Privacy Policy

1. Who we are

CarbonLens ("CarbonLens", "we", "us") provides a software platform that helps Indian companies track carbon emissions and prepare BRSR (Business Responsibility and Sustainability Reporting) and related ESG disclosures. This policy explains what data we collect through carbonlenss.com and the CarbonLens application, how we use it, and the choices you have.

2. Data we collect

• Account data: name, email address, and organisation details you provide when you register or are invited to an organisation.
• Business data you enter: emissions, energy, water, wages, governance, and other BRSR-related figures your organisation inputs to generate reports. This data belongs to your organisation.
• Usage data: pages visited and general interaction data, collected via analytics tools described in Section 4.
• Support communications: anything you send us by email (e.g. sales@carbonlenss.com).

3. How we use data

We use the data above to:

• Operate your account and the reporting features you use;
• Generate the BRSR and emissions reports your organisation requests;
• Respond to support requests;
• Understand aggregate product usage so we can improve the platform; and
• Meet legal and security obligations (e.g. maintaining an audit trail of data changes for compliance purposes).

We do not sell your data.

4. Analytics and cookies

We use the following third-party tools on our public website and application:

• Google Analytics 4 — uses cookies to measure site usage. Loaded only after you accept analytics cookies in the banner shown on your first visit; declining prevents these cookies from being set.
• Cloudflare Web Analytics and Vercel Analytics / Speed Insights — cookieless, privacy-preserving usage and performance measurement that does not track you individually across sites.

You can change your analytics cookie choice at any time by clearing your browser's local storage for this site, which will show the consent banner again on your next visit.

5. Where data is stored

The CarbonLens application is hosted on Vercel, and application data is stored in a managed PostgreSQL database provided by Supabase. Both are reputable infrastructure providers used by many SaaS companies; neither has access to your data beyond providing hosting infrastructure.

6. Your rights under the DPDP Act, 2023

If you are located in India, the Digital Personal Data Protection Act, 2023 (DPDP Act) gives you rights over your personal data, including the right to access the personal data we hold about you, request correction or erasure of your personal data, withdraw consent where processing is based on consent, and raise a grievance with us. To exercise any of these rights, contact us at sales@carbonlenss.com.

7. Data retention

We retain account and business data for as long as your organisation's account is active, and for a reasonable period afterward to comply with audit-trail and record-keeping needs. You can request deletion of your account data by contacting us, subject to any legal retention obligations that apply to regulatory/compliance records.

8. Security

We apply industry-standard practices such as encrypted connections (HTTPS), access controls, and audit logging of data changes within the application. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

9. Changes to this policy

We may update this policy from time to time. We will update the "Last updated" date above when we do.

10. Contact us

Questions about this policy or your data can be sent to sales@carbonlenss.com.