Privacy Policy

1. Information We Collect

To provide our utility data reconciliation and BRSR compliance services, we collect:

• Company Name and Headquarters details.
• Facility-specific utility data (Electricity bills, fuel consumption, travel logs).
• User contact information (Email address) for account management.
• Calculated emission figures and historical reduction targets.

2. Data Storage & Infrastructure

Primary database records and uploaded file storage are hosted in Mumbai, India (Supabase on AWS ap-south-1). Application hosting and compute are in Mumbai (bom1) via Vercel. However, automated document processing uses Google Gemini and may occur outside India (including the United States). We use industry-standard encryption for data at rest and in transit.

3. Use of Information & Third-Party Processors

Your data is used exclusively to generate compliance-ready BRSR and CCTS reports, provide AI-driven decarbonization recommendations, and maintain an auditable trail for regulatory verification. We do not sell your data. To provide our services, operational customer documents and account data are processed by the following sub-processors:

• Supabase: Primary PostgreSQL database and document file storage (hosted in Mumbai, India).
• Vercel: Application hosting and compute in Mumbai (bom1).
• Google Gemini API: Document optical character recognition (OCR) and data extraction (may process outside India).
• Resend: In-app transactional notifications and auditor invites (US East).

4. Data Retention & Deletion Requests

Operational records, calculated emissions, and uploaded evidence documents are retained indefinitely by default to maintain compliance and audit continuity. Data deletion is manual on request: you can request the deletion of your account, company data, and uploaded documents by emailing support@carbontrack.ink. An administrator will manually delete all associated records and storage files within 30 business days.