Privacy Policy

The data controller is DeCarbonPro LLC, 30 N Gould St Ste R, Sheridan, WY 82801, USA. Contact us about anything on this page at support@decarbonpro.com.

1. What we collect, and why

We collect personal data when you give it to us, and a small amount automatically when you use the site:

A result emailed to you

Data collected: Your first name, your email address, and the CN code, country and figures of the result you asked us to send.

Why: To send that result, and to write to you about CBAM.

A report you download

Data collected: Your name, email address, company name, country, sector and annual export volume.

Why: To send the report and guidance for your sector.

The contact form

Data collected: Your name, email address, company name, country, sector, role and your message.

Why: To answer you.

The newsletter

Data collected: Your email address, when you signed up and confirmed, the page you signed up on, when you unsubscribed, which issues we sent you, and the message ID our email provider gives each email we send you.

Why: Only to send this newsletter.

A demo booking

Data collected: Your name, email address and the time you chose.

Why: To arrange and confirm the meeting.

A sign-up we turn away

Data collected: If we refuse a sign-up — because the address is a personal one rather than a work one, for example — we keep the email address you typed, the reason we refused it, the date, the browser you used and the page you came from. After 90 days we delete the email address, the browser and the page, and keep only a count: the reason, whether it was the form or the server that refused it, the date, the domain part of the address, and a scrambled code that tells us two attempts came from the same person — we cannot read an address back from it, though we could check a guess. We delete the whole record after 12 months.

Why: To see who our sign-up rules are turning away, so we can fix a rule that is wrong or help someone who should have got in.

2. The lawful basis

We rely on your consent when we send you CBAM guidance you asked for, and on our legitimate interest in answering an enquiry you sent us and in running and securing the site. You can withdraw consent at any time: reply to any email we send you, or write to support@decarbonpro.com, and we stop.

We count visits on our legitimate interest in knowing which parts of the public site are used, and we collect nothing that identifies you for it. Microsoft Clarity runs on your consent, which you can withdraw at any time from “Cookie settings” at the bottom of any page on www.decarbonpro.com.

We rely on our legitimate interest in keeping a record of the sign-ups we refuse, so that we can tell a rule that is protecting the service from a rule that is turning away the people it was meant to serve. We keep the least that answers that question, and no longer than the periods set out below.

3. Where your data is stored

Your data is stored in Supabase, in its eu-west-1 region in Ireland. The site itself is served by Vercel. Access is limited to people who need it to run the service.

4. The services we use

Supabase:The database holding what you submit. Ireland (eu-west-1).
Vercel:Website hosting and delivery. Vercel records standard server logs, including IP address and timestamp, as part of running the infrastructure.
Resend:Sends our emails: confirmations, notifications and the newsletter.
Google Calendar:Arranges demo bookings. The booking form on our demo page is Google's own appointment page; Google processes the name and email address you enter there to create the invitation and its Google Meet link.
Vercel Analytics:Counts page views so we can see which parts of the site are used. It is part of the hosting, sets no cookie, and builds no profile of an individual.
Our own visit counts:We count visits to our public site, and to the app's pricing, policy and sign-up pages, ourselves: which page was opened, which free tool was used, whether the pricing page was seen, whether the sign-up form was opened, typed in, sent, refused (with the reason) or finished, and whether a contact or lead form was sent. Each count records the page's address without its query string, the website you came from (its domain only), any campaign tags in the link (utm_…), and a random number that identifies the browser tab and is forgotten when the tab closes. When you follow a link from our public site to the app's pricing or sign-up page in the same tab, that number travels in the link so the two pages count as one visit, and a sign-up you finish is counted in that same visit; the app takes it out of the address bar as soon as the page opens. It is never stored with an account or a form you send. It records no IP address, no browser details, no name or email, and sets no cookie. If your browser sends Do Not Track or Global Privacy Control, nothing is counted. The counts are stored with Supabase in Ireland. To stop abuse, the address your request came from is held in our rate-limit store for up to 60 seconds and then discarded; it is never saved with the counts.
Upstash:Runs our rate-limit store. To stop abuse of the contact, lead and sign-up forms and of our visit counts, it holds the address a request came from for a short window, at most one hour (up to 60 seconds for the visit counts), and then discards it. The calculator's 'email me the result' form is the exception: it holds your address and email for 24 hours, to stop repeated sends.
Microsoft Clarity:Only if you accept on the banner: Microsoft Clarity records how pages on the public site are used (clicks, scrolling, the pages opened) so we can see where the site is hard to use. Text you type is masked before it leaves your browser. It sets cookies, some of them on Microsoft's own domains (clarity.ms and bing.com); the cookie list at www.decarbonpro.com/cbam/cookies names each one. It never runs inside the signed-in app. You can change your choice at any time from “Cookie settings” at the bottom of any page on www.decarbonpro.com.
Payments:DeCarbonPro LLC invoices subscriptions itself. The payment goes to its account with the bank or payment service named on the invoice, together with the payer details sent with it. We do not see or store card details.

We do not sell or rent your personal data, and we do not share it for anyone else's marketing.

5. Transfers outside the UK and EEA

Our data is held in Ireland. Where one of the services above processes data outside the UK or EEA, it does so under the safeguards in UK and EU data protection law, including the standard contractual clauses. A payment you send us travels, with its payer details, to the account named on your invoice, wherever that account is held; that is part of making the payment.

6. How long we keep it

An enquiry and its correspondence: 24 months from your last contact with us. A marketing contact record: until you ask us to stop writing to you, or to delete it. Account data after a subscription is cancelled: 90 days, then deleted. A refused sign-up: the email address, the browser and the page are deleted after 90 days, and the count that remains is deleted after 12 months. A newsletter sign-up that is never confirmed: 30 days, then deleted. Our own visit counts: 13 months, then deleted. Microsoft Clarity recordings: the period Microsoft sets for the service.

7. Your rights

You can ask us to give you a copy of the personal data we hold about you, correct it, delete it, restrict or object to how we use it, or send it to you in a portable format. Write to support@decarbonpro.com and we will answer within one month.

If you think we have handled your data wrongly you can complain to the supervisory authority in your country — in the UK, the Information Commissioner’s Office; in the EU, the data protection authority of the member state you live in.

8. Cookies

Unless you accept Microsoft Clarity, the site uses only the cookies needed to serve and secure it. The page-view counting and our own visit counts named above set no cookie. Microsoft Clarity sets cookies only if you accept it on the banner. Some of those cookies are Microsoft's own, on its domains, and Microsoft says one of them (MUID) is also used for advertising. We set no advertising cookies ourselves. Every cookie is listed, with what it does and how long it lasts, on our cookie page at www.decarbonpro.com/cbam/cookies.

See the cookie list

9. Changes

We may update this policy. The date at the top of this page is the date of the most recent version.

Write to us at support@decarbonpro.com.