Privacy Policy

1. Overview

This Privacy Policy informs you in accordance with Articles 13 and 14 of the General Data Protection Regulation (UK GDPR + EU GDPR) about the nature, scope, and purpose of the processing of personal data on blackcarrot.tech and within the services of Blackstone. "Personal data" means any information relating to an identified or identifiable natural person.

2. Data Controller

The controller within the meaning of the GDPR and other data protection laws is:

Cakglo Ltd, trading as Blackstone
Company Number 16888528, registered in England & Wales
71-75 Shelton Street, Covent Garden
London WC2H 9JQ, United Kingdom
Email: info@blackcarrot.tech
Authorised representative: Alphan Cakir (Director)

We have not appointed a Data Protection Officer as the legal requirements for doing so do not apply to us. For data protection inquiries, please contact us directly at the address above.

3. Legal Basis for Processing

Where we obtain consent for processing operations of personal data, Art. 6(1)(a) GDPR serves as the legal basis. For processing necessary for the performance of a contract, Art. 6(1)(b) GDPR serves as the legal basis. Where processing is necessary to safeguard our legitimate interests, Art. 6(1)(f) GDPR serves as the legal basis. Where vital interests of the data subject or another natural person require processing, Art. 6(1)(d) GDPR serves as the legal basis.

4. Website Provision and Server Log Files

When you access our website, the following data is automatically stored temporarily in a log file:

• IP address (truncated where technically possible)
• Date and time of access
• Name and URL of the requested file
• Website from which access is made (referrer URL)
• Browser used and, where applicable, your computer's operating system and access provider name

Legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in ensuring smooth connection setup, comfortable use of our website, evaluation of system security and stability, and administrative purposes. Data is deleted at the latest after 14 days.

5. Cookies and Consent Management

Our website uses cookies. Cookies are small text files placed by a website operator on the user's end device to store information. We distinguish between technically necessary cookies and cookies requiring consent.

5.1 Technically Necessary Cookies

Technically necessary cookies are set automatically and are required for the operation of the website. Legal basis: Art. 6(1)(f) GDPR.

5.2 Consent-Required Cookies

Marketing and analytics cookies are only set after your express consent. By default, we set all consent signals to "denied" (Google Consent Mode v2) and only activate services after your approval. Legal basis: Art. 6(1)(a) GDPR and §25(1) TTDSG (German Telecommunications-Telemedia Data Protection Act, applicable for visitors from Germany).

You can withdraw your consent at any time with future effect by deleting cookies in your browser or contacting us at info@blackcarrot.tech.

6. Contact Forms and Email Contact

When you contact us via form or email, we process the transmitted data (name, email address, message, optionally company data) to respond to your inquiry. Legal basis is Art. 6(1)(b) GDPR (pre-contractual measures) or Art. 6(1)(f) GDPR (legitimate interest in responding).

For processing form submissions, we use the service FormSubmit.co (operated in the USA). It forwards form submissions to our email inboxes. A data processing agreement is in place. Data transfers to third countries take place on the basis of EU Commission Standard Contractual Clauses. Your data will be deleted at the latest 24 months after the conclusion of communication, unless statutory retention obligations exist.

7. Booking via Cal.com

We use the service Cal.com (Cal.com Inc., USA) for booking free consultation calls. When you book an appointment, the data you provide (name, email, optionally company details, appointment preferences) is processed by Cal.com. Details can be found in Cal.com's Privacy Policy. Legal basis: Art. 6(1)(b) GDPR. Data transfers to the USA are based on Standard Contractual Clauses.

8. Google Analytics 4 and Google Ads

After your consent, we use Google Analytics 4 (Measurement ID: G-C7C4TN7CFB) and Google Ads (Conversion ID: AW-16456421115), operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The purpose is the statistical evaluation of website usage and the measurement of advertising campaigns. Before your consent, no personal data is transmitted to Google (Google Consent Mode v2, default: denied).

Google processes information about the use of our website on our behalf. The IP address is truncated through IP anonymization. A data processing agreement under Art. 28 GDPR is in place. Data transfers to the USA take place on the basis of Standard Contractual Clauses. Legal basis: Art. 6(1)(a) GDPR. You can withdraw your consent at any time. More information: Google Privacy Policy.

9. Google Fonts

We embed fonts via Google Fonts. The fonts are loaded from a Google server when a page is accessed. This transmits your IP address to Google. Legal basis: Art. 6(1)(f) GDPR (consistent display of the website, fast loading times). More information: Google Privacy Policy.

10. Inspectlet (Session Recording)

To improve user experience, after your consent we use the tool Inspectlet (Inspectlet Inc., USA). Inspectlet captures anonymised usage data such as mouse movements, scroll behaviour, and clicks. Input fields with sensitive data (e.g. passwords) are automatically excluded. Legal basis: Art. 6(1)(a) GDPR. You can withdraw your consent at any time.

11. Hosting

Our website is hosted by Hostinger International Ltd. The servers are located in Germany. A data processing agreement under Art. 28 GDPR is in place with the provider. Hostinger processes personal data exclusively for providing the hosting infrastructure. Legal basis: Art. 6(1)(f) GDPR.

12. Payments via Stripe

For processing online payments, we use Stripe Payments Europe Ltd. (1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland). When you complete a purchase, payment data (card details, billing address, transaction amount) is transmitted directly to Stripe. We do not store full payment card details on our own systems. Legal basis: Art. 6(1)(b) GDPR (contract performance). Stripe's privacy policy: stripe.com/privacy.

13. 14-Day Free Trials (Construction Inspection App)

When you sign up for a free trial of our Construction Inspection App, we process your name, email address, optionally company name and country, and a password (stored hashed, not in clear text). No payment information is collected during the trial. We use this data to (a) create your account, (b) send you a verification email, (c) enable login during the 14-day trial, and (d) contact you with onboarding tips and a reminder before the trial ends. Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures). If you do not convert to a paid plan, your trial account is deleted after 30 days. You can request immediate deletion at any time via our account deletion page or info@blackcarrot.tech.

14. Blackstone Inspections Mobile App (Android)

Our Android app ("Blackstone Inspections") loads the same inspection application described above. In addition to the trial/account data in section 13, the app processes the following:

• Inspection photos (camera): Photos you take during an inspection are stored on your device (in the gallery album "Blackstone") and, when your inspections synchronise, uploaded to our server so they appear in your reports and remain available to your team. They are used exclusively for your inspection records. Legal basis: Art. 6(1)(b) GDPR.
• Location (GPS): If you grant the optional location permission, your current coordinates are stamped onto inspection photos and reports as evidence and stored with the inspection record on our server. If you deny the permission, the app works normally without GPS stamps. Legal basis: Art. 6(1)(a) GDPR (consent via the Android permission dialog); you can revoke it at any time in your Android settings.
• Usage statistics (first-party): Only with your consent (analytics toggle in the cookie banner, default off), the app reports an "app opened" event — your account email, a random session ID and the event name — to our own server (dashboard.blackcarrot.tech). No third-party analytics, advertising or tracking SDKs run in the app. Legal basis: Art. 6(1)(a) GDPR.
• Offline data on your device: Inspections, drafts and photos are also stored locally on your phone so the app works on site without a connection. Android's automatic device backup may include this app data in your Google account backup; you can exclude the app under Android Settings → Google → Backup.
• Reports you share: PDF/Word reports are generated for you and saved/shared only where you choose (Downloads folder, share sheet). We do not send them to anyone ourselves.

Account deletion: You can delete your account and the associated data at any time — in the app under Settings → Delete Account, or without the app via blackstoneapp.com/delete-account.html. Deletion is completed within 30 days and confirmed by email.

15. Your Rights as a Data Subject

You have the following rights:

• Access (Art. 15 GDPR) — You can request information about the personal data we have stored about you.
• Rectification (Art. 16 GDPR) — You can request the correction of inaccurate or the completion of incomplete data.
• Erasure (Art. 17 GDPR) — You can request the deletion of your data, provided no statutory retention obligations conflict with this.
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR) — You can request that we provide your data in a structured, commonly used, and machine-readable format.
• Objection (Art. 21 GDPR) — You can object to processing if it is based on legitimate interest.
• Withdrawal of consent (Art. 7(3) GDPR) — with effect for the future.

To exercise your rights, an email to info@blackcarrot.tech is sufficient.

16. Right to Lodge a Complaint with a Supervisory Authority

You have the right to lodge a complaint at any time with a data protection supervisory authority. The competent authority is the supervisory authority of your usual place of residence, your workplace, or the place of the alleged infringement. In the United Kingdom you can find the competent authority at ico.org.uk. In Germany at bfdi.bund.de.

17. Changes to This Privacy Policy

We reserve the right to adjust this Privacy Policy so that it always complies with current legal requirements or to implement changes to our services. The new Privacy Policy will then apply to your next visit. Status of this Privacy Policy: 9 August 2026.