Privacy Policy

IQCO₂ ("we", "us", "our") provides carbon accounting and SECR compliance reporting software to UK organisations. This policy explains what personal data we collect through the IQCO₂ platform (the "Service"), why we collect it, and the rights you have over it.

Data controller: [Registered company name], company number [Companies House number], registered address [registered address].

We collect the following categories of data:

• Account data — name, email address, and password (stored as a bcrypt hash, never in plain text) when you register.
• Organisation data — the organisation(s) you create or are invited to, and your role within them (owner, admin, member, or viewer).
• Activity data — the emissions-related data you or your organisation enter into the Service (e.g. electricity usage, fuel consumption, business travel, waste), which forms the basis of your carbon accounting reports. This data belongs to your organisation, not to us — see Section 8.
• Usage data — pages visited, features used, and general interaction data, collected via PostHog (see Section 5).
• Technical data — IP address, browser type, and device information, collected automatically for security and service-reliability purposes.

We use the data described above to:

• Provide and operate the Service, including running emissions calculations against DEFRA factor sets.
• Authenticate you and maintain your session securely.
• Send transactional emails (e.g. email verification, password reset, team invitations).
• Provide customer support and respond to enquiries.
• Understand how the Service is used, so we can improve it.
• Meet our own legal and regulatory obligations.

We do not sell your personal data, and we do not use your organisation's activity data to train any AI model.

Depending on the data in question, we rely on:

• Contract — processing account, organisation, and activity data is necessary to provide the Service you've signed up for.
• Legitimate interests — for security monitoring, fraud prevention, and product-usage analytics, balanced against your right to privacy.
• Legal obligation — where we're required to retain or disclose data by law.

We share data with the following categories of third party, only to the extent necessary to provide the Service:

• Hosting infrastructure — [hosting provider name], for application hosting and database storage.
• PostHog — for product analytics (page views, feature usage). PostHog is configured with our EU data region.
• OpenAI — where AI-assisted features are used (e.g. natural-language data entry assistance), relevant inputs are sent to OpenAI's API for processing. We do not send full organisation activity datasets to OpenAI without your action triggering it.
• Email delivery — [transactional email provider name], to send verification, password reset, and invitation emails.

We do not share your data with any third party for their own marketing purposes.

We retain account and organisation data for as long as your account is active. Calculation records are retained indefinitely once created, as they form an immutable audit trail required for SECR compliance reporting — this is a deliberate design choice, not an oversight (see our approach to auditability).

If you close your account, we will delete or anonymise your personal account data within [retention period, e.g. 30 days], except where we are required to retain it for legal or regulatory reasons.

Under UK GDPR, you have the right to:

• Access the personal data we hold about you.
• Ask us to correct inaccurate data.
• Ask us to erase your data, subject to our retention obligations above.
• Ask us to restrict or object to certain processing.
• Receive your data in a portable format.
• Complain to the Information Commissioner's Office (ICO) if you believe we've mishandled your data.

To exercise any of these rights, contact us at [privacy contact email].

Your organisation owns the activity data it enters into the Service. We process it on your organisation's behalf to provide the Service — we do not claim ownership of it, and it is not used for any purpose beyond delivering IQCO₂ to you.

We use:

• Strictly necessary cookies — an httpOnly session cookie used to keep you signed in. The Service cannot function without this.
• Analytics cookies (PostHog) — used only with your consent where required by law.

We use industry-standard measures to protect your data, including encrypted connections (TLS), hashed passwords, and role-based access controls enforced at the organisation-membership level. No system is completely secure, and we cannot guarantee absolute security of data transmitted to the Service.

Where any of the third parties listed in Section 5 process data outside the UK, we ensure appropriate safeguards are in place (such as Standard Contractual Clauses) as required by UK GDPR.

We may update this policy from time to time. If we make material changes, we will notify account holders by email or via the Service before the changes take effect.

Questions about this policy or your data can be sent to [privacy contact email].