Privacy Policy
How Carbon Giant collects, uses, and protects personal data.
This Privacy Policy explains how Carbon Giant Ltd, a company registered in England and Wales under company number 17243798 (“Carbon Giant”, “we”, “us”), handles personal data in connection with the Carbon Giant platform (the “Service”). It should be read together with our Terms of Service and, where we process personal data on your behalf, our Data Processing Agreement.
1. Our role: controller and processor
The Service handles personal data in two distinct capacities, and the law treats them differently.
- For the personal data of the individuals who register for and administer an account, including account, profile, and billing information, and for information about your authorised Users, Carbon Giant is the controller. This Privacy Policy describes that processing.
- For the personal data that may be contained inside the documents you upload, and in the line items and emission records derived from them, Carbon Giant acts as a processor on your behalf. Your organisation is the controller of that data. We process it only on your documented instructions, under the Data Processing Agreement, and not for our own purposes. Our obligations for that data are set out in the Data Processing Agreement rather than in this Privacy Policy.
2. Personal data we collect as controller
- Account and profile data. Name, work email address, organisation, role, and authentication details.
- Billing data. The information needed to administer your Subscription and process payments.
- Usage and device data. Log data, actions taken in the Service, IP address, and browser or device information, used to operate and secure the Service.
- Communications. Messages you send to support and related correspondence.
The content of the documents you upload is handled under the Data Processing Agreement and is addressed in section 5 below only to explain how the Service works.
3. How we use personal data
- To create and administer your account and provide the Service.
- To authenticate Users and secure the Service, including multi-factor authentication and fraud and abuse prevention.
- To communicate with you about the Service, including service, security, and billing messages.
- To provide support and respond to your requests.
- To improve, develop, and secure the Service.
- To meet our legal and regulatory obligations.
4. Legal bases for processing
The legal bases below apply to the personal data for which we are the controller, described in section 2. They do not apply to the content of uploaded documents: for that content we act as a processor on your documented instructions under Article 28 of the UK GDPR, not under a legal basis of our own.
| Purpose | Legal basis (UK GDPR Article 6) |
|---|---|
| Creating and administering your account and providing the Service | Performance of a contract |
| Billing and payment administration | Performance of a contract, and legal obligation for tax and accounting records |
| Authentication, security, and abuse prevention | Legitimate interests in keeping the Service and its data secure |
| Improving and developing the Service | Legitimate interests in operating and improving our Service |
| Service, security, and billing communications | Performance of a contract, and legitimate interests |
| Meeting legal and regulatory obligations | Legal obligation |
5. How the Service processes uploaded documents
When you upload an invoice or supporting document, the Service extracts the line items, classifies them into emission categories, and calculates greenhouse gas emissions. The invoices and financial transactions you upload represent procurement and spend data, which the Service maps to Scope 3 greenhouse gas accounting categories, such as Category 1 (Purchased Goods and Services). Two points are important for transparency.
- Customer review and confirmation. Classification suggestions are subject to your organisation's review and confirmation controls before emissions are calculated and published. Where an artificial intelligence model suggests a category, it does so in an assisted capacity only: the suggestion is presented to your reviewer, who confirms, overrides, or approves it, including through any bulk-approval controls the Service provides, and your organisation retains oversight of these classifications.
- Data minimisation before classification. Before any line item is sent to a third-party language model to assist with classification, we apply automated data minimisation controls designed to detect and strip personal identifiers, including individual names, financial account details, addresses, and non-essential free text, so that the model receives only the information needed to classify the item. Prompts sent for classification are not logged or retained by the model provider.
6. Sharing and sub-processors
We do not sell personal data. We share it only with service providers that help us operate the Service, each bound by contract to protect it and to process it only on our instructions. Our current sub-processors are:
| Provider | Purpose | Region |
|---|---|---|
| Amazon Web Services | File storage, document text extraction, and email delivery | United Kingdom (London) |
| Amazon Web Services (Bedrock) | Language model used to assist spend classification, which maps financial transaction and procurement data to Scope 3 GHG accounting categories (primarily Category 1 Purchased Goods and Services and Category 2 Capital Goods). Queries are processed transiently in the United States and are not persistently stored. | United States |
| Climatiq | Emission factor lookups | European Union |
| Apideck | Accounting software integrations you choose to connect | European Union |
| Sentry | Application error monitoring | EU (Germany) |
| Render | Application hosting and database | EU (Germany) |
We may also disclose personal data where required by law, to protect our rights or the safety of others, or in connection with a merger, acquisition, or sale of assets, subject to appropriate safeguards.
7. International transfers
Most processing takes place in the United Kingdom and the European Economic Area. Where a line item is sent to the language model for classification, that processing takes place in the United States. Such transfers are covered by the Standard Contractual Clauses and the United Kingdom International Data Transfer Addendum in our agreement with the provider, together with the data minimisation described in section 5, so that the data is protected to the standard required by UK data protection law.
8. How we protect personal data
- Access to the Service requires multi-factor authentication for all accounts.
- Personal data is encrypted in transit and at rest.
- Each organisation's data is logically separated, so one customer's data is not accessible to another customer.
- Access within Carbon Giant follows least-privilege principles, and administrative actions are logged.
- Data sent to the classification model is minimised as described in section 5, and is not retained by the model provider.
- We maintain backups and a documented recovery process so that the Service and its data can be restored after an incident.
9. How long we keep personal data
We keep account and billing data for as long as your account is active, and for a limited period afterwards to meet legal, tax, and accounting obligations.
Uploaded documents and the emission data derived from them are kept for a default period of up to 7 years, reflecting the retention normally expected for financial records, unless deletion is requested sooner. Where you or your organisation delete a document or close your account, or instruct deletion under the Data Processing Agreement, that instruction takes effect promptly and overrides the default retention period, except for the minimum data we are required by law to retain. Deletion is permanent and cascades across our file storage and database, and error monitoring data expires within 30 days.
10. Your rights
Where we are the controller, you have rights under UK data protection law, including the rights of access, rectification, erasure, restriction, objection, and data portability, and the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects. To exercise these rights, contact us using the details in section 13. Where the personal data is contained in uploaded documents, we act as a processor, and such requests should be directed to the controller, being your organisation, whom we will assist as set out in the Data Processing Agreement. You also have the right to complain to the Information Commissioner's Office at ico.org.uk.
11. Cookies
The Service uses cookies and similar technologies that are necessary to sign you in, keep your session secure, and remember your preferences. We do not use them to track you across other websites.
12. Changes to this policy
We may update this Privacy Policy from time to time. Where a change is material we will give you reasonable notice through the Service or by email. The effective date at the top of this document shows when it was last updated.
13. Contact
For any question about this Privacy Policy or about how we handle personal data, contact us at support@carbongiant.co.uk, or by post to Flat 5 Bavina House, 47 Leigham Court Road, London, England, SW16 2NF.