

This policy explains what personal data CARMON collects, why we collect it, and how you can exercise your rights. CARMON is operated by Richard Shaw. If you have questions, contact us at hello@carmon.co.

1. What data we collect and why

Email address — When you sign up for early access on carmon.co, we collect your email address. We use this to send updates about CARMON and to contact you when access is available. The legal basis is your consent, which you can withdraw at any time by emailing us or using the unsubscribe link in any email we send.

Usage analytics — We use Google Analytics to understand how people use the site (pages visited, time spent, general location by country). Google Analytics sets cookies and collects your IP address, browser type, and device information. This data is aggregated and pseudonymous — we cannot identify you individually from it. The legal basis is our legitimate interest in improving the product.

Uploaded files — If you use the CARMON tool, you may upload a spreadsheet (bill of materials). This file is sent to our servers for processing and the results are returned to your browser. We do not store your uploaded file or its contents. The data exists in memory only for the duration of the calculation (typically under one second) and is discarded immediately after.

2. Cookies

We use cookies only for Google Analytics. These are analytics cookies that help us understand aggregate traffic patterns. No cookies are used for advertising or tracking across other websites. You can disable cookies in your browser settings; this will not affect your ability to use the tool.

3. Third-party services

We use a small number of third-party services to run CARMON:

Google Analytics — website analytics. Data processed in the US under Google's EU-US Data Privacy Framework certification. Google Privacy Policy.
Mailchimp — email list management. Your email address is stored on Mailchimp's servers. Mailchimp Privacy Policy.
Vercel — website hosting and infrastructure. All web requests pass through Vercel's servers and may appear in server logs. Vercel Privacy Policy.

We do not sell your personal data to third parties and never will.

4. How long we keep your data

Email addresses on our early access list are kept until you unsubscribe or ask us to remove you. Google Analytics data is retained for 14 months (Google's default). Server logs on Vercel are retained for 30 days.

5. Your rights

Under UK GDPR, you have the right to:

Access the personal data we hold about you
Ask us to correct inaccurate data
Ask us to delete your data ("right to erasure")
Withdraw consent for email communications at any time
Lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk

To exercise any of these rights, email hello@carmon.co. We will respond within 30 days.

6. Security

CARMON is served exclusively over HTTPS. We apply security headers (HSTS, Content-Type Options, Frame Options, Referrer Policy) to all pages. We maintain a security contact at carmon.co/.well-known/security.txt for responsible disclosure.

7. Changes to this policy

If we make material changes to this policy, we will update the "Last updated" date above. We encourage you to review this page periodically.

This policy covers carmon.co only. If you have questions or concerns about how your data is handled, please contact us at hello@carmon.co.