Privacy notice
Last updated October 2026.
Who we are
Carbon Recycling is run by Charles Mansfield-Osborne, a sole trader trading as Carbon Recycling, of 35 Falmer Gardens, Woodingdean, Brighton and Hove, East Sussex, BN2 6NE. VAT number GB454041323. We are the data controller for account, website and billing data, and a processor for the data your organisation records in the app. Contact us about privacy at support@carbonrecycling.co.uk.
We are registered with the Information Commissioner's Office (ICO) as a data controller, registration number ZC280444.
What we collect
- Account details: your name, work email and a hashed password.
- Organisation data you enter: energy, travel, waste and supplier figures, and report details.
- Supplier contact details you add, and the figures suppliers submit.
- Billing details, handled by Stripe. We never see full card numbers.
- Technical logs needed to run and secure the service.
- A count of how many data pages each network views a day, to stop automated bulk copying. We store a one-way code made from the IP address, not the address itself.
- Your cookie choices, with the date and the version of the cookie policy you saw.
- Only if you allow analytics: which pages you visit and which steps you complete (for example signing up or choosing a plan), through Google Analytics.
- Only if you allow session recording: clicks, scrolling and mouse movement, through Microsoft Clarity. What you type, and the figures inside the app, are hidden.
- Page views and load times without cookies or identifiers, through Cloudflare Web Analytics.
- Only if you ask a free tool to email you its result: your email address, the result, and the company you looked up on Companies House (its name, number, status, type, registered postcode and SIC codes). Our free tools otherwise work without your name or email, and a company look-up on its own is not kept.
- If you look up your company when signing up or in Settings: its company number and SIC codes from Companies House, kept with your organisation's details.
Why and on what basis
- To provide the service, under our contract with your organisation.
- To keep it secure and to measure it without cookies (Cloudflare Web Analytics): our legitimate interests.
- Analytics, session recording and marketing measurement: your consent, which you can withdraw at any time.
- The newsletter, and any other marketing email: your consent, which you can withdraw at any time with the unsubscribe link in every email.
- Emailing you a free tool's result you asked for, and keeping a record of it to answer any questions about it and to understand who our tools help: our legitimate interests. We don't send marketing to that address unless you also ticked the newsletter box.
- Keeping invoices and consent records: legal obligations.
Who we share it with
These providers process data for us under data processing terms:
- Cloudflare: hosting, database, email sending and cookieless web analytics.
- Stripe: payments and invoices. Stripe is also a controller in its own right for payment and fraud checks, under its own privacy policy.
- Google (Google Analytics 4): analytics, only with your consent.
- Microsoft (Clarity): session recording and heatmaps, only with your consent.
- Brevo: sending the newsletter, only to people who signed up and confirmed.
- Companies House: when you look up a company, we send what you typed (a company name or number) to the Companies House public register to find it.
If you connect your accounting software (such as Xero, QuickBooks, Sage or FreeAgent), we read the spending figures you choose to import, and keep the connection details so you can import again. If you connect an AI assistant (such as Claude or ChatGPT), it can read or add figures in your account as you ask it to, and what it receives is handled by that assistant's provider under its own terms. You can disconnect either at any time in the app.
If you sign in with Google or Microsoft, we receive your name and email address from them, and nothing else. If you upload a bill for us to read, it is sent once to Cloudflare Workers AI to read the figures, which fill in the form for you to check; we don't keep the file.
Some of these providers process data in the United States. Transfers rely on the UK-US data bridge or the UK's international data transfer agreement or addendum. We don't sell data or show you adverts.
How long we keep it
- Account and organisation data: while your account is open, including after a trial or plan ends. When you delete your organisation it is removed straight away, and from backups within 90 days. If an organisation has had no trial or paid plan for 24 months, we may delete it after emailing its admins.
- Invoices: six years.
- Cookie choice records: two years.
- Newsletter: while you're subscribed. After you unsubscribe we keep your address and the dates, marked unsubscribed, so we never add you again by mistake. Sign-ups never confirmed are deleted after 30 days.
- Free tool results emailed to you, with the company you looked up: two years.
- Daily data page counts: two days. Checks that a visitor claiming to be a search engine is one: seven days.
- Google Analytics: 14 months. Microsoft Clarity: recordings 30 days, heatmaps and summaries 13 months.
Your rights
You can ask for access, correction, deletion, restriction or a copy of your data, and object to processing based on our legitimate interests. You can withdraw consent for cookies at any time with "Cookie settings" at the foot of each page. Contact support@carbonrecycling.co.uk. If you're unhappy, you can complain to the Information Commissioner's Office at ico.org.uk.
Cookies
We use strictly necessary cookies to keep you signed in and remember your choices, and optional analytics, session recording and marketing cookies only if you allow them. Our cookie policy lists each one.