Privacy notice
Short version: we ask for a website address and an email so we can send you a review. We store that in the EU, we do not sell it, we set no cookies, and you can have it deleted by writing one line to us.
Who is responsible
Peter Pohlmann, sole trader
Avenida Pinhal de Caldas 53, Verdizela
2855-609 Corroios, Portugal
NIF: 296995959
Email: info@carefulcopy.com
What we collect, and why
| What | Why | Kept |
|---|---|---|
| Website address | It is the thing being reviewed | 12 months |
| To send you the review and to answer you | 12 months | |
| Practice, clinic or agency name, if you give it | So we can address you properly. Optional | 12 months |
| Where your patients are | It decides which national phrasing rules the review applies | 12 months |
| Your two confirmations at submission | A record that you accepted the terms before we sent anything | 12 months |
| Which page on this site you submitted the form from, and the name of our ad campaign if you arrived from one of our ads | To see which page brought the request | 12 months |
| If you arrived from one of our Google ads: the click identifier Google adds to the ad link (gclid, gbraid or wbraid) | To tell Google Ads which ad clicks led to a review request or an order, so we can see which ads work | 12 months; for paid orders, with the order record |
| Browser user agent | To reproduce display problems and to spot automated abuse | 12 months |
| A one-way hash of your IP address combined with the current hour | To limit how many requests one connection can send. The address itself is never stored | 2 hours |
| The review we produce | A record of what we sent you, and our own file if a finding is ever disputed | 12 months |
| If you buy a paid review: name, email, billing address, country, VAT number if you give it, what you bought and the amount | To deliver the review and to issue and keep the invoice | As long as Portuguese tax law requires us to keep invoicing records, currently ten years |
We read the public pages of the website you submit, the same pages any visitor sees. That text is used to produce the review and is not kept in our database afterwards. The review quotes the sentences it comments on, so those quotes are part of the review we keep.
Every review is checked and approved by a person before it is sent to you.
If you write to us instead
The enquiry form collects the same website address, email and organisation name, plus what you tell us you need and, if you answer them, two optional questions about how many sites you have and roughly how many pages each runs to. We keep that for 12 months so we can reply and so we can see what people are asking for. It is used for nothing else: no newsletter, no advertising, and it is not passed on.
Whatever you type into that form reaches us as you wrote it, so please do not put anything confidential or anything about an identifiable patient into it.
Please do not send patient data
We have no use for it and we do not want it. We do not screen submissions for it, so please do not send it. If we notice it, we delete it and tell you.
Why we are allowed to hold it
Because you asked us to perform a service and we need it to do that, and because we have a legitimate interest in keeping the service working and free from abuse. For paid reviews, also because tax law requires us to keep invoicing records. There is no advertising use and no profiling.
Who else sees it
Google Ireland Limited hosts this site and stores the data, in Google Cloud's European multi-region. We do not sell data and we do not share it with advertisers, and no one receives it for any purpose other than the ones described below.
A copy of each request is emailed to the operator so that the review can be produced. That is the same information you typed into the form, and it is held in an ordinary mailbox rather than in the database.
To draft the review, the public text of your website is sent to Anthropic, the company that makes the Claude AI models, through its API. Anthropic receives the page text and the website address only: not your email, your name or anything else you typed into the form. Under its commercial terms it does not use this data to train its models. Anthropic is based in the United States, so this text is processed outside the EU. Anthropic is not certified under the EU-US Data Privacy Framework; the transfer relies on the European Commission's Standard Contractual Clauses (2021), which are part of Anthropic's data processing addendum. Write to us for a copy of these safeguards.
When we send you the review, our email provider processes your address in order to deliver the message, with the review attached as a PDF. That provider is Brevo, operated by Sendinblue SAS in France. They handle the delivery and nothing else.
If you buy a paid review, the payment is handled by Stripe (Stripe Payments Europe, Limited, in Ireland). Your card details go to Stripe directly and never reach us. Stripe passes us the details listed in the table above so that we can deliver the review and issue the invoice. For fraud prevention and its own legal obligations, Stripe acts on its own account as a separate controller, under Stripe's privacy policy.
If you came from one of our Google ads, we report the conversion to Google Ads ourselves: the click identifier from the ad link, the time, whether it was a review request or an order, and for an order the amount paid. We never send Google your email, name, organisation or website, and no Google script or cookie runs on this site. The identifier travels only in the page address while you browse; nothing is stored in your browser. The legal basis is our legitimate interest in measuring which of our ads work. You can object at any time by writing to info@carefulcopy.com, and we will exclude your request from these reports.
The free AI access check reads the public pages, robots.txt, llms.txt and DNS records of the address you enter, and shows the result in your browser. We do not store the address or the result. To limit automated use we keep a scrambled code derived from your connection's IP address for two hours. Mobile speed is measured by Google PageSpeed Insights, which receives the address you check.
Google, Brevo, Anthropic and Stripe each process this data under their standard data processing terms, which are part of our contracts with them.
If your name appears on a website we review
The websites we review are public business websites, and they often name the clinicians who work there, with their credentials. When a sentence on the page is part of a finding, the review quotes it, so a name or credential published there can appear in the report sent to the business that owns the site. We do this because checking that a practice describes its clinicians accurately is the point of the review; we hold that this legitimate interest is not outweighed by yours, since the information is published professional information and the report goes only to the website's owner. We keep reports for 12 months and use them for nothing else. If this concerns you, write to info@carefulcopy.com and we will remove your name from the reports we hold. You can object at any time.
Patient testimonials and review widgets are removed from the page text on our own server, before anything is sent to the AI model, and reviews do not repeat the names or details of patients.
Cookies and what is stored in your browser
This site sets no cookies. If you answer the banner, your choice is saved in your own browser's local storage, holding the categories you allowed, the date you chose and a version number for the record itself. It is never sent to us. The cookie page lists everything.
To count visits we use Ahrefs Web Analytics (Ahrefs Pte. Ltd., Singapore). It sets no cookies and stores nothing in your browser. It records visits such as which pages are viewed, the page that referred you, browser, device type and country. Ahrefs states that it does not store IP addresses with the analytics data. Ahrefs is based in Singapore, outside the EU. We see only totals. The legal basis is our legitimate interest in knowing which pages are read; because nothing is stored on your device, it runs without a banner choice. You can object by writing to info@carefulcopy.com, or block analytics.ahrefs.com in your browser.
Where the data is
In the European Union. The database region is Google Cloud's European multi-region, and the function that receives your submission, the review process and the stored reviews are in Frankfurt. The one exception is the public page text sent to Anthropic in the United States to draft the review, described above.
Your rights
You can ask for a copy of what we hold, ask us to correct it, ask us to delete it, object to us holding it, or ask for it in a portable form. Write to info@carefulcopy.com and say which. We will not ask you to justify the request.
If you are unhappy with how we handle it you can complain to the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (CNPD), or to the authority in your own country.
Changes
If this notice changes, the date at the top changes with it. If a change matters to people who have already sent us something, we write to them rather than quietly editing the page.