Privacy Policy

1. Who We Are

This Privacy Policy explains how Carbon Logger ("we," "us," "our") collects, uses, discloses, and safeguards information when you visit carbonlogger.com or use our carbon accounting platform at app.carbonlogger.com (together, the "Service"). The data controller responsible for your information is Carbon Logger. Direct any data protection query to contact@carbonlogger.com.

2. Information We Collect

What we collect depends on how you interact with us:

• Website visitors & prospects: name, work email, company, industry, and message content when you submit our contact form, plus standard technical data (IP address, browser type, device, referring page) collected automatically.
• Service account holders: account credentials, billing and subscription details, and any operational or emissions data you or your organization upload or connect to the Service ("Customer Data"). Customer Data may include personal data about your own employees or suppliers (e.g., named contacts on supplier records) — see Section 4 on how we handle that.
• Cookies & similar technologies: see Section 9. We currently do not use analytics or advertising cookies; this policy will be updated before any are introduced.

3. Why We Process It, and Our Legal Basis

For visitors and users in the EU/UK, GDPR requires us to state a legal basis for each purpose. Here is ours:

• Responding to your enquiry or demo request — legitimate interest in answering business enquiries.
• Providing the Service, billing, and support to account holders — performance of our contract with you or your organization.
• Sending product or compliance updates — consent, which you can withdraw at any time via the unsubscribe link or by contacting us.
• Security, fraud prevention, and enforcing our Terms — legitimate interest in keeping the Service safe.
• Meeting tax, accounting, or regulatory recordkeeping obligations — legal obligation.

4. Customer Data: Our Role as Processor

Where you upload operational or emissions data that includes personal data about third parties (for example, named contacts at a supplier), we act as a data processor on your organization's behalf, and you (the customer) remain the data controller for that data. You are responsible for having a lawful basis to share it with us. We process it only on your documented instructions and to provide the Service — never for our own marketing purposes.

5. Who We Share Information With

We do not sell personal information. We share it only with:

• Web3Forms — processes our website contact-form submissions; data is stored on AWS servers in the US-East region and automatically deleted after 30–365 days depending on plan. A GDPR Article 28 data processing addendum is publicly available from Web3Forms.
• Brevo (Sendinblue) — powers the newsletter signup form on our Blog and Resources pages; only loads, and only receives your email address, if you click "Signup" to open that form.
• Vercel — hosts this marketing website (carbonlogger.com).
• Infrastructure and hosting providers for app.carbonlogger.com — host the platform itself; named here once finalized.
• A payment processor — will process subscription payments once app.carbonlogger.com accepts paying customers.
• Professional advisers, regulators, or law enforcement where required by law, or a successor entity in the event of a merger, acquisition, or sale of assets.

Each processor is bound by confidentiality and data protection terms. We will update this list as we onboard additional vendors.

6. Data Retention & Security

Contact-form enquiries are retained per Web3Forms' schedule above. Account and Customer Data are retained while your account is active and for up to 5 years afterward to meet accounting, tax, and legal recordkeeping obligations under UAE law, after which they are deleted or anonymized. We use industry-standard technical and organizational measures (encryption in transit, access controls) to protect data, though no method of transmission or storage is 100% secure.

7. Your Rights

Depending on where you are, you have the following rights. To exercise any of them, contact contact@carbonlogger.com; we will respond within the timeframe your law requires.

• UAE (PDPL): access, correction, erasure, restriction, objection, and data portability, plus the right to lodge a complaint with the UAE Data Office.
• EU/UK (GDPR / UK GDPR): access, rectification, erasure, restriction, portability, and objection, the right to withdraw consent at any time, and the right to lodge a complaint with your local supervisory authority (or the ICO in the UK).
• California (CCPA/CPRA): the right to know what personal information we hold, to delete it, to correct it, to opt out of sale or sharing (we do not sell or share personal information), to limit use of sensitive personal information, and to be free from discrimination for exercising these rights. You may use an authorized agent to submit a request.
• Australia (Privacy Act / APPs): access and correction of your personal information, and the right to complain to the Office of the Australian Information Commissioner (OAIC) if unresolved.

8. International Transfers

As a platform serving customers across the GCC, EU, UK, US, and Australia, your information may be transferred outside your home country — for example, contact-form data is processed by Web3Forms on servers in the United States, and, if you click to load the newsletter signup form on our Blog and Resources pages, that form is served by Brevo in the European Union. Where we transfer personal data out of the EU/UK, we rely on appropriate safeguards such as Standard Contractual Clauses. We will disclose additional cross-border transfers here as we add vendors.

9. Cookies

Our fonts and icons are self-hosted, not loaded from a third party, so viewing this site does not by itself send any data to Google or set any font-related cookies. Our Blog and Resources pages offer a newsletter signup form from Brevo — it only loads, and only sets any cookies, after you click "Signup." We do not otherwise use analytics or advertising cookies.

10. Children's Privacy

The Service is intended for business use and is not directed at individuals under 18. We do not knowingly collect personal data from children.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified via the website or by email to registered users, with an updated "Last updated" date above.

12. Contact Us

Questions about this Privacy Policy or your data can be sent to contact@carbonlogger.com.