Legal

Privacy notice

This notice explains how Carse AI handles personal data about people who visit this site, get in touch, or buy work or coaching.

Who is responsible

The data controller is Noel Pope, trading as Carse AI, Edinburgh (postal address on request). Contact: hello@carse.dev. ICO registration: in progress.

What we collect, why, and on what legal basis

• Enquiries. Your name, business, email, phone and what you tell us about your needs. Used to reply and arrange a call. Basis: our legitimate interest in answering people who contact us, or steps you ask for before a contract.
• Business clients. Contact details of the people we deal with at a client business, and project notes. Used to deliver, support and invoice the work. Basis: our legitimate interest in running the contract with your employer (you are not the contracting party).
• Individual customers. If you contract with us personally (for example coaching), your name, contact details, booking and payment records. Basis: performance of a contract with you.
• Accounts and legal duties. Invoices, payment records and correspondence kept for tax and accounting. Basis: legal obligation.
• Business prospects. We may contact businesses about our services. We use company contact details published on the business's own website or on Companies House (usually a general address such as info@, and the business name, sector and town), and notes of any conversation. We email only companies, LLPs and Scottish partnerships without prior consent, and screen calls against the Telephone Preference Service. Basis: our legitimate interest in telling businesses about relevant services. You can object at any time, and we will stop and keep a minimal record so we don't contact you again.
• Marketing updates. If you ask to hear from us, your email address. Basis: consent, which you can withdraw at any time by replying "unsubscribe".

Data we get from someone else. A client may give us names and work email addresses of their staff, for example to set up accounts or run training. Where we hold that data as controller, we tell those people how we use it within a month of receiving it, or earlier if we first contact them or share their data with someone else before then. We don't need to do this if they already have this information, for example because the client has already given it to them.

If you don't provide it. We can't reply to an enquiry without a way to contact you, and can't deliver or invoice work without the details needed to do so. Marketing data is always optional.

Who we share it with

Only the services needed to run the business, each under a contract that limits what they can do with your data: Cloudflare (website hosting, and routing of email sent to hello@carse.dev), Google (the mailbox that email is delivered to and replied from), GitHub (private storage of business records), our self-hosted analytics (no personal data), and our accountant. If a booking, payment or accounting service is added, it will be listed here first. We also share data where the law requires it, for example with HMRC. We never sell personal data.

Transfers outside the UK

Some of the services above may store data outside the UK. Where that happens, the transfer is protected by UK adequacy regulations (for the EU and the US under the UK Extension to the EU-US Data Privacy Framework, where the provider is certified) or the UK International Data Transfer Addendum in the provider's terms. You can ask for details.

Client data inside projects

Where we handle your customers' or staff's personal data while setting up AI tools, we act as your processor under a written data processing agreement, signed before work starts. That agreement, not this notice, governs that data.

How long we keep it

• Enquiries that don't lead to work: 12 months after our last contact.
• Tax and accounting records, including invoices: 5 years after the 31 January Self Assessment deadline for the tax year they relate to, as HMRC requires.
• Other client records (proposals, project notes, correspondence): 6 years after the work ends, so that any claim under the contract can be answered (this period will be confirmed when a solicitor reviews these terms).
• Business prospect records that don't lead to work: 12 months after our last contact. "Do not contact" records: kept as long as needed to honour the request (name of the business and the address only).
• Marketing updates list: until you unsubscribe, or 24 months after your last interaction.

Cookies and analytics

This site sets no cookies. We count visits with Plausible Analytics, which we host ourselves on our own server. It sets no cookies and stores nothing that identifies you: your IP address is only used to make an anonymous ID that changes every day, and isn't kept. We use the totals (pages viewed, where visitors came from) to improve the site, which is our legitimate interest. Fonts are served from this site, not from a third party. If we ever add cookies or other tracking, we will ask for your consent first, and update this notice.

Your rights

You can ask to see the data we hold about you, have it corrected or deleted, restrict how we use it, withdraw consent where we rely on it, and, where we process your data by automated means under a contract or consent, receive it in a portable format. Email hello@carse.dev. We respond to rights requests within one month.

Your right to object

Where we rely on legitimate interests, you can object at any time to our use of your data, and we will stop unless we can show compelling legitimate grounds that override your interests. You can object to direct marketing at any time, and we will always stop. Email hello@carse.dev.

Complaints

If you are unhappy with how we have handled your data, email hello@carse.dev. We will acknowledge your complaint within 30 days, investigate it, keep you updated, and tell you the outcome without undue delay. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

Last updated 3 November 2026.