1. About this Privacy Policy
This Privacy Policy explains how CarbonAI Limited (“CarbonAI”, “we”, “us” or “our”) collects and uses personal data in connection with our website at https://carbonai.eco, the CarbonAI platform, our APIs and our related services (the “Services”), and our wider business activities. It applies to visitors to our website, prospects, account holders and authorised users of our customers, individuals who interact with us in a business context, and individuals whose information appears in our research and AI outputs.
It should be read together with our Terms of Use, which govern access to and use of the Services. Where we process personal data on behalf of a customer who has engaged us as a processor, that handling is also governed by our Data Processing Addendum (the “DPA”).
2. Who we are and how to contact us
CarbonAI Limited is the controller of the personal data described in this Privacy Policy. We are registered in England and Wales (company number 16735735), with registered office at 7 Greenoak, Radcliffe, Manchester, England, M26 1EG.
For any privacy-related question or to exercise your rights, contact our Data Privacy Manager at privacy@carbonai.eco. We will respond as quickly as we reasonably can and, in any event, within the periods required by law.
3. Personal data we collect
The categories of personal data we may process, and typical examples of each, are summarised in the table below.
| Category | Examples |
|---|---|
| Identity data | First and last name, username, job title and role, employer or organisation. |
| Contact data | Business email address, telephone number, business postal address, records of correspondence. |
| Account data | Account credentials, authentication and access information, account preferences. |
| Transaction and commercial data | Subscription details, orders, invoices, billing records and payment information. |
| Technical and Usage data | IP address, browser and device information, operating system, time zone, log data, feature usage, session counts, token and API consumption, performance metrics and similar telemetry. |
| Marketing and communications data | Marketing preferences, opt-in and opt-out records, engagement with our communications, event participation. |
| Research data | Information about individuals (typically business contacts, executives, directors, project developers and other professionals) that we collect from public sources to produce our ESG, sustainability and carbon market research, ratings and analytics. |
| Customer input data | Personal data that customers or their authorised users choose to include in prompts, queries, uploaded files or other inputs to the Services (see section 6). |
We do not intentionally collect or process special category personal data (such as health, biometric, racial, religious or political data) or criminal offence data through the Services, and customers should neither submit such information to us, nor should include it in any prompt, query or upload. We do not knowingly collect personal data relating to children. The Services are not intended for individuals under the age of 18. However, given the nature of user-generated inputs and publicly available sources, such data may occasionally be included incidentally. Where this occurs, we take steps to minimise processing, restrict access, and delete or anonymise the data where appropriate.
4. How we collect personal data
We collect personal data when you interact with us directly — for example by visiting our website, requesting information, registering an account, subscribing to the Services, entering into a contract with us, attending an event or webinar, contacting our support team or otherwise communicating with us.
We also collect personal data through automated technologies when you use our website or the Services. Our servers and analytics tools collect Technical and Usage data, and we use cookies and similar technologies as described in section 13.
We additionally collect personal data from third party and public sources, including publicly available professional information (such as company websites, regulatory filings, news media and professional networking sites), business partners and our service providers.
5. Purposes and legal bases
We process personal data only where we have a lawful basis to do so under the UK GDPR.
We take reasonable steps to ensure that personal data we process is accurate, up to date and limited to what is necessary for the purposes described in this Privacy Policy. This includes:
- periodic review of research datasets;
- mechanisms to correct or update records; and
- processes to remove or anonymise data that is no longer relevant.
The principal purposes and bases on which we rely are set out below.
| Purpose | Legal basis |
|---|---|
| Providing and operating the Services, administering accounts, processing payments and providing customer support. | Performance of a contract with you (or steps prior to entering one); our legitimate interests in operating a paid service. |
| Securing, monitoring and improving the Services, including troubleshooting, abuse and fraud prevention, and analysing Usage Data. | Our legitimate interests in operating a secure, reliable and useful service. |
| Producing, maintaining and distributing our ESG, sustainability and carbon market research, ratings and analytics. | Our legitimate interests in providing independent market intelligence to our customers. |
| Sales, business development and corporate marketing to organisations and their representatives. | Our legitimate interests in growing our business, balanced against your rights and freedoms. |
| Marketing communications to individuals where the law requires consent (for example certain direct marketing emails). | Your consent. |
| Complying with our legal and regulatory obligations, including tax, accounting, anti-money-laundering, sanctions and other applicable laws. | Compliance with a legal obligation. |
| Establishing, exercising or defending legal claims, and protecting our rights, property or safety (and those of our users and third parties). | Our legitimate interests in protecting the business. |
Where we rely on legitimate interests, these interests include operating and improving the Services, developing our research and analytics products, ensuring security, and communicating with business users. We ensure that such processing is necessary and proportionate for a clearly defined purpose and that our interests are not overridden by your rights and freedoms by applying appropriate safeguards, including data minimisation, access controls, and opt-out mechanisms..
In particular, for research and analytics involving publicly available personal data, we assess the reasonable expectations of individuals, the nature of the data, and the potential impact of its use; for business development and marketing, we apply suppression lists, opt-out mechanisms, and targeting limitations; and for service improvement and AI-related processing, we apply data minimisation and access controls.
Where we collect personal data as part of a contractual requirement or legal obligation, failure to provide that data may mean we are unable to enter into or perform a contract with you or comply with our legal obligations.
You can ask for further information about this balancing exercise at any time.
6. AI features and personal data in inputs
The Services use artificial intelligence (“AI”) and machine learning. AI may be used to analyse user inputs, generate summaries, reports, insights and recommendations, and improve the functionality of the Services. Personal data that you or your colleagues include in prompts, queries or uploaded files will be processed by our AI systems and infrastructure providers to generate outputs. These outputs are intended to assist decision-making and should be independently verified where appropriate.
You should not upload personal data to the Services beyond what is strictly necessary for your authorised use of the Services. This applies to all accounts, whether paid, free or trial. You must not include sensitive personal information — including special category data such as health, biometric, racial, religious or political data, or criminal offence data — in any prompt, query or upload.
Where personal data is included in prompts or uploads under a paid customer relationship, we process that personal data as a processor on behalf of the customer, and our handling of it is governed by our DPA and the customer’s instructions, and in accordance with applicable data protection laws. For free and trial accounts, personal data in prompts and uploads is handled under this Privacy Policy.
The confidentiality of prompts, queries and uploaded content, and the restrictions on use of that content (including in relation to AI model training), are dealt with in our Terms of Use.
We do not use customer input data submitted to the Services to train our AI models except where strictly necessary to generate outputs in real time and not retained for training purposes, unless the customer has provided prior written consent or such processing is required by law. AI outputs are generated using probabilistic systems and may not always be accurate or complete.
We implement appropriate safeguards in relation to AI processing, including:
- human oversight of system outputs in contexts where decisions may affect individuals;
- processes to test, monitor and mitigate risks of bias, inaccuracy or inappropriate outputs;
- validation and evaluation procedures for model performance; and
- access controls and logging of AI system usage.
Where AI-generated outputs are used in decision-making processes, customers are responsible for ensuring that appropriate human review is applied and that decisions are not based solely on automated processing where this would produce legal or similarly significant effects.
7. Personal data in our research, ratings and outputs
Our research, datasets, ratings and AI outputs may include information about individuals where that is necessary to provide market intelligence about the organisations, projects, instruments or activities they are associated with — for example directors, officers, project developers, signatories or other publicly identifiable individuals. We collect this data from publicly available sources such as company websites, regulatory filings, and professional platforms. We process this information on the basis of our legitimate interests in providing independent ESG and carbon market intelligence, having considered the rights and reasonable expectations of those individuals. If you are an individual whose information appears in our outputs, you can exercise the rights described in section 12.
Where we collect personal data indirectly from publicly available sources, we provide this Privacy Policy to individuals within a reasonable period unless:
- the provision of such information proves impossible or would involve a disproportionate effort (for example, where datasets contain large volumes of professional contact data); or
- obtaining or disclosure is expressly laid down by law.
Where we rely on the disproportionate effort exemption, we implement alternative safeguards, including making this Privacy Policy publicly available, enabling rights requests, and applying data minimisation and relevance checks.
Individuals have the right to object at any time to the processing of their personal data for inclusion in our research, analytics or outputs based on our legitimate interests.
8. Who we share personal data with
We share personal data with the following categories of recipients:
- our staff and contractors who need access to perform their roles, under appropriate confidentiality obligations;
- service providers and processors that support our business and the Services, including providers of cloud hosting and infrastructure, AI infrastructure, security and monitoring, analytics, customer relationship management, marketing and communications, payment processing, document execution and professional advisory services;
- our professional advisers (including lawyers, accountants and auditors), and our insurers;
- regulators, courts, law enforcement and other public authorities where we are required by law or where we consider this appropriate to comply with the law or to protect our rights or the rights, property or safety of others; and
- third parties involved in a corporate transaction, such as a merger, acquisition, investment or sale of assets, subject to appropriate safeguards.
Our principal service providers are located in the United Kingdom, the European Economic Area (EEA) and the United States. Customer and account data is primarily hosted in the United Kingdom and/or the EEA, although certain service providers, including AI infrastructure providers, may process personal data in the United States or other jurisdictions. Where personal data is transferred internationally, we implement appropriate safeguards as described in section 10. We ensure that all such providers are contractually bound to process personal data only on our instructions and to implement appropriate safeguards.
A current list of the principal subprocessors and service providers used to deliver the Services, including their processing locations where applicable is maintained in Schedule 3 of our Data Processing Addendum.
9. International transfers
We are based in the United Kingdom. Some of our service providers are located in, or may transfer personal data to, countries outside the UK and the European Economic Area. Where we make such transfers, we put in place an appropriate transfer mechanism under the UK GDPR — typically reliance on a UK adequacy regulation, the UK International Data Transfer Addendum to the EU Standard Contractual Clauses (the “IDTA”) or the EU Standard Contractual Clauses (the “SCCs”), with additional safeguards where required.
Where required, we carry out transfer risk assessments to assess whether personal data transferred outside the UK is adequately protected and to identify any supplementary measures needed to ensure a level of protection essentially equivalent to that provided under UK GDPR.
You can request further information about these safeguards by contacting support@carbonai.eco.
10. Security
We maintain commercially reasonable technical and organisational security measures designed to protect personal data against unauthorised access, loss, misuse, alteration or disclosure, including appropriate access controls, encryption in transit and at rest, vulnerability management, logging and monitoring, incident response procedures and personnel training. No system can be guaranteed completely secure.
11. Retention
We retain personal data only for as long as is reasonably necessary for the purposes set out in this Privacy Policy, including to meet legal, accounting, regulatory and reporting obligations and to deal with disputes or claims. The principal periods we apply are summarised below.
| Data | Indicative retention period |
|---|---|
| Account, contract and billing records | Term of the relevant agreement, plus 6 years to address limitation, tax and audit requirements. |
| Customer Data submitted to the Services | In accordance with the relevant order document and our DPA, and otherwise for the term of the account. |
| Usage Data and technical logs | Up to 24 months, depending on type and purpose. |
| Marketing data | Until you unsubscribe or otherwise opt out, plus a short suppression record to honour your choice. |
| Research data about individuals appearing in our outputs | For as long as necessary for our market intelligence offering, subject to periodic review (at least annually) to ensure the data remains accurate, relevant and necessary. |
| Records relating to legal claims | For the period of the relevant limitation period. |
We apply criteria to determine retention periods, including:
- the nature and sensitivity of the data;
- the purposes for which it is processed;
- legal and regulatory requirements; and
- the risk of harm from unauthorised use or disclosure.
We may retain anonymised or aggregated information, which does not identify any individual, for longer periods.
12. Your rights
Subject to applicable law, you have the right to:
- request access to the personal data we hold about you;
- ask us to correct inaccurate or incomplete data;
- ask us to erase personal data in certain circumstances;
- ask us to restrict our processing in certain circumstances;
- object at any time to processing carried out on the basis of legitimate interests, including profiling, or for direct marketing;
- request data portability where the processing is based on consent or contract and is carried out by automated means;
- withdraw consent at any time where processing is based on consent; and
- not be subject to a decision based solely on automated processing that produces legal or similarly significant effects.
To exercise any of these rights, contact privacy@carbonai.eco. We may need to verify your identity before responding. We will respond within the period required by law (generally one month), which may be extended by a further two months for complex or numerous requests.
If you have a concern that we have not addressed to your satisfaction, you can complain to the Information Commissioner’s Office (“ICO”), the UK supervisory authority for data protection, at https://ico.org.uk. If you are based outside the UK, you may also be able to lodge a complaint with the supervisory authority in your country.
13. Cookies and similar technologies
Our website uses cookies and similar technologies. Essential cookies are necessary to operate the website and the Services — for example for authentication, security and session management — and are set on the basis of our legitimate interests.
We obtain consent for non-essential cookies, including analytics and marketing cookies through a compliant consent management platform that allows users to accept, reject or customise cookie settings in line with applicable law.
You can change your preferences at any time using our cookie banner or your browser settings; blocking essential cookies may affect the operation of the website and the Services.
14. Marketing communications
Where permitted by law, we may send you business communications about the Services, our research, events and similar matters. You can opt out of marketing communications at any time by using the unsubscribe link in any marketing email or by emailing support@carbonai.eco. We will still send you operational and service-related communications where these are necessary.
15. Changes to this Privacy Policy
We may update this Privacy Policy from time to time. The “Last updated” date at the top shows when it was last changed. If we make material changes, we will let you know by email or by a notice on our website or within the Services.
16. Contact and complaints
You have the right to lodge a complaint with the ICO at any time. We would, however, appreciate the opportunity to address your concerns about this Privacy Policy or our use of personal data, before you approach the ICO.
Please contact our Data Privacy Manager at support@carbonai.eco, or by post to CarbonAI Limited, 7 Greenoak, Radcliffe, Manchester, England, M26 1EG. We will investigate and respond in a timely and transparent manner in accordance with applicable law.