Privacy Policy

1. Data controller

Carneo Labs AB (corporate ID 559587-6250), c/o Epicenter, Malmskillnadsgatan 44 a, 111 57 Stockholm, is the data controller for the processing of personal data described in this policy.

If you have questions about how we handle your data, reach us at privacy@carneo.se.

2. What data we process

Carneo is built to collect as little as possible. This website has no seller chat or browser seller intake. Depending on how you use the service, we process:

• SMS intake — your phone number, messages and related case and vehicle details, so operators can review your selling request and reply manually.
• Contact with us — what you write in an email or tell us when you call, and your contact details.
• Operator account data — name, email address and authentication/session information for access to the Control Center.
• Website preferences — your language and cookie choices.
• Cookies — see our cookie policy for the full list.

3. Purposes and legal bases

Caroline, Carneo's AI guide, may suggest replies to your messages. A suggestion is never sent automatically — someone on our team reads it, edits it if needed and sends the reply. No decisions about you are made automatically.

• Providing the service and following up on your case — steps taken at your request prior to a potential contract (Art. 6(1)(b) GDPR).
• Answering questions and requests you send us — legitimate interest (Art. 6(1)(f) GDPR).
• Security and abuse prevention, such as rate limiting — legitimate interest (Art. 6(1)(f) GDPR).
• Managing operator accounts and sign-in to the Control Center — legitimate interest (Art. 6(1)(f) GDPR).
• Product analytics — only if you have consented to analytics cookies (Art. 6(1)(a) GDPR).

4. Who sees your data

Your SMS messages and case details are available to authorized Carneo operators. No car dealer sees who you are until you have chosen to proceed with the dealer path yourself. We never sell your data.

Processors that may handle data on our behalf:

• Amazon Web Services (AWS) — hosting and storage. The service and its databases run in the AWS Stockholm region (eu-north-1).
• Twilio Ireland Limited — SMS. Receives your text messages to us and sends operators' replies, with processing in Twilio's Ireland region.
• AI provider — produces Caroline's reply suggestions from your messages and case details. The data is only used to produce suggestions for our team.
• Car.info — vehicle data. An operator may look up a registration number to retrieve details about the car. Only the registration number is sent, and the response is not automatically saved to your case.
• Email and phone service — receives email and calls to Carneo.
• Mailjet (Sinch) — email for verifying operator accounts and resetting passwords.
• PostHog Inc. (USA) — product analytics. Only used if you have consented to analytics cookies.

5. Transfers outside the EU

Your SMS messages and case details are stored within the EU/EEA. If a provider processes data outside the EU/EEA, it does so only under a valid GDPR transfer mechanism, such as the European Commission's standard contractual clauses. If Twilio exceptionally processes data outside the EU/EEA, for example for support, it does so under Twilio's Binding Corporate Rules (BCR) approved by EU data protection authorities.

If you have consented to analytics cookies, pseudonymised analytics data may be processed by PostHog in the USA, based on the EU-US Data Privacy Framework and standard contractual clauses.

6. Retention

We are in an early phase and do not yet have automated data purging. Until it is in place, we delete data manually on request — email privacy@carneo.se and we will remove your data.

• SMS messages and case details are kept for as long as your case is active with us.
• Emails and calls to us are kept for as long as needed to handle your question.
• Server logs are kept for 14 days and database backups for 7 days. Data that has been deleted may remain there for at most that long.
• Cookies have the lifetimes listed in the cookie policy.

7. Your rights

Under the GDPR you have the right to:

• access the data we hold about you (a copy of your data),
• have inaccurate data corrected,
• have your data erased,
• request that processing be restricted,
• receive your data in a machine-readable format (data portability),
• object to processing based on legitimate interest,
• withdraw a given consent at any time.

8. Complaints

Contact privacy@carneo.se to exercise any of your rights — we respond within one month at the latest.

If you believe we are processing your personal data incorrectly, you have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY), www.imy.se.

9. Cookies

We use a small number of cookies. What they are, what they do, and how long they persist is described in our cookie policy.

10. Changes to this policy

We may update this policy as the service evolves. The date at the top shows when it was last changed. For material changes we will announce them clearly on the site.