Privacy policy
Last updated: 19 September 2026
This policy covers the DeCarbonPro CBAM software at app.decarbonpro.com. It explains what personal data we collect, why we collect it, and how we handle it.
1. Who controls your data
The data controller is DeCarbonPro LLC, 30 N Gould St Ste R, Sheridan, WY 82801, USA. For any question about your data, or to exercise any right in section 6, email support@decarbonpro.com.
2. What we collect, and why
Your account
Data collected: Name, work email address, job title, organisation name and country.
Why: To create and secure your account, and to contact you about the service.
Your subscription
Data collected: Subscription status, plan, renewal date, and the identifier the payment provider gives your subscription once there is one. We never see or store your card details.
Why: To give your organisation access to what it has paid for, and to handle renewals, cancellations and refunds.
Your team
Data collected: The email addresses you invite, and each member’s name and role once they join.
Why: To let colleagues work on the same installation record with the access you give them.
Installation and emissions data
Data collected: Data about your installation, its processes, fuels, materials, electricity, precursors and production. This is business data, and only incidentally personal — for example a contact name on a monitoring plan.
Why: To calculate embedded emissions and produce your reports. It is the substance of the service.
Support messages
Data collected: What you send us, and our replies.
Why: To answer you, and to keep a record of complaints and how they were resolved.
A booked call
Data collected: Your name, email address and the time you chose.
Why: To arrange and confirm the call.
A sign-up we turn away
Data collected: If we refuse a sign-up — because the address is a personal one rather than a work one, for example — we keep the email address you typed, the reason we refused it, the date, the browser you used and the page you came from. After 90 days we delete the email address, the browser and the page, and keep only a count: the reason, whether it was the form or the server that refused it, the date, the domain part of the address, and a scrambled code that tells us two attempts came from the same person — we cannot read an address back from it, though we could check a guess. We delete the whole record after 12 months.
Why: To see who our sign-up rules are turning away, so we can fix a rule that is wrong or help someone who should have got in.
3. Where your data is stored
Your data is stored in Supabase, in its eu-west-1 region in Ireland. The application itself is served by Vercel. Access is restricted to the people who need it to run the service. We do not sell, rent or share your personal data for marketing, and we do not use it to train machine-learning models.
4. Who else processes it
- Vercel:Runs the application and delivers it to your browser. Collects standard server logs, including IP address and timestamp.
- Supabase:Stores your account, installation and emissions data, in its eu-west-1 region in Ireland.
- Resend:Sends the emails the service produces — confirmations, invitations and the reports you ask for.
- Google Calendar:Arranges the calls you book in the app: a walkthrough call from the setup screens, or a support call from Contact Us. The booking form is Google's own appointment page, shown only when you choose to book; Google processes the name and email address you enter there to create the invitation and its Google Meet link.
- Vercel Analytics:Counts page views so we can see which parts of the product are used. It is part of the hosting, sets no cookie, and builds no profile of an individual.
- Our own visit counts:We count visits to our public site, and to the app's pricing, policy and sign-up pages, ourselves: which page was opened, which free tool was used, whether the pricing page was seen, whether the sign-up form was opened, typed in, sent, refused (with the reason) or finished, and whether a contact or lead form was sent. Each count records the page's address without its query string, the website you came from (its domain only), any campaign tags in the link (utm_…), and a random number that identifies the browser tab and is forgotten when the tab closes. When you follow a link from our public site to the app's pricing or sign-up page in the same tab, that number travels in the link so the two pages count as one visit, and a sign-up you finish is counted in that same visit; the app takes it out of the address bar as soon as the page opens. It is never stored with an account or a form you send. It records no IP address, no browser details, no name or email, and sets no cookie. If your browser sends Do Not Track or Global Privacy Control, nothing is counted. The counts are stored with Supabase in Ireland. To stop abuse, the address your request came from is held in our rate-limit store for up to 60 seconds and then discarded; it is never saved with the counts.
- Upstash:Runs our rate-limit store. To stop abuse of the contact, lead and sign-up forms and of our visit counts, it holds the address a request came from for a short window, at most one hour (up to 60 seconds for the visit counts), and then discards it. The calculator's 'email me the result' form is the exception: it holds your address and email for 24 hours, to stop repeated sends.
- Microsoft Clarity:Only if you accept on the banner: Microsoft Clarity records how pages on the public site are used (clicks, scrolling, the pages opened) so we can see where the site is hard to use. Text you type is masked before it leaves your browser. It sets cookies, some of them on Microsoft's own domains (clarity.ms and bing.com); the cookie list at www.decarbonpro.com/cbam/cookies names each one. It never runs inside the signed-in app. You can change your choice at any time from “Cookie settings” at the bottom of any page on www.decarbonpro.com.
- A merchant of record:When paid subscriptions open, a payment provider will sell the subscription as merchant of record and handle your payment, invoice and any refund, collecting your billing details directly — we never receive your card number. This row will name that provider before any payment is taken.
We use no advertising networks and no tracking pixels. Vercel Analytics and our own visit counts set no cookie and do not profile individuals. Microsoft Clarity runs only if you accept it.
5. Cookies
We use strictly necessary cookies — the session token that keeps you signed in. On the public site, Microsoft Clarity sets cookies only if you accept it on the banner; if you decline or do not choose, it does not load. Some of those cookies are Microsoft's own, on its domains, and Microsoft says one of them (MUID) is also used for advertising. We set no advertising cookies ourselves. Every cookie is listed, with what it does and how long it lasts, at www.decarbonpro.com/cbam/cookies.
6. Your rights
You have the right to:
- Access the personal data we hold about you
- Correct data that is wrong
- Ask us to delete your data
- Object to, or ask us to restrict, how we process it
- Receive your data in a portable format
Email support@decarbonpro.com to exercise any of these. We respond within one month. You can also export your installation and report data yourself, at any time, from inside the application.
7. How long we keep it
While your subscription is active, we keep your data so the service works. After cancellation we keep your account data for 90 days so you can return to it, then delete it. We keep the records of a transaction for as long as tax and accounting law requires, which is a legal obligation rather than a choice. Where we refused a sign-up, the email address, the browser and the page are deleted after 90 days, and the count that remains is deleted after 12 months. Our own visit counts are deleted after 13 months. Microsoft Clarity keeps recordings for the period Microsoft sets for the service.
8. Legal basis
We process your account, subscription and installation data to perform the contract you entered into with us. We process support messages, and keep transaction records, on the basis of our legitimate interest in running the service and our legal obligation to keep accounts. We keep a record of the sign-ups we refuse on the basis of our legitimate interest in telling a rule that protects the service from a rule that turns away the people it was meant to serve. We arrange a call you book on our legitimate interest in arranging the call you asked for. We count visits on our legitimate interest in knowing which parts of the public site are used, and we collect nothing that identifies you for it. Microsoft Clarity runs on your consent, which you can withdraw at any time from “Cookie settings” at the bottom of any page on www.decarbonpro.com.
9. Changes to this policy
We may update this policy. The date at the top of this page shows the most recent revision, and we will tell subscribers in advance of any change that materially affects them.
10. Contact
For any privacy question or request, contact support@decarbonpro.com.