Privacy Policy

1.1 Account Information

When you create an account, we collect:

• Email address
• Name and company name
• Role/title (optional)
• Password (encrypted)

1.2 Document Data

When you use our platform, we process:

• Uploaded documents (invoices, certificates, reports)
• Email content forwarded to our ingestion address
• Extracted data from OCR processing
• Emissions calculations and methodology decisions

1.3 Usage Information

We automatically collect:

• Device and browser information
• IP address and approximate location
• Pages visited and features used
• Time spent on the platform

We use your information to:

• Provide Services: Process documents, calculate emissions, generate reports
• Improve Platform: Analyze usage patterns to enhance features
• Communication: Send service updates, security alerts, and marketing (with consent)
• Compliance: Meet legal obligations and respond to lawful requests
• Security: Detect and prevent fraud, abuse, and security incidents

We do not sell your personal information. We may share data with:

• Service Providers: Cloud hosting (Azure), email services (Resend), analytics (Google Analytics)
• Authorized Parties: Auditors you explicitly grant access to
• Legal Requirements: When required by law or to protect our rights
• Business Transfers: In connection with mergers or acquisitions

We implement industry-standard security measures:

• AES-256 encryption for data at rest
• TLS 1.3 for data in transit
• SOC 2 Type II certified infrastructure
• Regular security audits and penetration testing
• Role-based access controls (RBAC)
• Immutable audit logs for all data access

We retain your data as follows:

• Account Data: Until you delete your account, plus 30 days for recovery
• Document Data: As long as your account is active, or as required for audit trails
• Audit Logs: 7 years minimum (regulatory requirement)
• Anonymized Analytics: Indefinitely

Depending on your jurisdiction, you may have the right to:

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate information
• Deletion: Request deletion of your data (subject to legal retention requirements)
• Portability: Export your data in a machine-readable format
• Objection: Object to certain processing activities
• Restriction: Limit how we use your data

To exercise these rights, contact us at privacy@emission3.com.

Your data may be processed in the United States and European Union. We ensure appropriate safeguards through:

• Standard Contractual Clauses (SCCs) for EU data
• Data Processing Agreements with all sub-processors
• Compliance with GDPR and CCPA requirements

Our services are not intended for individuals under 18 years of age. We do not knowingly collect personal information from children.

We may update this Privacy Policy periodically. We will notify you of material changes via email or platform notification at least 30 days before they take effect.

For privacy-related inquiries:

• Email: privacy@emission3.com
• Mail: Emission³ Inc., Dubai, UAE
• DPO: dpo@emission3.com