Privacy Policy

1. Who We Are

This Privacy Policy explains how Carbon Logger ("we," "us," "our") collects, uses, discloses, and safeguards information when you visit carbonlogger.com or use our carbon accounting platform at app.carbonlogger.com (together, the "Service"). The data controller responsible for your information is Carbon Logger. Direct any data protection query to contact@carbonlogger.com.

2. Information We Collect

What we collect depends on how you interact with us:

• Website visitors & prospects: name, work email, company, industry, and message content when you submit our contact form, plus standard technical data (IP address, browser type, device, referring page) collected automatically.
• Service account holders: account credentials, billing and subscription details, and any operational or emissions data you or your organization upload or connect to the Service ("Customer Data"). Customer Data may include personal data about your own employees or suppliers (e.g., named contacts on supplier records) — see Section 4 on how we handle that.
• Cookies & similar technologies: see Section 9. We use Google Analytics to understand how visitors use our website; we do not use advertising cookies.

3. Why We Process It, and Our Legal Basis

For visitors and users in the EU/UK, GDPR requires us to state a legal basis for each purpose. Here is ours:

• Responding to your enquiry or demo request — legitimate interest in answering business enquiries.
• Providing the Service, billing, and support to account holders — performance of our contract with you or your organization.
• Sending product or compliance updates — consent, which you can withdraw at any time via the unsubscribe link or by contacting us.
• Security, fraud prevention, and enforcing our Terms — legitimate interest in keeping the Service safe.
• Meeting tax, accounting, or regulatory recordkeeping obligations — legal obligation.

4. Customer Data: Our Role as Processor

Where you upload operational or emissions data that includes personal data about third parties (for example, named contacts at a supplier), we act as a data processor on your organization's behalf, and you (the customer) remain the data controller for that data. You are responsible for having a lawful basis to share it with us. We process it only on your documented instructions and to provide the Service — never for our own marketing purposes.

5. Who We Share Information With

We do not sell personal information. We share it only with:

• Web3Forms — processes our website contact-form submissions; data is stored on AWS servers in the US-East region and automatically deleted after 30–365 days depending on plan. A GDPR Article 28 data processing addendum is publicly available from Web3Forms.
• Google Analytics — measures website traffic and usage (pages viewed, approximate location, device and browser) using cookies and similar identifiers; data is processed by Google, including on servers outside your country.
• Brevo (Sendinblue) — powers the newsletter signup form on our Blog and Resources pages; only loads, and only receives your email address, if you click "Signup" to open that form.
• Vercel — hosts this marketing website (carbonlogger.com).
• Infrastructure and hosting providers for app.carbonlogger.com — host the platform itself; named here once finalized.
• A payment processor — will process subscription payments once app.carbonlogger.com accepts paying customers.
• Professional advisers, regulators, or law enforcement where required by law, or a successor entity in the event of a merger, acquisition, or sale of assets.

Each processor is bound by confidentiality and data protection terms. We will update this list as we onboard additional vendors.

6. Data Retention & Security

Contact-form enquiries are retained per Web3Forms' schedule above. Account and Customer Data are retained while your account is active and for up to 5 years afterward to meet accounting, tax, and legal recordkeeping obligations under UAE law, after which they are deleted or anonymized. We use industry-standard technical and organizational measures (encryption in transit, access controls) to protect data, though no method of transmission or storage is 100% secure.

7. Your Rights

Depending on where you are, you have the following rights. To exercise any of them, contact contact@carbonlogger.com; we will respond within the timeframe your law requires.

• UAE (PDPL): access, correction, erasure, restriction, objection, and data portability, plus the right to lodge a complaint with the UAE Data Office.
• EU/UK (GDPR / UK GDPR): access, rectification, erasure, restriction, portability, and objection, the right to withdraw consent at any time, and the right to lodge a complaint with your local supervisory authority (or the ICO in the UK).
• California (CCPA/CPRA): the right to know what personal information we hold, to delete it, to correct it, to opt out of sale or sharing (we do not sell or share personal information), to limit use of sensitive personal information, and to be free from discrimination for exercising these rights. You may use an authorized agent to submit a request.
• Australia (Privacy Act / APPs): access and correction of your personal information, and the right to complain to the Office of the Australian Information Commissioner (OAIC) if unresolved.

8. International Transfers

As a platform serving customers across the GCC, EU, UK, US, and Australia, your information may be transferred outside your home country — for example, contact-form data is processed by Web3Forms on servers in the United States, website analytics data is processed by Google (including in the United States), and, if you click to load the newsletter signup form on our Blog and Resources pages, that form is served by Brevo in the European Union. Where we transfer personal data out of the EU/UK, we rely on appropriate safeguards such as Standard Contractual Clauses. We will disclose additional cross-border transfers here as we add vendors.

9. Cookies

Our fonts and icons are self-hosted, so they do not set any cookies or send data to a third party. We use Google Analytics, which sets cookies in your browser and sends usage data (such as pages viewed, approximate location, and device and browser type) to Google to help us understand and improve the website; you can opt out with Google's browser add-on at tools.google.com/dlpage/gaoptout or by blocking cookies in your browser settings. Our Blog and Resources pages also offer a newsletter signup form from Brevo — it only loads, and only sets any cookies, after you click "Signup." We do not use advertising cookies.

10. Children's Privacy

The Service is intended for business use and is not directed at individuals under 18. We do not knowingly collect personal data from children.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified via the website or by email to registered users, with an updated "Last updated" date above.

12. Contact Us

Questions about this Privacy Policy or your data can be sent to contact@carbonlogger.com.