Privacy Policy

Who is responsible for your data

[to be added before publication], tax number [to be added before publication], [to be added before publication], is responsible (the “controller”) for the personal data described here. Write to [email protected] about anything in this policy.

What we collect

• Account details: your name, email address and profile picture, and how you sign in. Sign-in is handled by Clerk.
• What you put into Cavioo: the websites you audit, journey descriptions, sign-in details for test accounts, comments, and the people you invite to a project.
• What the robot records: screenshots, page text and measurements of the sites you audit, and a record of each step it took. If an audited page shows personal data, such as a name on an account page, it will appear in the screenshots.
• Billing details: your name, billing address, tax or VAT number, your plan and what you have bought. Card details go directly to Stripe; we never see your full card number.
• Technical data: your IP address, browser and device type, and records of requests to our servers, which we use to keep Cavioo secure and working.
• Messages: emails you send us and emails we send you.

Why we use it, and on what legal basis

• To provide Cavioo: run your audits, show your reports and send you service emails, for example when an audit needs you. Legal basis: our contract with you.
• To take payments and keep accounting and tax records. Legal basis: our contract and our legal obligations.
• To keep Cavioo secure, prevent abuse (such as audits of sites without permission) and fix problems. Legal basis: our legitimate interest in running a safe service.
• To improve the robot and our scoring, using what we learn across audits. Legal basis: our legitimate interest. We do not publish your reports or tell anyone which sites you audit, apart from the page addresses we send Google’s Chrome UX Report to measure their speed (see “Who else sees your data”).

We do not sell your data, we do not show ads and we do not send marketing emails. If we ever want to, we will ask you first.

AI analysis

To run your audits and write their reports, we send the journey you describe, screenshots and page text to AI model providers, who return their answers to us. If your journey includes a password for the site, it goes to them too, so the robot can sign in. Sign-in details you give us are masked before anything is recorded.

Reports are produced automatically, but no decision with legal or similarly significant effects on you is made by automated means.

Who else sees your data

We use these outside services to run Cavioo. Apart from Google’s fonts and icons, which your browser fetches directly, they handle data on our behalf and only as we instruct:

• Clerk: sign-in and account security.
• Neon: our database.
• Cloudflare: network security, storage for screenshots, and sending and receiving email.
• Stripe: payments, invoices and tax.
• Google: delivers the fonts and icons our pages use, so your browser connects to Google’s servers, which see your IP address. Once per audit, we also send Google’s Chrome UX Report the addresses of the audited pages, without anything after a “?” in them, to fetch how fast those pages load for real visitors.
• AI model providers: OpenRouter and the companies it passes our requests to, and xAI, to analyse screenshots and page text.

Our list of sub-processors says what each of these companies receives and where.

People you invite to a project, and anyone you give a share link to, can see that project’s reports.

The websites you audit see the robot’s visits, and the test details it types in, like those of any visitor.

We may also disclose data when the law requires it, or to protect Cavioo, our users or others from fraud or abuse.

Data outside the European Union

Our own servers are in Spain. Our database is in London, in the United Kingdom, which the European Commission recognises as protecting personal data to the same standard as the European Union. Some of the providers above are based in the United States or may process data there, or in other countries outside the European Union. When that happens, the transfer is protected by a European Commission adequacy decision, the EU–US Data Privacy Framework or the European Commission’s standard contractual clauses. Write to us for a copy of these safeguards.

How long we keep it

• Account, project and audit data: while your account is open. You can delete your account yourself in Settings → Account: you are signed out straight away, and 30 days later it is deleted together with your audits, screenshots and reports. Until then you can change your mind by signing back in.
• Comments you wrote on other people’s audits: they stay, under your name and marked as deactivated, so those conversations still make sense.
• Records of what we sent to AI models, and what they answered, to analyse your audits: 90 days.
• A copy of your data you download: 7 days, then deleted.
• Records of audits you stopped: 14 days.
• Billing and invoice records: as long as tax and accounting law requires, which in Spain is up to 6 years.
• Security records of requests to our servers: for a limited time, then deleted.

Deleted data can remain in our backups for about 3 months before it is overwritten.

Your rights

You can download a copy of your data, and delete your account, yourself in Settings → Account. You can also ask us to:

• give you a copy of your personal data;
• correct it;
• delete it;
• limit how we use it, or object to a use based on our legitimate interest;
• send it to you, or to another service, in a common format.

Write to [email protected] and we will answer within one month. If you are not happy with our answer, you can complain to the Spanish data protection authority, the Agencia Española de Protección de Datos, or to the authority where you live.

When your audits contain other people’s data

If you audit a site whose pages show personal data, for example your own customers’ accounts, you decide what the robot sees. You are responsible for that data and for being allowed to share it with us, and we handle it only to run your audits. Business customers who need a data processing agreement can ask us for one.

Children

Cavioo is not for people under 18, and we do not knowingly collect their data.

Security

Connections to Cavioo are encrypted, access to data is limited to what is needed to run the service, and sign-in details are masked in our logs. No system is perfectly secure; if a breach puts your data at risk, we will tell you and the authorities as the law requires.

Changes to this policy

If we change this policy in a way that matters, we will tell you by email or in Cavioo before the change takes effect. The date at the top of this page shows the current version.