Version 2.0, effective date: 17 November 2026 (published 18 October 2026; replaces version 1.9 from the effective date)
Karro Intelligence Ltd ("Karro", "we", "us") is committed to protecting your personal data. This policy explains what we collect, why we collect it, and your rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Karro Intelligence Ltd is the data controller for personal data processed through the Karro platform. Contact: privacy@karro.io.
We collect the following categories of personal data: • Account data: your name, email address, and password (stored as a hash). • CV data: the text content of CVs you upload after creating an account, used to generate your career analysis and, unless you opt out, to produce anonymous job market statistics (see Section 7A). (See Section 3 for CVs uploaded via the free anonymous scan, which are handled differently and are not stored.) • Usage data: how you interact with the platform, for product improvement purposes. • Payment data: billing details processed by Stripe; we do not store your card details directly. • Consent records: a timestamped log of the preferences you have agreed to.
Karro offers a free, instant CV scan on certain marketing pages that does not require you to create an account first. If you use this feature: • The CV file or text you upload is sent to our AI provider (Anthropic) solely to generate the on-screen result: an ATS compatibility score and platform-by-platform feedback. • Your CV, the text extracted from it, and the analysis result exist only in memory for the duration of that single request. None of it is written to our database or any other store, and none of it is retained after your result is shown to you. • We do not require your name or email address to use this feature. • A separate, minimal record — your IP address and a timestamp only, never linked to any CV content — is kept only for as long as necessary to prevent abuse of this free feature. • If you later create an account, you will be asked to upload your CV again. Nothing from the anonymous scan is carried over or linked to your new account. We rely on legitimate interests as the legal basis for this processing (see Section 4): it is limited to exactly the service you are actively requesting, is minimal and transient, and is disclosed to you before you upload.
We process your data under the following legal bases: • Contract: to deliver the service you signed up for. • Consent: for optional purposes such as marketing emails, recruiter visibility, and AI training data, each recorded separately with a timestamp. You may withdraw consent at any time. • Legitimate interests: for platform security, fraud prevention, service improvement, to provide the free anonymous CV scan described in Section 3, and to produce and sell anonymous job market statistics from coded CV data (Section 7A), where this does not override your rights. You can object to these at any time (see Section 10).
• To analyse your CV and produce career intelligence reports. • To generate an instant, free ATS compatibility scan when you upload a CV before creating an account (see Section 3). • To match you with relevant job opportunities via our partner job boards. • To make your anonymised profile discoverable by recruiters (only if you opt in). • To send you service-related emails (e.g. email confirmation, password reset). • To send you marketing communications (only if you opt in, and you can unsubscribe at any time). • To improve our AI models using anonymised data (only if you opt in). • To produce anonymous job market statistics, which we sell to partner organisations (unless you opt out, see Section 7A).
Karro uses automated algorithms to analyse your CV and produce a career archetype, scores (depth, breadth, reach), and role recommendations, whether or not you have created an account. This constitutes automated processing, including profiling, under UK GDPR Article 22. These outputs are informational only. They do not produce legal effects or similarly significant decisions about you; no employer is directed to hire or reject you based on them, and you are not bound by any output Karro produces. You have the right to request human review of any output you disagree with, to express your point of view, and to contest a result. To do so, contact us at privacy@karro.io. You can also re-upload an updated CV or adjust your preferences in Settings at any time. We do not use solely automated processing to make any decision that produces a legal or similarly significant effect on you. We also code CVs automatically for the anonymous job market statistics described in Section 7A. This is not used to make any decision about you and does not change anything you see in Karro.
Karro offers two separate, opt-in visibility tiers. Both are off by default and can be withdrawn at any time from your CV Visibility settings. Tier 1 (Anonymous profile): If you opt in, an anonymised snapshot of your profile, including your Karro scores, career archetype, sector, skills, and approximate location, is made searchable to subscribed partner recruitment agencies. Your name, email address, and full CV text are not shared under this tier. Tier 2 (Full contact visibility): If you choose to also enable full contact visibility for a specific CV, your name, email address, and the full text of that CV will additionally be visible to subscribed recruiters. This is a separate, explicit consent step. Enabling Tier 1 does not automatically enable Tier 2. When either tier is active, recruiter agencies who view your profile are logged with a timestamp. You can see the number of recruiter views for each CV in your settings. Recruiters must accept our Recruiter Terms of Use before accessing the platform; these terms prohibit contacting candidates for purposes other than genuine recruitment, sharing candidate data with third parties, or retaining data after a candidate withdraws consent. Once a recruiter has viewed your contact details outside the platform, we cannot compel deletion of any notes they may have taken; we recommend withdrawing visibility if you no longer wish to be discoverable.
From 17 November 2026, unless you opt out, we use the CVs you upload to produce statistics about the job market, such as which skills are common in which occupations and regions, or how careers progress. How it works: an automated process reads your CV and records standard codes for your most recent occupation, your employer's sector, your leadership level, your skills and your approximate location (no finer than local authority district; we never record your postcode or address). It does not record or infer your gender, age, ethnicity, nationality, health, religion or any other protected characteristic. These codes are kept separately from your account under a random reference, with no name, contact details or CV text. What we share: only statistics about groups of at least 100 people, with small numbers hidden and other numbers rounded, so that nobody can be identified from them. We sell these statistics to partner organisations, such as employers, recruiters, training providers and researchers. We never sell or share your CV, your codes or anything about you as an individual, and we never use CVs that recruiters upload. Legal basis: our legitimate interest in producing and selling job market statistics. This does not affect what you see in Karro and no decision is made about you. Your right to object: you can opt out at any time by switching off "Include my CV in job market statistics" in Settings → Communication & Data, or by emailing privacy@karro.io. When you opt out, the codes from your CVs are deleted immediately and are not used in any future statistics. Statistics already produced can't be changed, but they contain nothing about you as an individual.
We share data with the following categories of third parties only as necessary to operate the service: • Supabase (database and authentication infrastructure), hosted in the UK (London). • Stripe (payment processing): Stripe is the system of record for payment transactions (see section 9). See stripe.com/privacy. • Anthropic (AI analysis): CV text is sent to their API, including for the anonymous CV scan described in Section 3 and to code CVs for the job market statistics in Section 7A; under Anthropic's commercial API terms, our data is not used to train their models. • postcodes.io (location lookup, for the statistics in Section 7A): if your CV includes a postcode, only its first part (for example "M1") is sent, to find the local authority district. Your full postcode is never sent or stored. • Adzuna (job matching): anonymised search queries only. • Reed.co.uk (job matching, UK fallback): anonymised search queries only. • Vercel (hosting): EU region. • Cloudflare (network security and content delivery): traffic to karro.io passes through Cloudflare's network for security and performance. • PostHog (analytics): usage events (pages visited, features used) are sent to PostHog, which processes them on our behalf, unless you turn analytics off. By default these are anonymous and cookieless; they are linked to your account, with your email address and name, only if you accept all cookies (see section 11). PostHog is hosted in the EU. See posthog.com/privacy. • Reddit and Google (advertising): only if you accept advertising cookies, their tags record that you arrived from one of our ads and whether you went on to sign up, so we can measure our advertising (see section 11). • Loops (email delivery): your email address, name, account identifier, subscription status, marketing preference, sign-in activity and a summary of your CV results (career archetype and ATS score) are processed by Loops to send service emails about your account and, only if you opted in, marketing emails. Loops is based in the United States (see section 12). We do not sell personal data to any third party.
We retain data only for as long as necessary for the purpose it was collected. Our retention periods by category are: • CV text and analysis results (account holders): retained while your account is active; deleted within 30 days of account deletion. • Anonymous CV scan (no account, see Section 3): CV text and analysis results are never stored — processed in memory for the duration of the request only. A minimal IP address and timestamp record is kept only as long as necessary to prevent abuse of this feature. • Account profile and preferences: retained while active; deleted within 30 days of account deletion. • Consent records: retained for 6 years from the date consent was given or withdrawn, to demonstrate compliance. • Payment records: Stripe, our payment processor, is the system of record for payment transactions and retains transaction records as required by financial regulations (around 6 years under UK law). Payment records held in Karro's own database are deleted when your account is deleted. • Reason for deleting your account: when you delete your account we ask why you're leaving (you can choose "I'd rather not say") and you can add an optional comment. We keep your answer, with your account type, plan, how long you had your account and how many CVs you uploaded, but not your name, email address or any account identifier, so it can no longer be linked to you. We use it to understand why people leave and improve Karro, and keep it indefinitely. Please don't include personal details in the comment. • Codes derived from your CVs for job market statistics (Section 7A): deleted immediately when you delete the CV or your account, or opt out. The job title and skills as written on your CV, which we keep next to the codes to check their quality, are deleted 90 days after coding. • Job market statistics and other anonymised, aggregated analytics (no personal data): retained indefinitely. If you delete your account, your personal data will be purged within 30 days. You can request early deletion at any time by contacting privacy@karro.io.
Under UK GDPR you have the right to: • Access the personal data we hold about you. • Correct inaccurate data. • Erasure ("right to be forgotten"): contact privacy@karro.io to request deletion. • Restrict or object to processing. • Data portability: receive your data in a machine-readable format. • Withdraw consent at any time without affecting prior processing. Right to object: you can object at any time to processing based on our legitimate interests, including the job market statistics in Section 7A, which you can switch off yourself in Settings → Communication & Data. To exercise any of these rights, contact privacy@karro.io. Complaints: if you're unhappy with how we handle your personal data, please complain to us first at privacy@karro.io. We will acknowledge your complaint within 30 days and tell you the outcome. You also have the right to complain to the Information Commission (formerly the ICO, ico.org.uk).
Some of our service providers (including Anthropic and Loops) are based in the United States. Where data is transferred outside the UK, we ensure appropriate safeguards are in place, including the UK International Data Transfer Agreement or Standard Contractual Clauses with the UK Addendum where required.
Karro is not directed at children under 18. We do not knowingly collect data from anyone under 18. If you believe we have done so in error, contact us immediately.
We will notify you by email and in-app notice before making material changes to this policy. The effective date at the top of this page reflects the current version.
Data protection queries: privacy@karro.io. We aim to respond within 30 days.
Karro Intelligence Ltd · Registered in England and Wales · hello@karro.io