Privacy Policy

This policy describes what CarabAI collects through this website, why, how long it is kept and how to have it removed. It describes the system as it is actually built.

What we collect, and when

Browsing the site

No account is required and no advertising or cross-site tracking cookies are set. A single functional cookie remembers a language choice; it is described below.

The AI Opportunity Audit

The audit can be completed without giving any contact details, and the complete result is shown without an email address. When you submit it we store your answers, the scores calculated from them, the risk signals detected, the generated result and the version of the audit engine that produced it. We also store the page you arrived from and any campaign parameters in the link you followed.

While you are still working through the questions, your answers are held only in your own browser tab and are not sent to us until you submit.

Two of the questions accept free text. You choose what to put in them. Please do not enter passwords, confidential customer data or sensitive personal information; if you type personal data there, it is stored with the rest of your answers.

Contacting us

This website has no contact form. It cannot receive, process or store an enquiry. The contact page offers two links that hand you over to software you already control: an optional booking link, and a mailto: link that opens your own email program with the address filled in.

If you write to us, your message reaches us the way any email does, through your email provider and ours. Nothing about that is handled by this website, and nothing you write is added to a mailing list.

Language preference

If you choose a language, we store that choice in a first-party cookie named carabai_locale. It is a functional cookie: it holds only one of four values (en, fr, de or es), is validated against that list on every request, lasts about a year, and identifies nobody. It is not used for analytics, advertising or tracking, so no consent banner is required for it. Clearing your browser cookies removes it.

Abuse prevention

To stop automated abuse we apply rate limits per connection, using a counter stored in our own database. Your IP address is combined with a secret value and hashed before storage, so the stored record cannot be read back as an address. These records expire with their window. No third-party bot-verification service is used.

What we do not collect

• No name, email address, phone number or company contact details. There is no form to enter them into.
• No marketing consent, because there is no mailing list.
• No advertising identifiers, and no cross-site tracking.
• No special category data. Please do not send any.
• No free-text answers in analytics. Company descriptions, notes, result tokens and full results are never sent to an analytics provider.
• No payment details are taken through this website.

How your audit result link works

Your result lives at a private address containing a random token with 256 bits of entropy. Only a hash of that token is stored, so the live links cannot be reconstructed from our database. The address contains no name, email address or database identifier. Result pages are marked not to be indexed by search engines, and lookups are rate limited so links cannot be guessed at volume.

The same link works in every language: adding a language prefix shows the same stored result translated, and never creates a new audit.

Anyone holding the link can view the result, so treat it as you would any private link.

How long we keep things

• Audit results stay reachable through their link for the configured retention period, after which the link stops working.
• Rate-limit records expire with their window, within hours.
• Any email you choose to send us is kept in our mailbox while we are in contact and for as long as we need it for our own records. That is ordinary correspondence, not something this website stores.

Automated processing

Your audit scores, the risk signals and the recommendations are all calculated by fixed, published rules applied to your answers. No language model is involved at any point, and no free-text answer is interpreted: what you write is stored and shown back to you, but it does not affect any number or recommendation. None of this produces a decision with legal or similarly significant effects.

Who else is involved

This list is short because the site is built to keep it short. Your audit answers are processed on our own server and are not sent anywhere else.

• Our hosting and database provider, which stores the data described above.
• No language model provider. Your audit result is generated entirely by our own code. No AI service receives your answers, your scores or your result.
• No email provider. This website sends no email at all, so no email service receives anything about you.

Links to live demonstrations and profiles

Some pages link to systems that run outside this website. Nothing loads from them until you click, and nothing is embedded in our pages. Following one of these links takes you to that service, where its own privacy policy and terms apply.

Voice interactions with Laura may be recorded, transcribed and stored by Retell and may be accessible to CarabAI for operating and reviewing the demonstration. Do not share confidential, sensitive or personal information.

When you contact the MagicConnect demonstration through WhatsApp, your WhatsApp phone number, profile information and the message you send may be visible to the receiving account and processed by WhatsApp/Meta and MagicConnect.

Interactions with the virtual assistant may be processed and stored by MagicConnect and the AI and service providers it has configured.

Upwork and Malt host the founder’s independent freelancing profiles and apply their own policies once you are on their sites.

CarabAI does not append your audit answers or audit-result token to these external links. When you open or use a third-party service, that provider receives technical and interaction data according to its own privacy policy. Because these are ordinary links rather than embedded content, they set no cookies on this site.

Analytics

Analytics are off by default. If they are enabled, the provider is privacy-conscious and only a fixed list of non-identifying properties may be sent: which page an action came from, which step of the audit was reached, and coarse score bands. A runtime filter enforces that list, and values that look like an email address or a long digit sequence are discarded before sending. Free-text answers, result tokens and full reports are never sent. Where consent is required, nothing is sent until you agree.

Your rights

You may ask what is held about you, ask for it to be corrected or deleted, or object to its processing. Because the site collects no contact details, the practical way to identify an audit is to send us the result link. Write to the address in the legal notice and we will respond.

Changes

If this policy changes materially, the revision date above changes with it. We do not silently broaden what is collected.