Privacy Policy

    Last updated: May 2026

    1. Introduction

    Carbontribe Labs OÜ ("Carbontribe," "we," "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform and services, including the CBT Engine — our carbon and water credit calculation and verification platform.

    2. Information We Collect

    We collect the following types of information:

    • Account Information: Name and email address when you register or are invited to the platform.
    • Project Data: Environmental project submissions including methodology parameters, boundary files (KML), proof documents, and NFT metadata that you upload to the CBT Engine.
    • Usage & Activity Data: Actions taken on the platform (project creation, approvals, asset minting/retirement) recorded in our audit log.
    • Device & Connection Data: IP address and browser information collected for security purposes.
    • Authentication Data: Password (hashed, never stored in plain text), two-factor authentication secrets, and session tokens.

    3. How We Use Your Information

    • To provide the CBT Engine platform: project management, credit calculation, verification, and NFT issuance.
    • To validate project data quality using AI-assisted review.
    • To generate sustainability reports (GRI, CDP) at asset retirement.
    • To send transactional notifications (project status updates, approvals, minting).
    • To detect and prevent fraud, security incidents, and abuse.
    • To comply with legal obligations and enforce our terms.

    4. Third-Party Data Processors

    We do not sell your personal information. To operate the platform, we share data with the following sub-processors:

    • OpenAI / Anthropic — Project submission data (names, descriptions, methodology parameters, and supporting metadata) is sent to large language model APIs to perform automated data quality checks and generate sustainability reports. No personally identifiable information beyond project metadata is included. Governed by OpenAI's and Anthropic's data processing agreements.
    • Pinata (IPFS) — Approved NFT images and asset metadata are published to the public InterPlanetary File System (IPFS) via Pinata. IPFS content is content-addressed and immutable — once published, it cannot be removed from the network. We disclose this before publishing any asset.
    • Google Cloud Storage (GCS) — Proof documents and boundary files you upload are stored in private GCS buckets accessible only to you and authorised Carbontribe staff. Files are served via short-lived signed URLs (5-minute expiry).
    • Google Custom Search API — During data validation, organisation names, project names, and location fields may be sent to Google's search API to verify publicly available information. No personal contact details are used in search queries.
    • Google Earth Engine — For forest and mangrove projects, boundary data (GeoJSON polygon) is sent to Google Earth Engine to compute satellite-derived planted area. No personal data is transmitted.
    • SMTP / Email provider — Transactional emails (invitations, password resets, project notifications) are sent via SMTP. Your email address is transmitted to the mail relay to deliver these messages.

    5. Cookies and Session Data

    The CBT Engine sets one strictly necessary session cookie: cbt_session. This cookie stores your authenticated session token and is required for the platform to function. It expires after 7 days. No tracking or analytics cookies are used. No consent banner is required for strictly necessary cookies under ePrivacy rules.

    6. Data Security

    Passwords are hashed with Argon2id. All data in transit is protected by TLS. Proof documents are stored in private cloud storage with access-controlled signed URLs. Two-factor authentication (TOTP) is mandatory for all platform users. Internal service-to-service calls require shared authentication tokens.

    7. Data Retention

    We retain your account data for as long as your account is active. Activity logs (audit events) are automatically deleted after 2 years. Project records and issued carbon/water credit assets are retained indefinitely as they form part of the permanent environmental accounting record. Upon account deletion, your personal identifiers (name, email) are removed; project records are anonymised and retained for audit continuity. NFT metadata published to IPFS cannot be deleted due to the immutable nature of that network.

    8. Your Rights (GDPR)

    Under the General Data Protection Regulation, you have the right to:

    • Access — download a copy of your personal data via Settings → Account → Download my data in the CBT Engine.
    • Erasure — delete your account via Settings → Account → Delete account. Project records are anonymised, not deleted, to preserve credit integrity.
    • Correction — contact us to correct inaccurate personal data.
    • Restriction / Objection — contact us to restrict or object to specific processing activities.
    • Portability — your data export (above) is provided as structured JSON.
    • Withdraw consent — where processing is consent-based, you may withdraw at any time without affecting prior lawful processing.

    To exercise any right or submit a Subject Access Request, email help@carbontribe.me.

    9. Your Rights (個人情報保護法 / APPI)

    Carbontribe complies with Japan's Act on the Protection of Personal Information (個人情報の保護に関する法律, "APPI"). If you are located in Japan, you have the following rights with respect to your retained personal data (保有個人データ):

    • Disclosure (開示請求, Article 33) — request a copy of the personal data we hold about you. Use Settings → Account → Download my data in the CBT Engine, or contact us by email.
    • Correction / Addition / Deletion (訂正・追加・削除請求, Article 34) — request correction of inaccurate personal data or deletion of data that is no longer necessary for its stated purpose.
    • Cessation of Use / Erasure (利用停止・消去請求, Article 35) — request that we stop using or erase your personal data where it has been handled in violation of APPI. Use Settings → Account → Delete account in the CBT Engine to exercise this right directly, or contact us by email.
    • Cessation of Third-Party Provision (第三者提供停止請求, Article 35) — request that we stop providing your personal data to third parties.

    To exercise any of the above rights or to submit a data request under APPI, email help@carbontribe.me. We will respond within a reasonable period (generally within 14 days).

    10. International Transfers

    Your data may be transferred to and processed in countries outside the European Economic Area and Japan, including the United States (OpenAI, Anthropic, Google, Pinata). We rely on Standard Contractual Clauses (SCCs) approved by the European Commission for GDPR-covered transfers.

    For users in Japan: pursuant to APPI Article 24, we disclose that personal data is processed by the sub-processors listed in Section 4, operating in the United States and the European Economic Area. These sub-processors operate under data processing agreements that include equivalent protective measures (SCCs or equivalent frameworks). The EU has issued a mutual adequacy decision with Japan; EEA-based transfers are therefore treated as equivalent to domestic transfers under APPI.

    11. Changes to This Policy

    We may update this Privacy Policy periodically. We will notify you of material changes by posting the updated policy on our website and updating the "Last updated" date above.

    12. Contact Us

    For privacy-related inquiries, data requests, or to exercise your rights under GDPR or 個人情報保護法 (APPI), contact us at help@carbontribe.me.