Last updated: 15 September 2026
Privacy policy
What personal data we collect through this website, why we collect it, and what you can do about it.
Who we are
Karo is built by SynapTix Systems Ltd, which is the data controller for the personal data described on this page. We are registered in England and Wales, company number 16254772, at 4th Floor, Silverstream House, 45 Fitzroy Street, Fitzrovia, London W1T 6EB. We are also registered with the Information Commissioner's Office, registration number ZB905782.
For anything to do with your data, email hello@synap-tix.com.
What this policy does not cover
This page covers heykaro.com, the Karo product site. It does not cover conversations you have with Karo on a venue's own website. Where Karo handles an enquiry there, the venue is the data controller and we act as their processor under a data processing agreement, so if you want to know how that conversation is handled, contact the venue.
It also does not cover the Karo application itself, which is governed by the agreement with the customer whose account you are using. For how SynapTix handles data in its consultancy work, see synap-tix.com/privacy.
In both cases the venue is the one who has to tell you what happens to your data, and its own privacy notice is where you will find it. Venues under contract get the full list of named sub-processors, and where the application is hosted, in their data processing agreement. If you are not sure which of those applies to you, or you cannot work out who to ask, get in touch at hello@synap-tix.com and we will point you to the right place.
What we collect
When you browse this site. Our hosting provider records standard server request logs, including IP address, the pages requested and the time of the request. These are used to keep the site running and secure. Our analytics provider also sees your IP address as a side effect of the request your browser makes to it – see Cookies, storage and third-party requests.
When you book a demo or contact us. The forms on /book-a-demo and /contact are hosted by Tally and embedded here. When you submit one we collect your name, email address, the organisation you work for, the ticketing system you use and whatever else you choose to tell us. Submissions are held in Tally and passed into our CRM so that we can reply and keep track of the conversation.
When your venue becomes a customer. We hold the business contact details of the people we work with, along with correspondence, account configuration and billing information.
We do not buy contact data, and we do not build profiles of visitors to this site.
Cookies, storage and third-party requests
This website sets no cookies of its own, and on every page but the two that carry a form, nothing it loads sets one either. There is no advertising, nothing that follows you between sites, and nothing that recognises you on a later visit. We measure pages, not people. There is no cookie banner because nothing we do requires your consent; the one exception, Tally's form frame, is set out below.
Two things on the site do involve somebody other than us, and both are set out here rather than left for you to find.
Analytics. Every page sends an anonymous record of the visit to PostHog, hosted in the EU, so we can see which pages are read and which links are used. It runs in cookieless mode: nothing is written to cookies, local storage or session storage, no identifier is kept, and you are not recognised on a later visit or followed to any other site. Visits are counted from a hash that PostHog re-salts daily and cannot be reversed. The request carries your IP address, your browser's user agent and the address of the page, as any web request does. We do not use it for advertising and we do not build profiles. Our lawful basis is legitimate interests – knowing which of our pages are useful. If your browser sends a Do Not Track signal, nothing is recorded at all.
The forms on /book-a-demo and /contact. Those two pages, and no others, load the form in a frame served by Tally, plus a small script from Tally so that frame can size itself correctly. The frame is Tally's own page rather than ours, so Tally may set cookies or storage inside it, and what it does there is governed by Tally's privacy policy rather than by this page. We only see what you submit. Every other page on this site loads nothing from Tally at all, so if you do not open one of those two pages, none of this applies to you.
Apart from those two, no page on this site loads anything from a third party. There are no web fonts, no maps, no embedded video and no social widgets. If you would rather not make the analytics request at all, blocking eu.i.posthog.com stops it and nothing else on the site depends on it.
Why we use your data, and our lawful basis
| What we do | Lawful basis |
|---|---|
| Answer your enquiry or demo request and follow it up | Legitimate interests – you contacted us and expect a reply |
| Provide Karo under a contract with your organisation | Performance of a contract, or legitimate interests where the contract is with your employer rather than you |
| Keep the site running, secure and available | Legitimate interests |
| Keep accounting and tax records | Legal obligation |
Who we share it with
We do not sell personal data and we do not share it for anyone else's marketing.
We use a small number of suppliers who process data on our behalf under contract: our website host (Cloudflare), our form provider (Tally), our email provider (Google Workspace), our CRM (Attio) and our analytics provider (PostHog). Each is bound to use the data only as we instruct.
We will disclose data where the law requires it.
Where your data is held
Our core infrastructure is hosted in the UK. The Karo application runs on UK servers, and works from an anonymised representation of a customer's account rather than sending personal data to the model. This marketing site is a separate, static site served from Cloudflare's network. Some of our suppliers process data outside the UK. Where they do, transfers are covered by UK adequacy regulations or by the International Data Transfer Agreement.
How long we keep it
Enquiries and demo requests that do not lead to an account: two years from our last contact. Customer records: seven years from the end of the contract, to meet our accounting obligations.
Your rights
You have the right to ask for a copy of the personal data we hold about you, to have it corrected, to have it deleted, to restrict or object to how we use it, and to receive it in a portable format. Where we rely on your consent, you can withdraw it at any time.
Email hello@synap-tix.com and we will respond within one month.
Complaints
If you are unhappy with how we have handled your data, tell us first and we will try to put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk, or on 0303 123 1113.
Changes to this policy
We update this page when what we do changes. The date at the top shows when it was last revised.