Privacy Policy
1. Introduction
AI Sustainable Future ("we," "our," or "us") runs aisustainablefuture.com. This Privacy Policy explains what we collect, how we use it, who processes it for us and how long we keep it when you use the site and its products: carbon reports from accounting data (Carbon Draft), VSME sustainability reports, CBAM data packs, the BRSR supplier profile and the free ESG Scorecard.
2. Information We Collect
2.1 Information You Provide
- Company Information: Company name, industry, size and country, and the reporting period and region where a product asks for them
- Contact Information: The email address you give at checkout, with a CBAM order or BRSR profile, or when you request a workspace sign-in link, and the name you give at checkout. On the free ESG Scorecard the email field is optional.
- Accounting and Bank Exports: Files you upload for a carbon report (CSV or Excel, including Tally and DATEV exports, or SIE and XAF ledger files). We read the cost rows from them; section 5 says what we keep.
- Activity Data: Quantities you enter, such as kWh of electricity, fuel volumes and refrigerant mass
- ESG Scorecard Answers: Environmental, social and governance metrics (for example energy use, workforce diversity, board composition and policies) and the optional climate-risk (TCFD) answers
- VSME Report Answers: Your answers to the VSME questionnaire, including workforce, pay and governance data
- CBAM Installation Data: Production routes, quantities, precursors and emissions, and the name and email address of the installation's contact person
- BRSR Supplier Profile: Your answers to the profile questions
- Messages: What you send through our contact, partner, auditor and waitlist forms
- Payment Information: Dodo Payments takes your payment (see section 6). We receive the payment's status, amount and the email address used; we never see your card details.
2.2 Automatically Collected Information
- Device and browser information, IP address and approximate location, and the pages you visit and actions you take on the site, collected by our analytics provider, PostHog
- Your IP address, read by our server to limit how often requests can be made; it is not stored with your submissions
- Browser storage and an analytics cookie, described in section 8
3. How We Use Your Information
- Prepare the reports and profiles you ask for from the data you submit
- Classify each spend row into an emission category with an AI model (Claude, by Anthropic), and keep a per-row record of how each row was classified so a classification can be checked
- Take payment and deliver what you bought
- Send you sign-in links, receipts, report-ready notices and, for VSME reports, up to three renewal reminders around the report's anniversary
- Reply to messages you send through our forms; if you join the CBAM founding list, write to you about its launch and founding terms; and if you join the BRSR list, write to you only about changes to the BRSR profile
- Count page views and on-site events to improve the site
- Comply with legal obligations
4. Data Security
How we protect your data:
- All traffic to the site and our server uses TLS encryption
- Our database provider, MongoDB Atlas, encrypts stored data at rest
- A paid report downloads only through a signed link that expires; knowing a report's ID is not enough
- Your workspace opens only through a sign-in link we email to your address. A sign-in lasts 30 days, and one address can hold at most 5 active sign-ins.
- Our review tools require an administrator key
- A free ESG Scorecard opens from its own link, which carries a random report ID, without sign-in: anyone you share that link with can open it
5. Data Retention
We keep the data you submit, and the reports we generate from it, until you ask us to delete them. This includes spend files you upload without buying a report: we keep the transaction rows we read from the file (date, supplier, account or category, description and amount, with the emission category and factor we applied), not the file itself. We keep them so you can download a report again and so its figures can be checked later. Download links in our emails work for 12 months; after that, your workspace lists fresh links. The per-row record of how our classifier handled your rows is deleted automatically after 90 days. Workspace sign-ins expire after 30 days. To have your data deleted, email hello@aisustainablefuture.com from the address you used. We delete it and confirm by email within one month of your request. We keep only a record of each payment (its id, amount, currency and date) to handle refunds, chargebacks and tax records; Dodo Payments keeps its own invoices as merchant of record.
6. Third-Party Services
We share data only with the service providers that run the product, each for one job:
- Dodo Payments: Our merchant of record for card payments. It takes your payment, issues your invoice and handles sales tax. We send it your email address, the name you give and the product; it collects your card details directly.
- Anthropic (USA): Classifies each spend row with its Claude model. It receives the row's account or category and supplier name (up to 120 characters each), its amount in US dollars and up to 60 characters of its description, never your company name or email address.
- MongoDB Atlas: Stores your submissions and reports
- Railway: Runs our application server
- Vercel: Hosts the website
- Brevo: Sends our emails (sign-in links, receipts, report-ready notices and renewal reminders)
- PostHog (USA): Counts page views and on-site events. Session recording is off.
We do not sell your data. Some of these providers process data in the United States.
7. Your Rights
Depending on your location, you may have the following rights:
- Access: Request a copy of your personal data
- Correction: Request correction of inaccurate data
- Deletion: Request deletion of your data
- Portability: Receive your data in a structured format
- Objection: Object to certain processing activities
Email hello@aisustainablefuture.com to use any of these rights. We respond within one month of your request.
8. Cookies and Browser Storage
We do not set our own cookies. We use your browser's local storage to keep you signed in to your workspace and to save unfinished VSME, CBAM and BRSR forms, including the email address you entered, on your device; you can clear it in your browser settings. Our analytics provider, PostHog, sets a cookie and a local storage entry to count page views and on-site events. Session recording is off.
9. Changes to This Policy
We may update this Privacy Policy periodically. We will notify you of significant changes by posting the new policy on this page with an updated "Last updated" date.
10. Contact Us
If you have questions about this Privacy Policy or wish to exercise your rights, please contact us: