Privacy Policy

Go Karrot ("we", "us", or "our") is a digital marketing studio based in the Commonwealth of Virginia, United States. We operate the website gokarrot.com and associated customer portal, order management, and communication services.

This Privacy Policy describes how we collect, use, disclose, and safeguard your personal information when you visit our website, submit inquiries, purchase marketing, design, or web services, or communicate with us. It also explains your privacy rights under federal law and state consumer privacy laws, including the Virginia Consumer Data Protection Act (VCDPA), the California Consumer Privacy Act as amended by the CPRA (CCPA/CPRA), CalOPPA, and other applicable state laws.

If you do not agree with the terms of this Privacy Policy, please discontinue use of our site and services. If you have questions or wish to exercise your rights, you can reach us at privacy@gokarrot.com.

We adhere strictly to data minimization principles. We collect and process personal data only when it is adequate, relevant, and strictly necessary for the specified purposes for which it is provided:

• We only ask for the information needed to evaluate your project, deliver orders, process payments, and provide customer support.
• Providing a telephone number is optional. If provided, it is used solely to contact you about your active projects or urgent updates.
• We do not collect sensitive identifiers such as Social Security numbers, government IDs, driver's licenses, racial or ethnic origins, precise geolocation, biometric data, or health details.
• We do not buy or acquire external marketing lists or cross-context behavioral tracking profiles.

Depending on how you interact with our website, we collect the following categories of information:

We respect your digital privacy. Unlike many agencies:

• We do not use third-party analytics services such as Google Analytics, Mixpanel, or PostHog on this website.
• We do not install advertising, retargeting, or social tracking pixels (such as Meta Pixel, TikTok Pixel, LinkedIn Insight Tag, or Google Ads Remarketing).
• We do not sell your personal data or share your personal data for cross-context behavioral advertising.

For full details on technical cookies and browser storage, please review our dedicated Cookie Policy.

We process your personal information exclusively for lawful business and operational purposes:

• Contract Performance: To deliver requested marketing, branding, website, and SEO services, maintain your client dashboard, generate service agreements, process invoices, and communicate regarding deliverables.
• Legitimate Business Interests: To protect our website and systems against fraud, malicious activity, and spam; to enforce our Terms of Service; and to maintain accurate financial and tax accounts.
• Explicit Consent: To send direct marketing communications where you have opted in. You may withdraw consent at any time via the unsubscribe link in any promotional email or by contacting us.
• Legal Compliance: To comply with applicable tax, financial reporting, and statutory record-keeping obligations, or in response to valid court orders.
• We do not use your information for automated profiling that produces legal effects, nor do we sell your data to train third-party generative AI models.

We do not sell, rent, or trade your personal information. We disclose data solely to contracted service providers who assist us in operating our business under strict confidentiality and security terms:

We retain personal information only as long as necessary to fulfill the purposes outlined in this policy:

• Invoices, Payments & Signed Contracts: Retained for 7 years following the date of completion to comply with IRS and Virginia statutory business record-keeping laws.
• Active Client Accounts & Orders: Kept for the duration of the client relationship plus limitation periods for breach-of-contract claims.
• Contact Inquiries: Retained for up to 2 years, after which unengaged leads are archived or securely deleted.
• Project Deliverables & Uploaded Assets: Retained during the project and up to 12 months after final delivery to allow for client re-downloads or revision requests, unless earlier deletion is requested.

Under the Virginia Consumer Data Protection Act (VCDPA), the California Consumer Privacy Act (CCPA/CPRA), and laws in Colorado, Connecticut, Utah, Texas, and other states, consumers have specific enforceable rights:

• Right to Know / Access: You may request confirmation of whether we process your data and receive a copy of your personal data in a portable format.
• Right to Correct: You may request correction of inaccurate personal data.
• Right to Delete: You may request deletion of personal information provided by or obtained about you, subject to legal record retention exemptions.
• Right to Opt Out: You have the right to opt out of the sale of personal data, targeted advertising, and profiling. Because Go Karrot engages in none of these practices, no opt-out is necessary.
• Right to Non-Discrimination: We will never deny services, charge different prices, or provide a different level of quality if you exercise any privacy right.
• Right to Appeal: If we decline to take action regarding your request, you have the right to appeal within 60 days. You may also contact the Virginia Attorney General or your state Attorney General if you are unsatisfied with our response.

Our website and professional marketing services are intended strictly for commercial enterprises and adults aged 18 and older. We do not knowingly solicit or collect personal information from individuals under the age of 13 in accordance with the Children's Online Privacy Protection Act (COPPA), nor do we sell or share the personal data of consumers under 16 years of age.

If you believe a minor has submitted personal data to our website, please email privacy@gokarrot.com and we will immediately purge the record from our systems.

We employ robust technical, administrative, and physical safeguards designed to protect personal information against unauthorized access, loss, or disclosure:

• End-to-end transport layer encryption (TLS 1.3) for all web traffic and API calls.
• PostgreSQL Row Level Security (RLS) guaranteeing authenticated users can only query their own client records.
• Private, time-limited presigned storage URLs for uploaded files and executed agreements.
• Cloudflare bot and DDoS defenses protecting public submission endpoints.

While we implement industry-standard safeguards, no method of transmission over the Internet is 100% impenetrable. In the event of a security breach affecting your personal data, we will provide notifications in accordance with applicable Virginia and state breach notification statutes.

For any questions regarding this Privacy Policy or our data handling practices, please contact us directly: