Privacy Policy
Last updated: September 24, 2026
The 30-second version
Your calculation data is stored in the EU. If you choose live chat, Crisp also processes your message and technical connection data. We do not sell your data or use advertising trackers.
1. Who we are
CarbonTrace is operated by Simplinity, based in Belgium. We provide carbon footprint calculation and reporting services for IT assets. For privacy-related inquiries, contact us at privacy@carbontrace.cloud.
2. What data we collect
We collect data you provide directly: account information (name, email, password), organisation details, and IT asset data submitted for carbon footprint calculations. When you create an account from a campaign link, we also keep its source, medium, campaign name and a coarse public landing path with the organisation. This account attribution does not include a visitor ID, referrer, raw URL, query string or browser data. We also collect technical data automatically: IP address, browser type, and usage analytics to improve our service. We do not collect sensitive personal data, biometric data, or data about minors.
3. How we use your data
We use your data to: provide and improve our carbon footprint calculation service, generate certificates and reports, manage your account and billing, send transactional emails (account confirmations, invoices), and comply with legal obligations. We do not sell your data to third parties. We do not use your data for advertising.
4. Legal basis (GDPR)
We process your data under the following legal bases: contract performance (providing the service you signed up for), legitimate interest (improving our service, preventing fraud), legal obligation (tax and accounting requirements), and consent (marketing communications, which you can withdraw at any time).
5. Data residency & transfers
Your account and calculation data is stored on Supabase infrastructure in the EU. If you choose live chat, Crisp stores messages in the EEA; technical connection logs may be processed through relay servers outside the EEA. Other providers may process data internationally under applicable transfer safeguards. Payments are processed by the Dutch provider Mollie B.V.
6. Data retention
Account data is retained while your account is active and normally for 30 days after deletion. Calculation data and certificates are retained for the duration of your subscription. Issued invoices, credit notes and related tax evidence are retained for seven full years from 1 January following issue, as required for Belgian VAT records. You can request earlier deletion of non-mandatory data at any time. We aim to remove Crisp live-chat conversations within 30 days after the last message, unless a legal obligation requires longer retention. We review the inbox weekly and manually remove conversations once the last message is at least 23 days old. Crisp does not guarantee a minimum history period on Free, so a conversation may become unavailable sooner. You can request earlier deletion of chat data we are not required to keep at privacy@carbontrace.cloud.
7. Your rights
Under GDPR, you have the right to: access your personal data, rectify inaccurate data, erase your data (‘right to be forgotten’), restrict processing, data portability (export in machine-readable format), object to processing, and withdraw consent. To exercise any of these rights, contact privacy@carbontrace.cloud. We will respond within 30 days.
8. Cookies
We use essential cookies for authentication and session management. We use analytics cookies (privacy-friendly, no cross-site tracking) to understand how people use our service. We do not use advertising cookies or trackers. You can disable non-essential cookies in your browser settings. Crisp chat loads only when you actively choose live chat. Crisp then uses functional crisp-client/* cookies to restore your chat session. They expire after six months by default and may be renewed when you return.
8a. Anonymous sector benchmarks
CarbonTrace offers a sector benchmark feature that shows how your carbon footprint compares against other organisations in the same sector. These comparisons are computed from aggregated, anonymised data: every bucket contains at least 5 contributing organisations before any statistic is shown (k-anonymity, k≥5). We never display individual organisation names or data. Your organisation's data contributes to these aggregates by default, on the basis of our legitimate interest in improving the service and helping organisations benchmark responsibly; you can opt out at any time in Settings → Privacy & Data, in which case your contributions are removed on the next nightly refresh. The aggregates themselves — percentiles, sample sizes, and medians — are available to all opted-in organisations via /reports/benchmark.
9. Sub-processors
We use Supabase (database and authentication), Vercel (hosting), Mollie (payments), Resend (transactional email), Mailchimp (marketing email in line with your consent), and Crisp (live chat when you choose it). Further information on processing and your rights is available in our DPA at carbontrace.cloud/dpa.
10. Security
We protect your data with: encryption in transit (TLS 1.3) and at rest (AES-256), row-level security on all database tables, hash-chained audit logging, regular security reviews, and strict access controls. If we discover a data breach affecting your personal data, we will notify you and the relevant supervisory authority within 72 hours.
11. Changes to this policy
We may update this privacy policy from time to time. We will notify you of material changes via email or an in-app announcement. The latest version is always available at this URL.
12. Contact & complaints
For privacy questions or to exercise your rights: privacy@carbontrace.cloud. If you believe we have not adequately addressed your concern, you may lodge a complaint with the Belgian Data Protection Authority or your local supervisory authority.
Questions about your data? Contact us