Privacy Policy

1. Who We Are

Carp Army Ltd (company number 08225014) is the data controller for personal data collected through the Carp Army Platform. Our registered office is at 85 Great Portland Street, First Floor, London, England, W1W 7LT.

This Privacy Policy explains how we collect, use, share and protect your personal data when you use the Carp Army app, website (carp.army), business dashboard (business.carp.army), or any related services (together, the "Platform").

We are committed to protecting your privacy in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR).

2. What Data We Collect

Data you provide directly

• Account data — name, email address, username, profile photo, date of birth, password (stored as a one-way hash)
• Profile data — fishing biography, species preferences, favourite venues, social links
• Catch & session data — fish weight, species, bait, rig, session notes, catch photos and videos
• User Content — posts, comments, reviews, messages, rig descriptions, classifieds listings
• Business data — company name, address, VAT number, bank/payout details, product listings, order data
• Payment data — billing address, payment method (card details are handled directly by our payment processor — we do not store full card numbers)
• Communications — emails or messages you send to our support team

Data collected automatically

• Device data — device type, operating system, browser type, app version, device identifiers
• Usage data — pages viewed, features used, time spent, click patterns, search queries
• Log data — IP address, access timestamps, error logs
• Location data — GPS coordinates (where you grant permission), What3Words pins, venue check-ins
• Cookie data — see Section 5

Data from third parties

• If you sign in via Apple, Google or Facebook, we receive basic profile data from those providers as permitted by your privacy settings with them
• If you connect integrations (e.g. Shopify, eBay, WooCommerce), we receive data from those platforms as authorised by you
• We may receive publicly available data about fisheries from Environment Agency and third-party mapping providers

3. How We Use Your Data

Where we rely on legitimate interests, we have assessed that our interests are not overridden by your rights and interests. You can request more information about that balancing test by contacting us.

4. Data We Share

We do not sell your personal data. We share data only in the following circumstances:

Service providers

We share data with trusted third-party processors who help us operate the Platform. These include:

• Cloud hosting — DigitalOcean (servers and database)
• CDN, DNS and media storage — Cloudflare (including photos and video you upload)
• Payment processing — Stripe
• In-app purchases — Apple and Google, who validate purchase receipts for subscriptions, coins and boosts
• Transactional email — Resend (order confirmations, password resets, notifications)
• Marketing email — Brevo, where you have opted in
• Push notifications — Apple APNs, Google FCM
• Maps and addresses — Google Maps, Google Places, What3Words
• AI processing — Anthropic, and OpenAI as a fallback (see below)
• Advertising measurement — Meta Platforms and TikTok, via website pixels and only where you have consented. They receive the fact that a browser visited a page on our website. They receive nothing at all if you refuse, and nothing from the app.
• Crash and error reporting — Sentry, which receives diagnostic data when the app or our servers hit an error. This can include your account identifier so we can trace a fault back to a session; we scrub request headers and browsing breadcrumbs before they are sent.
• Postage and delivery — Royal Mail, where a seller uses it to fulfil your order. Your delivery name, address and phone number are sent so a label can be produced.

All processors are bound by data processing agreements and may only use your data to provide services to us.

AI processing

Three features send content to an AI provider (Anthropic; OpenAI is used as a fallback for listing analysis):

• AI listing review — the product title, description and pricing you ask us to review.
• Product import — the supplier web address you paste, and the page content fetched from it.
• Bug report triage — the description and any screenshot you submit with a bug report, so it can be categorised and routed.

Only the content needed for the feature is sent. We do not send your captures, private messages, contact details or payment information for AI processing, and none of it is used to train anyone's models. These providers are based in the United States — see section 10 on international transfers.

If you would rather not have content processed this way, do not use those features; nothing else on the Platform depends on them.

Connected integrations

If you connect your account to third-party platforms (e.g. Shopify, eBay, WooCommerce, Xero, Mailchimp), we share order, product and customer data with those platforms as directed by you. Each third party's privacy policy governs their use of that data.

Other users

Content you post publicly (catches, reviews, listings, profile) is visible to other users. Your username, profile photo and public posts may be discoverable via search.

Business sellers

When you purchase from a seller on the Platform, we share your name, delivery address and order details with the seller to fulfil your order.

Legal disclosure

We may disclose personal data if required by law, court order, or regulatory authority, or where we reasonably believe disclosure is necessary to protect the rights, property or safety of Carp Army Ltd, our users, or others.

Business transfers

If Carp Army Ltd is involved in a merger, acquisition or sale of assets, personal data may be transferred to the acquiring entity, subject to the same protections as this Policy.

5. Cookies & Tracking

We use cookies and similar technologies on our websites. Cookies are small text files stored on your device.

Types of cookies we use

• Essential cookies — required for the Platform to function (authentication, session management, security). These cannot be disabled.
• Analytics cookies — we do not currently run third-party analytics cookies. If that changes, this policy will be updated and, where consent is required, you will be asked before any such cookie is set.
• Marketing cookies — with your consent, we use the Meta (Facebook and Instagram) and TikTok advertising pixels on our website so we can measure which of our adverts and posts bring anglers to Carp Army, and so we can show our adverts to people who have visited the site. These are not set unless you accept them — you are asked when you first visit, and refusing is a single tap. They run on our website only; the Carp Army app contains no advertising or tracking software of any kind.
• Preference cookies — remember your settings and preferences (e.g. theme, language).

You can change your mind at any time by clearing this site's data in your browser, which removes your stored choice and asks you again on your next visit. You can also manage cookies through your browser settings. Refusing non-essential cookies will not prevent you using the Platform.

6. Location Data

The Carp Army app uses your device's GPS location to power features including fishery finder, catch pinning, session replay and What3Words location tags. Location access is always at your discretion — you can grant or revoke permission in your device settings at any time.

Precise catch locations are stored as private by default. You choose what location data is visible to other users when you post a catch or pin a venue.

We do not share precise GPS coordinates with advertisers.

7. Children's Privacy

The Platform is for adults. You must be at least 18 years old to create an account, and Carp Army is not directed at children or young people under 18.

We do not knowingly collect personal data from anyone under 18. If you are a parent or guardian and believe your child has registered, please contact us at privacy@carp.army and we will close the account and delete the associated data.

8. Data Retention

We retain personal data for as long as necessary to fulfil the purposes for which it was collected, comply with legal obligations, resolve disputes and enforce our agreements. Typical retention periods:

• Account data — retained for the life of your account and up to 2 years after closure
• Order and payment records — 7 years (HMRC requirement)
• User Content — deleted within 90 days of account closure, unless the content has been shared by others
• Server logs — 90 days
• Marketing consent records — for the duration of consent plus 2 years
• Support communications — 3 years

You may request early deletion of your data subject to legal obligations — see Section 9.

9. Your Rights

Under UK GDPR you have the following rights regarding your personal data:

• Right of access — request a copy of the personal data we hold about you
• Right to rectification — ask us to correct inaccurate or incomplete data
• Right to erasure ("right to be forgotten") — ask us to delete your data, subject to legal obligations to retain it
• Right to restriction — ask us to pause processing of your data in certain circumstances
• Right to data portability — receive your data in a structured, machine-readable format
• Right to object — object to processing based on legitimate interests or for direct marketing
• Rights relating to automated decisions — request human review of any significant automated decision made about you
• Right to withdraw consent — where processing is based on consent, withdraw it at any time (this does not affect the lawfulness of processing before withdrawal)

To exercise any of these rights, email us at privacy@carp.army. We will respond within one calendar month. We may need to verify your identity before processing your request.

These rights may be exercised free of charge. If requests are manifestly unfounded or excessive, we may charge a reasonable fee.

10. International Transfers

Some of our service providers are based outside the UK and European Economic Area (EEA). Where we transfer personal data internationally, we ensure appropriate safeguards are in place, including:

• UK International Data Transfer Agreements (IDTAs)
• Standard Contractual Clauses (SCCs) approved by the ICO
• Transfers to countries with UK adequacy decisions

You can request details of the safeguards in place for specific transfers by contacting us.

11. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration or destruction. These include:

• TLS/HTTPS encryption for all data in transit
• Encryption of sensitive data at rest
• Password hashing using industry-standard algorithms
• Access controls limiting data access to authorised personnel
• Regular security assessments and monitoring
• Payment card data handled by PCI-DSS compliant processors only

No system is completely secure. In the event of a data breach that is likely to result in a high risk to your rights and freedoms, we will notify you and the ICO as required by law.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Where changes are material, we will notify you by email or via an in-app notification at least 14 days before the change takes effect. The date at the top of this page reflects the most recent update.

13. Contact & Complaints

For any privacy-related queries or to exercise your rights, please contact our Data Protection team:

Carp Army Ltd — Data Protection
85 Great Portland Street, First Floor
London, England, W1W 7LT
Email: privacy@carp.army

If you are not satisfied with our response, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO):

Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, SK9 5AF
Tel: 0303 123 1113
Website: ico.org.uk