Privacy notice

Draft for review. Last updated September 2026.

Who we are

Carbon Recycling is operated by [legal entity name, company number and registered address]. We are the data controller for account data and a processor for the data your organisation records.

What we collect

• Account details: your name, work email and a hashed password.
• Organisation data you enter: energy, travel, waste and supplier figures, and report details.
• Supplier contact details you add, and the figures suppliers submit.
• Billing details, handled by Stripe. We never see full card numbers.
• Technical logs needed to run and secure the service.

Why and on what basis

To provide the service under our contract with your organisation, to keep it secure (legitimate interests), and to meet legal obligations such as keeping invoices.

Who we share it with

Hosting, database and email (Cloudflare), and payments (Stripe) providers, under data processing agreements. We don't sell data or use it for advertising.

How long we keep it

For as long as your account is open, then 90 days, except invoices which we keep for six years.

Your rights

You can ask for access, correction, deletion, restriction or a copy of your data, and complain to the Information Commissioner's Office. Contact [privacy email].

Cookies

We use one strictly necessary cookie to keep you signed in. We don't use tracking or advertising cookies.