Privacy
Privacy and data handling
What personal and client data CarveOutIQ holds, why, where it is stored, and how confidential deal information is protected.
Last updated: 9 November 2026
Who we are
CarveOutIQ is operated by Apollo Consulting Solutions Limited, a company registered in England and Wales (company number 15453719), registered office 12 Little Street, Guildford, GU2 9QG. For website visitors and account users, Apollo is the data controller under the UK GDPR and the Data Protection Act 2018.
For deal information a client enters into the platform, the client decides what is entered and why, and Apollo processes it on the client's behalf under the client terms.
Contact: contact@carveoutiq.com
What we collect
| Data | Examples | Source |
|---|---|---|
| Enquiries | Name, work email, company, message | You, when you email us or use a contact form |
| Account data | Work email, login credentials (password stored only as a secure hash by our authentication provider), login times | You, when we issue access |
| Deal data | Deal profile, scores, scenarios, saved versions, exports | Users at a client, entered into the platform |
| Technical data | IP address, browser type, server and error logs | Collected automatically when you use the site or app |
We do not ask for special category data, and deal data should not include personal data about individuals beyond what a deal assessment needs. The website and app use Vercel Web Analytics to count page visits; it does not set cookies. The website's font is loaded from Google Fonts, which receives your IP address when a page loads. The app stores only what is needed to keep you signed in.
How we use it
| Purpose | Lawful basis |
|---|---|
| Reply to enquiries and arrange demos | Legitimate interests |
| Provide accounts, authenticate users, run the platform | Contract with the client |
| Keep the service secure and fix faults | Legitimate interests |
| Build anonymised benchmarks from deal data | The client's written agreement in the client terms (see below) |
| Meet legal and tax obligations | Legal obligation |
We do not sell personal data, use it for advertising, or share it with third parties except the service providers listed below.
How we protect client deal data
Deal information is treated as confidential client information.
- Access: only approved users can sign in, using credentials we issue. Each saved deal is visible only to the account that created it; this is enforced by access rules in the database, not just by the app's screens.
- Encryption: data is encrypted in transit (HTTPS) and at rest by our hosting and database providers.
- Our access: CarveOutIQ staff do not view a client's saved deals except to provide support the client has asked for.
- AI services: deal data is not sent to any AI model provider, and is never used to train AI models. If we introduce document extraction using an AI service, we will update this page and the client terms first.
- Benchmarking: deal data is pooled for benchmarking only where the client has agreed in writing in the client terms. We use derived figures only, never raw inputs or deal names. A benchmark is shown only when it draws on at least five deals, and a client can withdraw its data from future benchmarks at any time.
- Certifications: we do not currently hold SOC 2 or ISO 27001 certification. We will answer security questionnaires on request.
Where data is stored
| Provider | What it does | Location |
|---|---|---|
| Supabase | Database and user authentication | West Europe (London) region |
| Vercel | Hosts the website and app | Global edge network; delivers the site's files only, and deal data is not stored on Vercel |
| Microsoft 365 | Business email | UK |
Some providers may process data outside the UK, for example for support or service delivery. Where they do, we rely on UK adequacy regulations or the UK International Data Transfer Agreement or Addendum. Vercel is certified under the UK Extension to the EU-US Data Privacy Framework, and both Vercel and Supabase include the UK International Data Transfer Addendum in their data processing agreements.
How long we keep it
- Enquiries: up to 24 months after our last contact, unless you become a client.
- Accounts: while access is active, then deleted within 90 days of access ending.
- Deal data: for the term of the client agreement, then deleted within 90 days unless the client asks for earlier deletion or an export. Anonymised benchmark figures the client agreed to contribute may be kept.
- Logs: as set by our providers, typically 30 days.
- Business records: as required by UK company and tax law.
Your rights
You can ask to access, correct or delete your personal data, to restrict or object to how we use it, or to receive a copy in a portable format. Email contact@carveoutiq.com and we will respond within one month. If your data is held as part of a client's deal data, we may refer your request to that client.
If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
Changes to this page
We will update this page when our services or providers change, and show the date of the latest version here. When Cleave Partners Ltd takes over operation of CarveOutIQ, this page will be updated to name it as the controller.