PRIVACY POLICY
how we handle personal data
How ZeroCarbon Tech handles personal data on its carbon accounting platform, and how you can use your rights.
1. Who We Are
ZeroCarbon Tech ("ZeroCarbon", "we") runs a carbon accounting platform. Companies use it to record their emissions, prepare greenhouse gas inventories, CBAM communications and BRSR reports, and share figures with buyers and verifiers.
For data a company puts in its workspace, the company is the controller and we process it on its behalf. For our own records, such as accounts, billing, security logs and our website, we are the controller.
Privacy questions: privacy@zerocarbon.org.in. Grievances: grievance@zerocarbon.org.in.
This notice is written to meet India's Digital Personal Data Protection Act, 2023, the EU GDPR, the UK GDPR and the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA).
2. What Data We Process and Why
| Data | Examples | Why | Legal basis |
|---|---|---|---|
| Account and contact | Name, work email, role, company name and country | Run the account and sign you in | Contract (Art. 6(1)(b)) |
| Sign-in and security | Password hash (bcrypt), one-time sign-in codes sent by email, IP address, browser, a security audit log | Protect accounts and detect misuse | Legitimate interest (Art. 6(1)(f)); legal obligation (Art. 6(1)(c)) |
| Business activity records | Electricity and fuel bills, invoices, e-way bills, Tally exports, shipments, supplier data | Calculate and report emissions | Contract (Art. 6(1)(b)); your consent for workspace processing (Art. 6(1)(a)) |
| Documents | Files you upload or connect, with a SHA-256 hash of each | Read figures and keep the evidence behind each number | Contract (Art. 6(1)(b)); consent (Art. 6(1)(a)) |
| Billing | Plan, payments and receipts. Cards are handled by Dodo Payments, never by us | — | Contract (Art. 6(1)(b)); legal obligation for tax (Art. 6(1)(c)) |
| Website visits | Pages visited, only after you accept analytics cookies | — | Consent (Art. 6(1)(a)) |
The article numbers refer to the GDPR and the UK GDPR.
Under India's DPDP Act, we act as a Data Processor for the data a company puts in its workspace. The company is the Data Fiduciary for that data. For our own records, we are the Data Fiduciary.
We do not sell personal data. We do not build marketing profiles of the people in your workspace.
3. Where the Data Comes From
- You and your team.
- Apps you connect, such as Gmail, Outlook, Google Drive, OneDrive and other apps. This happens only after an owner or admin connects them, and only the mail and files Cowork is asked to read are used.
- Tally exports sent by the Tally bridge.
- Bills forwarded to your workspace's own inbound address.
- Your suppliers, through the supplier portal, after you invite them.
- Data your systems send with an API key.
- Calculations you ask ChatGPT, Claude or another AI assistant to save with our calculator tools.
- Public sources: your website's public pages at sign-up, to suggest a profile you confirm; public web pages when you ask Cowork to look something up; and peer comparisons from other companies' own published reports, each linked.
Our calculator tools in AI assistants work without an account. We keep nothing from a calculation unless you ask the assistant to save it. A saved set holds only the calculation inputs and results, under a private link that anyone holding it can open. If you then request a workspace, the set is attached to your request.
We do not buy contact lists or scrape people's details.
4. Emission Figures and Their Evidence
Every figure in your ledger can be traced back to where it came from. This record includes some personal data, such as the name of the person who added or approved a figure.
- Each figure links to its source document, with the page or line where it was read.
- Each figure shows the emission factor used, with its publisher and version.
- Each figure shows who added it and who approved it.
- The “Trace this figure” view shows this whole chain for any figure.
How the evidence is kept
- When you upload a file, we record its SHA-256 hash.
- Each report we generate is anchored with a SHA-256 hash in our own ledger, so a copy can be checked later.
- A correction keeps the earlier value in the history. It does not overwrite it.
5. How We Use AI With Your Data
AI reads and drafts. It never calculates your emissions, and it never changes your records without a person approving.
- Cowork uses models from Google (Gemini), Anthropic (Claude), NVIDIA and Groq through the HeyRoute model router. You choose the model.
- Text in digital PDFs is read by our own code. Scans and photos are read by an AI model.
- Every emission figure is calculated by our own rule-based engine from a published emission factor, and shows its source.
- Cowork asks before adding or changing a record. An owner or admin can turn on auto-approval for chosen tasks, and every approval is logged.
- We do not train our own AI models on your workspace data.
- We do not use AI to make automated decisions that have legal effects on you.
6. Who We Share It With
| Provider | What it does for us | Where |
|---|---|---|
| Neon | Database | Singapore |
| Render | Cowork, background jobs, the PACT exchange | Singapore |
| Vercel | Website and application | — |
| Cloudinary | Stores uploaded files and reports | — |
| Google Gemini | AI models | United States |
| Anthropic, NVIDIA, Groq, HeyRoute | AI models | Provider's region |
| Composio, Google, Microsoft | Connected mailboxes, drives and apps, only when you connect them | — |
| Google SMTP | Sign-in codes, alerts and reports by email | — |
| Dodo Payments | Checkout and payment receipts, as merchant of record | — |
| Cloudflare Turnstile, Google Analytics, Vercel Analytics | Bot checks; Google Analytics only after cookie consent; Vercel Analytics is cookieless | — |
| Verra, Gold Standard | Carbon registries, only when you buy and retire credits | — |
- Buyers you answer through PACT, verifiers you give a share link to, and suppliers you invite see only what you send them.
- We disclose data to authorities only when the law requires it.
- A customer Data Processing Addendum is being prepared; ask for it at privacy@zerocarbon.org.in.
7. International Transfers
Workspace data is stored in Singapore. Some AI processing happens in the United States.
- India: the DPDP Act permits transfers except to countries restricted under Section 16. None of our locations is restricted today.
- EU and UK: we rely on each provider's data-protection terms. We do not yet sign EU Standard Contractual Clauses ourselves. EU and UK customers should ask us before sending personal data.
How we protect data wherever it is stored is set out in the Security section below.
8. Security
These are the measures in place today.
- Passwords: stored only as bcrypt hashes, never as plain text.
- Sign-in codes: a one-time code sent by email is required when you sign in on a new device. On a device you marked as trusted, it is required at least every 30 days.
- Password changes: after a password change, your other sessions end and you must sign in again.
- Access levels: there are four levels: owner, admin, member and viewer. They limit who can change data, consent and billing.
- Isolation: row-level isolation in the database stops one company from reading another company's records.
- API keys: stored only as SHA-256 hashes. A key acts with member access.
- Rate limits: sign-in and form endpoints are rate-limited.
- Audit log: a hash-chained security audit log records sensitive actions.
- Encryption: HTTPS for all traffic, and encryption at rest by our database and storage providers.
What we have not done yet
- SOC 2 and ISO 27001 are in progress, not achieved.
- No independent penetration test has been completed yet.
10. Your Rights and How to Use Them
| Right | How |
|---|---|
| See and download your data | Data control, Export: a full copy in one file |
| Correct it | Edit it in the workspace, or Data control, Correct profile |
| Erase it | Data control, Erase, after a typed confirmation. Records the law makes us keep are kept until their period ends |
| Withdraw consent | Data control, Withdraw: processing stops at once, and nothing is deleted |
| Give consent again | Sign in, open Data control and tick the notice |
| Object, restrict or complain | Email privacy@zerocarbon.org.in, or contact your regulator: in India the Data Protection Board, in the UK the ICO, in the EU your national data protection authority |
- When you withdraw consent, owners and admins can still sign in, but only Data control opens, so you can export, erase or give consent back.
- Everyone with owner or admin rights gets an email recording the decision.
- Consent can only be given back from a signed-in session, never from an email link.
Your rights by region
- India (DPDP Act): access, correction, erasure, grievance redressal, and nominating someone to act for you if you die or cannot act (Section 14). Email privacy@zerocarbon.org.in. If we do not resolve it, you can go to the Data Protection Board of India.
- EU and UK (GDPR, UK GDPR): access, rectification, erasure, restriction, portability, objection, and the right to complain to a supervisory authority. In the UK, that is the ICO.
- California (CCPA/CPRA): the right to know, delete and correct. We do not sell or share personal information for cross-context behavioural advertising. We will not treat you differently for using these rights.
We answer emailed requests within 30 days, and we confirm the requester's identity first.
11. If There Is a Data Breach
If a breach affects personal data, we will tell affected customers without undue delay.
- India: we will notify the Data Protection Board and the people affected, as the DPDP Act and its Rules require.
- EU and UK: where the GDPR applies, we will notify the supervisory authority within 72 hours.
We will notify other authorities where the law requires it.
12. How Long We Keep Data
| Data | Default period | Why |
|---|---|---|
| Emission records and their source documents | 7 years | They back filed reports. SEBI expects BRSR evidence to be kept for about 8 years |
| Audit logs | 7 years | They show who changed what |
| User account data after a user leaves | 1 year | — |
| Consent decisions | As long as the workspace exists | — |
| Calculations saved from an AI assistant | 14 days; 60 days once attached to a workspace request; 30 days after the workspace is set up | So you can view them and add them to a workspace. Deleted automatically at the end of the period |
| Payment records | As long as tax law requires | Tax law |
- An owner or admin can change the first three periods in Data control.
- Erasure deletes in one step, except what the law makes us keep. Our providers' backups expire on their own schedules.
- A company can turn on automatic deletion of source files at the end of their period. Otherwise we apply it on request.
See our Data Retention Policy for more detail.
13. Children
The service is for businesses. It is not meant for anyone under 18.
We do not knowingly process children's personal data. If we learn that we have, we delete it.
14. Contact and Grievances
You do not need an account to contact us. Most rights can also be used directly from Data control in your workspace.
ZeroCarbon Tech
Privacy questions and rights requests: privacy@zerocarbon.org.in
Grievances (DPDP Act): grievance@zerocarbon.org.in
15. Changes to This Notice
We will update this notice when what we do changes, and show the date of the last change at the top of this page.
Earlier versions are available on request at privacy@zerocarbon.org.in.