What we do with what you type in.

Short, because there is very little of it. This page describes the whole of it, not a summary of a longer document held somewhere else.

Last updated 1 August 2026

The request form does not send us anything

There is no database behind this website and no server that receives form submissions. When you press Request coverage check, everything you typed is assembled into a draft email in your mail client, addressed to us. Nothing leaves your browser until you press send yourself, and if you close the draft instead, we never see any of it.

We are telling you this because a form that quietly posts to a third-party endpoint is the normal arrangement, and this one isn't. If that changes, this page changes with it, and the date above will move.

What we hold once you do email us

• Your message and its contents — name, work email, agency, vertical, and the competitors you asked about. This sits in our mailbox like any other business email.
• Nothing else. No profile is built, no enrichment service is called, no list is created, and nothing is passed to anyone for marketing.

Lawful basis: legitimate interest in replying to a business enquiry you initiated (GDPR Art. 6(1)(f)). We keep the correspondence while there is an active conversation and for two years afterwards so we can pick up where we left off, then delete it.

What the website itself collects

No analytics, no advertising pixels, no cookies, and no consent banner — because there is nothing to consent to. The site is a set of static files served by GitHub Pages, which writes standard server logs including your IP address for security and abuse prevention. Those logs are GitHub's, kept briefly, and we never see them.

If we later add analytics, we will use a cookieless product that does not track people across sites, and we will say so here before it goes on.

Who else sees it

• GitHub, Inc. — hosting and server logs.
• Our email provider — because your message arrives as email and has to live somewhere.

That is the complete list. We do not sell data, we do not share it with partners, and there are no partners.

The research we sell is not about you

Cart Ladder's product involves identities we own subscribing to public marketing lists, browsing public storefronts and abandoning carts, in order to observe what brands send. Those are our own accounts and our own inboxes. We do not collect, buy or process email belonging to members of the public, we do not impersonate real people, and nothing a client sends us is used as research material.

Your rights

You can ask what we hold, ask for a copy, ask for corrections, ask us to delete it, or object to us holding it at all — email hello@cartladder.com and we will action it within thirty days. Given the above, deletion usually means deleting an email thread, and we will confirm when it is done.

If we handle that badly you can complain to your national data protection authority.

Changes

If this page changes, the date at the top changes. We do not keep a separate archive of old versions, so if the terms of an ongoing conversation matter to you, save a copy.