Privacy Policy

1. Data Controller

CarbonInsights OÜ
Ahtri tn 12, 15551 Tallinn, Estonia
Business ID 17468248 · VAT EE102971943
Contact: privacy@carboninsights.net

CarbonInsights OÜ is the controller of your personal data.

2. Data We Collect

• Account data: name, business email, company, and login credentials.
• Usage data: logins, pages and features used, and API activity.
• Behavioral data: pages visited, features used, and interaction patterns within the dashboard to enable personalized experiences.
• Billing data: information needed to invoice and process payments for paid clients.
• Communications: messages you send us and related correspondence.
• Technical data: IP address, device and browser information, and cookies (see Section 8).

We do not intentionally collect special categories of personal data.

3. How and Why We Use It

We process personal data to:

• Provide the Service: create and manage your account and deliver data and analytics (legal basis: performance of a contract).
• Operate and improve the Service: ensure security and prevent misuse (legal basis: legitimate interests). This does not include optional analytics cookies (see Section 8); those require your consent.
• Personalize your dashboard experience: using first-party product usage signals we collect as part of providing the Service (for example authenticated page-visit events), to adapt overview content to your workflow (legal basis: legitimate interest to improve user experience). Optional third-party analytics tools (Clarity, Google Analytics) are separate and run only with your consent under Section 8.
• Handle billing: meet accounting and tax obligations (legal basis: legal obligation).
• Communicate with you: send updates about the Service where permitted; you can opt out at any time (legal basis: legitimate interests or consent).

4. Sharing Your Data

We do not sell personal data. We share it only with:

• Service providers: who host our platform, process payments, and provide technical support, acting on our instructions under data-processing agreements. This includes analytics providers when you consent (see Section 8).
• Authorities: where required by law.
• Successors: in the event of a merger, acquisition, or reorganisation.

5. International Transfers

Some providers process data outside the European Economic Area (EEA), including in the United States. Where that happens, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework.

If you Accept All cookies, analytics data may be processed by:

• Microsoft (Clarity) - session and usage analytics
• Google (Google Analytics) - traffic and engagement metrics

6. Retention

We keep personal data for as long as your account is active and as needed to provide the Service. Thereafter, we retain data only as required to meet legal obligations (e.g., accounting records) or to resolve disputes.

7. Your Rights

Under the GDPR, you have the right to:

• Access your personal data
• Correct inaccurate data
• Delete your data
• Restrict or object to processing
• Request data portability
• Withdraw consent at any time

To exercise these rights, contact us at privacy@carboninsights.net.

You may also lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee) or your local supervisory authority.

9. Security

We maintain appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or misuse. No system is completely secure, and we cannot guarantee absolute security.

10. Changes and Contact

We may update this Policy from time to time. Material changes take effect 30 days after we post them.

For any questions about this Policy or your personal data, contact us at:

privacy@carboninsights.net

© 2026 CarbonInsights OÜ · All rights reserved.