Privacy

Controller: VantarGroup LLC, United States.

What we hold

Your email address, and whatever you choose to tell us: your name, city, what you do, and any usernames you give us. Then the results of the scan itself, which is a record of what publicly available sources and AI models say about you.

We never scan anyone who has not asked us to

A scan only starts after the owner of an email address enters a code we sent to it. There is no way to use Cartograph to look up another person.

How long we keep it

Reports are deleted 30 days after they are created. If you have an active subscription we keep your record so your removal history survives, because deleting it would lose the evidence of what was asked and when.

Where it is stored

Our database is hosted by Neon in the United States. If you are in the EEA or the UK, that means your personal data is transferred outside it. The transfer relies on the European Commission's standard contractual clauses. Ask us and we will tell you exactly what is held about you.

Who else sees it

• Neon, database hosting, United States.
• Amazon Web Services, email sending, United States.
• Cloudflare, email receiving and site delivery.
• DataForSEO, which runs the model queries on our behalf.
• Anthropic, which extracts the claims from those answers.
• Stripe, which processes payments. Card details go to Stripe and never touch our servers.

Removal requests we send on your behalf necessarily disclose your name and the pages you marked to the organisation publishing them. That is what a removal request is.

Your rights

Access, correction, erasure, objection, portability, and complaint to a supervisory authority. Write to support@usecartograph.com and we answer within one month. Deleting your account deletes your reports.

Tracking

There are no third-party scripts on this site and no advertising trackers. If you arrive through an affiliate link, we store that code in your own browser so the person who referred you gets credited, and we send it to our own server when you verify an address. That is the only tracking there is, and clearing your browser storage removes it.

Deleting everything, now

There is a delete button in your report, and it is immediate. It removes your address, your scans, every claim, your authorisation, your mailbox and your removal history. We do not keep a copy. Requests already sent to other organisations are out in the world and cannot be recalled; our record of having sent them goes with everything else.

What we cannot do

We cannot remove your data from inside an AI model. Information learned during training cannot be erased without retraining the model, and no provider offers that. What we do is remove the pages the model reads when it answers, and file the removal requests the providers themselves offer. Anyone who tells you otherwise is overstating it.