Privacy Policy

1. Who We Are

Coffset OÜ ("we", "us", "our") operates the platform at coffset.org. We provide AI-powered carbon footprint calculation and carbon credit offsetting services.

2. Data We Collect

• Account data: email address, full name, and hashed password when you create an account.
• Carbon calculations: lifestyle, travel, and activity data you provide during calculator conversations, stored linked to your account.
• Payment data: processed by Stripe. We store purchase amount, currency, and Stripe session ID only.
• Usage data: IP address, browser type, pages visited, and timestamps via server logs and analytics.
• Research data (with consent): when you accept analytics cookies, we store a coarse, pseudonymous snapshot alongside your calculation — approximate country (from your IP, not stored as a full address), browser language, timezone, device type, screen size, and referral/campaign source. It is linked to a random session identifier, never to your name or email, and is used only for aggregated research to improve the calculator and understand where our users come from.
• Communications: emails you send us and newsletter subscription status.

3. How We Use Your Data

• To operate and maintain your account and deliver core features.
• To process carbon offset purchases and issue retirement certificates.
• To send transactional emails (order confirmations, account creation).
• To send newsletters if you have explicitly subscribed.
• To improve the platform through aggregated, anonymized analytics.
• To measure whether our ads lead to visits and purchases (with consent).
• To comply with applicable laws and regulations.

4. Legal Bases for Processing (GDPR)

Under the GDPR, we process your personal data based on:

• Contract performance (Art. 6(1)(b)): account creation, carbon calculations, and offset purchases.
• Legitimate interests (Art. 6(1)(f)): website analytics and service improvement.
• Consent (Art. 6(1)(a)): newsletter subscriptions and non-essential cookies.
• Legal obligation (Art. 6(1)(c)): tax record-keeping for purchases.

5. Third-Party Services

• Supabase — database and authentication (EU region).
• Stripe — payment processing. Privacy Policy
• CNaught — carbon credit retirement.
• Vercel AI Gateway, Google and Anthropic — AI for the calculator chat and AI reports (US).
• Resend — email delivery, including the newsletter.
• Attio — customer relationship management (CRM): your name, email address, language, purchases, subscription and newsletter status, and a log of the emails we send you, so we can look after our customers.
• Google Analytics — analytics (with consent). Privacy Policy
• Google Ads — ad measurement (with consent). When you buy, also a hashed (SHA-256) copy of your email, so Google can match the purchase to an ad click without receiving the address (Enhanced Conversions). Privacy Policy
• Microsoft Clarity — usage analytics and session recordings (with consent). Privacy Statement
• Meta (Facebook / Instagram) — ad measurement (with consent). Privacy Policy
• Reddit — ad measurement (with consent). Privacy Policy
• Vercel — hosting and infrastructure.

6. International Data Transfers

Your data may be transferred outside the EEA. We ensure appropriate safeguards:

• Supabase: EU region (Frankfurt).
• Stripe: EU-US Data Privacy Framework certified.
• Vercel AI Gateway, Google and Anthropic: US processing under the EU-US Data Privacy Framework or Standard Contractual Clauses.
• Vercel: EU regions available; global CDN for performance.

7. Data Retention

• Account data: until you delete your account, then removed within 30 days.
• Carbon calculations: retained while your account is active.
• Purchase records: 7 years for tax compliance.
• Analytics data: aggregated/anonymized data may be retained indefinitely.

8. Your Rights

You have the right to:

• Access — request a copy of your personal data.
• Rectification — request correction of inaccurate data.
• Erasure — request deletion ("right to be forgotten").
• Restrict processing — limit how we use your data.
• Data portability — receive your data in a machine-readable format.
• Object — object to processing based on legitimate interests.
• Withdraw consent — withdraw any previously given consent.

To exercise these rights, email hello@coffset.org. We respond within 30 days.

9. Cookies

We use:

• Essential cookies: authentication and session management.
• Analytics cookies: Google Analytics (with consent).
• Advertising cookies: Google Ads, Meta and Reddit (with consent), to measure visits and purchases from our ads.

See our Cookie Policy for details.

10. Automated Decision-Making

Our carbon calculator uses AI to estimate emissions. This automated processing:

• Does not produce legally significant decisions about you.
• Is based on your explicit consent when using the calculator.
• Can be reviewed or contested by contacting us.

11. Security

We use industry-standard security measures including HTTPS encryption, bcrypt password hashing, HTTP-only session cookies, and Row Level Security on our database. We will notify you promptly in the event of a data breach.

12. Right to Lodge a Complaint

If you believe we have not handled your data properly, you can lodge a complaint with:

13. Changes to This Policy

We may update this policy from time to time. For significant changes, we will notify users by email.

14. Contact

For privacy-related questions: hello@coffset.org