Privacy Policy

1. Who we are

URLCarbon ("we", "us", "our") provides AI-generated product carbon footprint reports at urlcarbon.com. This policy explains what personal data we collect and how we handle it. For privacy questions, contact support@urlcarbon.com.

2. Data we collect

• Account data: email address, name, and authentication identifiers (including Google OAuth ID if you sign in with Google).
• Report data: product URLs you submit and the generated report contents.
• Billing data: subscription status, plan, and transaction history. Card details are handled directly by Stripe — we never see or store them.
• Usage data: pages visited, features used, and anonymised analytics events.
• Support data: messages you send via our contact form or email.

3. How we use your data

• To provide the service (generate reports, manage your account, process payments).
• To communicate about your account, billing, and product updates.
• To improve accuracy, performance, and security of the platform.
• To comply with legal obligations (tax, accounting, fraud prevention).

4. Legal basis (UK/EU users)

We process personal data under: (a) contract — to deliver the service you signed up for; (b) legitimate interests — to operate, secure, and improve the platform; (c) legal obligation — for tax and compliance; and (d) consent — where required (e.g. optional marketing).

5. Sub-processors

We share data with the following providers strictly to run URLCarbon:

• Supabase — database, authentication, storage.
• Stripe — payment processing and subscription billing.
• Google (Gemini API) — AI analysis of product pages.
• Cloudflare — hosting, edge compute, CDN.
• Resend — transactional and support email delivery.

6. Data retention

Account and report data is retained while your account is active and for up to 12 months after closure, unless a longer period is required by law (e.g. invoices kept for 6 years for tax). You can request deletion at any time.

7. Your rights

Depending on your location, you may have the right to access, correct, export, or delete your personal data, object to processing, or withdraw consent. Email support@urlcarbon.com and we'll respond within 30 days.

8. Cookies

We use strictly necessary cookies for authentication and session management, and privacy-friendly analytics to understand aggregate usage. We do not use advertising or tracking cookies.

9. Security

Data is encrypted in transit (TLS) and at rest. Access is restricted to authorised personnel and enforced via row-level security. No system is 100% secure — please use a strong, unique password.

10. International transfers

Our sub-processors may process data outside your country. Where required, transfers rely on Standard Contractual Clauses or equivalent safeguards.

11. Children

URLCarbon is not intended for anyone under 16 and we do not knowingly collect data from children.

12. Changes to this policy

We may update this policy from time to time. Material changes will be notified by email or in-app. Continued use of the service after changes take effect constitutes acceptance.

13. Contact

Questions or complaints? Email support@urlcarbon.com. UK/EU users may also lodge a complaint with their local data protection authority.