How Carno AI collects, uses, shares and protects personal information.

01Personal Data we collect

02Where Personal Data comes from

03Why we use Personal Data and our lawful bases

Where we rely on legitimate interests, we consider the purpose of the processing, whether it is necessary and whether your interests, rights and reasonable expectations override our interests. You can object to processing based on legitimate interests, and you have an absolute right to object to the use of your Personal Data for direct marketing.

04Business-to-business outreach

Carno AI may contact relevant people at businesses where we reasonably believe our services may be relevant to their professional role. UK data-protection law can apply to this activity where we use information that identifies a business contact, even where the information is publicly available.

For electronic marketing, we distinguish between corporate subscribers and individual subscribers. Corporate subscribers include companies and limited liability partnerships. Sole traders and certain partnerships are treated as individual subscribers and have stronger protections under PECR. We do not intend this notice to authorise outreach that would require consent under PECR. If we are unsure whether contact details belong to an individual or corporate subscriber, we should apply the more protective approach.

We identify ourselves in our outreach and provide a practical way to ask us to stop. If you object to direct marketing, we will stop using your Personal Data for that purpose. We may retain a minimal suppression record so that we can respect your request in future.

05Meetings and Fireflies

Carno AI may use Fireflies.ai to record and transcribe business meetings. Recording is not silently enabled: the Fireflies assistant is admitted/allowed into the meeting by Carno AI, and attendees receive a meeting-chat message informing them that recording is taking place and explaining how recording can be stopped if needed or wanted.

Meeting recordings and transcripts are used for accurate notes, action items, follow-up and maintaining a record of relevant business discussions. Routine Fireflies recordings/transcripts are normally retained for up to 90 days unless there is a documented reason to retain a particular record for longer. Important decisions or actions may be transferred into the appropriate business record before the recording/transcript is deleted.

06Who we share Personal Data with

Carno AI uses service providers to operate its business. Depending on the interaction, these may include providers of business email and productivity tools, scheduling/calendar services, meeting transcription, CRM/database services, hosting, automation infrastructure and AI/API services. We only disclose information that is reasonably necessary for the relevant purpose.

For client automation services, production workflows will generally operate within technology environments owned or controlled by the client. This may include the client's automation platform, email or productivity environment, CRM/database, calendar services and other connected systems. Those providers may therefore be contracted directly by the client rather than by Carno AI.

Carno AI may be granted authorised access to those client-controlled systems for purposes such as implementation, configuration, testing, monitoring, troubleshooting, maintenance and support. Such access does not change the client's role as controller where the client determines the purposes and essential means of the processing.

Where Carno AI itself engages another provider to process client Personal Data on Carno AI's behalf, that provider is treated as a subprocessor and is governed by the applicable Data Processing Agreement and Carno AI's Subprocessor Register.

We may also disclose Personal Data where reasonably necessary to comply with law, protect legal rights, investigate security incidents, obtain professional advice, or deal with a business restructuring or transfer subject to appropriate safeguards.

07International transfers

Carno AI operates as an Australian business and uses technology providers that may process information in the United Kingdom, European Economic Area, United States, Australia and other locations. This means Personal Data relating to people in the UK may be transferred internationally.

Where Carno AI is responsible for a restricted international transfer under applicable UK data-protection law, we seek to rely on an applicable UK adequacy regulation or appropriate safeguards such as the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or another lawful transfer mechanism, together with any assessment required by law.

Client automation systems may also use technology providers selected or contracted directly by the client. The client, as controller, is responsible for assessing the transfer arrangements applicable to providers it engages directly, although Carno AI may assist with relevant technical information where appropriate.

Where Carno AI appoints a subprocessor on the client's behalf, the international-transfer requirements applicable to that subprocessor are addressed through the relevant contractual and data-protection arrangements.

08How long we keep Personal Data

These are standard retention positions rather than a promise to keep every record for the full period. We may delete information earlier where it is no longer needed and may retain it longer where a specific legal, regulatory, security or dispute-related reason requires this.

09Cookies and website tracking

Carno AI does not currently use website analytics, advertising pixels or similar non-essential tracking technologies. The website or its hosting infrastructure may still use technologies that are strictly necessary to provide functionality, security or communications requested by the user. If Carno AI later introduces non-essential analytics, advertising or similar tracking, we will update our privacy/cookie information and implement any consent mechanism required by applicable law before using those technologies.

10Your data-protection rights

Depending on the circumstances, UK data-protection law may give you rights to be informed about processing; access your Personal Data; correct inaccurate information; request erasure; restrict processing; receive certain data in a portable format; and object to processing. Where processing relies on consent, you can withdraw that consent without affecting processing that was lawful before withdrawal.

Direct marketing. You have the right to object at any time to the processing of your Personal Data for direct marketing. If you make that objection, we will stop processing your Personal Data for that purpose.

To exercise a privacy right or ask a question, contact admin@carnoai.com. We may need to verify your identity before acting on a request.

11Complaints

Please contact Carno AI first if you have a privacy concern so that we can try to resolve it. If UK data-protection law applies to your Personal Data, you may also have the right to complain to the UK Information Commissioner's Office (ICO).

12Security

Carno AI uses technical and organisational measures designed to protect Personal Data against unauthorised access, disclosure, alteration, loss and destruction. These measures include access controls, credential protection, encrypted transmission where appropriate, data minimisation, retention controls, backups where applicable, and incident-response procedures.

Where client automation systems operate within client-controlled infrastructure, security responsibilities are shared according to the relevant system and contractual arrangements. Carno AI applies appropriate controls to its own access to those environments, while the client and relevant technology provider remain responsible for the aspects of the environment they control.

No system can guarantee absolute security.

13Changes to this notice

We may update this Privacy Notice when our services, systems, providers or legal obligations change. The current version will be made available through carnoai.com. Material changes will be reflected by updating the effective date and version.

14Contact Carno AI

Carno AI does not publish the controller's residential address in this Privacy Notice. If additional contact or representative information is legally required for a particular processing activity, Carno AI will provide it through the appropriate channel.