Privacy policy

Who is the controller

CBAMWorks is operated by LowerPlane Technologies Private Limited (the "controller"). The controller is responsible for the processing described in this policy. For any question or request, email [email protected].

What personal data we process

• Account data. Name, work email, workspace role, password hash, authentication timestamps.
• Supplier contact data. Supplier name, phone number (used for WhatsApp invites), email, country, language preference.
• Operational data. Fuel bills, electricity bills, production records, monitoring plan references and the figures extracted from them.
• Uploaded documents. Photos and scans of bills and production records uploaded by suppliers.
• Billing data. Company name, VAT ID, billing address, invoice history. Payment details are held by Stripe (not by us).
• Website analytics. Aggregate, cookieless page analytics via Plausible. No individual tracking.
• Communication data. Email, WhatsApp and support messages exchanged with us.

Legal bases for processing

• Contract performance (Art. 6(1)(b) GDPR). Running the account, calculating emissions, generating exports, invoicing.
• Legitimate interest (Art. 6(1)(f)). Product improvement, security monitoring, fraud prevention, aggregate analytics, abuse response.
• Consent (Art. 6(1)(a)). WhatsApp communication to supplier contacts, optional marketing emails, optional AI-assisted bill extraction.
• Legal obligation (Art. 6(1)(c)). Tax records, VAT invoices, compliance-related record retention.

Who we share data with

We share personal data only with the sub-processors listed on our sub-processors page, with EU buyers you explicitly share with (for suppliers), and with authorities where required by law. We do not sell personal data. We do not share supplier operational data with EU buyers who have not been explicitly granted access by the supplier.

International transfers

Primary processing happens inside the EU (AWS eu-central-1). Some sub-processors operate in the EU, US and India. Where transfers outside the EEA happen, we rely on the EU Standard Contractual Clauses (SCCs) and, where applicable, additional safeguards. The transfer mechanism per sub-processor is listed on this page.

Retention

• Account data. Retained while the account is active and for 90 days after closure, then deleted or anonymised.
• Operational and emissions data. Retained for the longer of (a) 7 years from the reporting year it relates to, to meet audit expectations for CBAM, or (b) the duration of the customer agreement. Specific retention can be contracted via the DPA.
• Billing data. Retained for 10 years to meet tax requirements.
• Backups. Automatic backups are retained for 14 days.

Your rights

Under GDPR you have the rights of access, rectification, erasure, portability, restriction and objection. You can also lodge a complaint with your supervisory authority. Indian residents have equivalent rights under the Digital Personal Data Protection Act (DPDP). Email [email protected] to exercise any of these — we respond within 30 days.

Automated decisions

CBAMWorks uses AI (OpenAI) to extract numbers from uploaded bills. These extractions are always confirmed by a human (the supplier) before they count toward any emissions calculation. No automated decision is made that has a legal or similarly significant effect on an individual.

Children

CBAMWorks is a B2B service and is not directed at children under 16. We do not knowingly collect data from children.

Security

See our security page for the technical and organisational measures in place.

Changes to this policy

We update this policy when our processing changes. Material changes are notified by email to account administrators at least 30 days before they take effect. The "Last updated" date at the top of the page always reflects the latest change.