Privacy Policy

Data controller

carbonmeld.com
Email: [email protected]

What data we collect and why

Contact and document submission forms

When you fill in a form on the site (contact, document submission), we collect the data you enter: name, email, company, and message content.

Legal basis: pre-contractual measures at your request (Art. 6.1.b GDPR). We collect this data only because you provide it voluntarily to receive a response or a service.

Retention: form data is retained for 24 months from last contact, then deleted unless an active contractual relationship exists.

Traffic analytics

The site uses Google Analytics to collect anonymous usage data: pages visited, session duration, device, approximate geographic area, traffic source. We do not collect data that directly identifies a user.

Legal basis: legitimate interest of the controller in understanding and improving the service (Art. 6.1.f GDPR). You may object to this processing at any time — see "Your rights" below.

Form protection

The site uses hCaptcha to protect forms from automated abuse. hCaptcha may collect technical session data to distinguish human users from bots.

Legal basis: legitimate interest of the controller in service security (Art. 6.1.f GDPR).

Language preference

The site saves your language preference in browser localStorage keys (cm_lang, cm_lang_choice). This data stays on your device and is not transmitted to CarbonMeld.

Newsletter subscription

If you subscribe to the CarbonMeld newsletter, we collect your email address and language preference. This data is stored in Cloudflare KV (key-value storage infrastructure) and used exclusively to send you the newsletter and a one-time welcome email on first subscription.

Legal basis: your consent (Art. 6.1.a GDPR), freely given by submitting the subscription form.

Retention: until you request deletion. To unsubscribe, visit carbonmeld.com/unsubscribe/ or write to [email protected].

Right to withdraw consent: you may withdraw your consent at any time with the same ease as giving it. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Cookies and similar technologies

CarbonMeld uses:

• Google Analytics analytics cookies (for the purposes described above)
• hCaptcha (technical cookies for form protection)
• localStorage (cm_lang, cm_lang_choice) for language preference; cm_acct (only after you sign in to Premium) to show the Account link in the header — it contains no personal data

CarbonMeld does not use its own advertising cookies and does not carry out profiling.

CarbonMeld Premium (paid access)

Authentication cookie (cm_premium)

When you log in to Premium, the site sets a strictly functional authentication cookie (cm_premium), valid for 30 days and flagged HttpOnly. It is used exclusively to keep your session active and is not used for tracking or advertising.

Account data

A Premium account consists solely of your email address, used to send login links and service emails via Resend (resend.com).

Legal basis: performance of contract (Art. 6.1.b GDPR).

Payment processors

Card payments are handled by Stripe (stripe.com); cryptocurrency payments by NOWPayments (nowpayments.io). Each acts as an independent data controller or processor for payment data. Card details never touch CarbonMeld servers.

Access records

To manage access, CarbonMeld stores access records (email, pass status, expiry, projects unlocked for you) in Cloudflare D1. To apply the fair-use limit of the pass, it also records which projects you open each day; these rows are deleted after 3 days. If you use My portfolio, the projects you save are stored with your email until you remove them, and we email you alerts when they change.

Pass access log and payment disputes

CarbonMeld also keeps a log of the premium projects you open through a pass (email, day, project, time of first and last access, number of requests), for 540 days. It is used only if a card payment for your pass is disputed with your bank (chargeback): the log of your own account, the terms accepted at checkout and the purchase details are then sent to Stripe as evidence. Projects you unlock as a project owner are not logged. Legal basis: legitimate interest in defending against payment disputes (Art. 6.1.f GDPR).

Your account page

On carbonmeld.com/account/ you can see your pass, your payments and the use of your API key, sign out of every device, unsubscribe from the newsletter, download a copy of your data (a JSON file of selected account records, up to 50,000 entries per category, excluding API keys and their hashes) and delete your account. API keys are stored only as a hash, with the time they were last used; the daily request counter of a key is deleted after 3 days.

For records not included in the file, contact us as described under Your rights below.

Deleting your account removes at once: the pass (remaining days are forfeited), API keys, saved projects and their pending alerts, score alerts and pending confirmations sent to your address, complimentary project unlocks, the daily usage rows, the PDF download log and the newsletter subscription. Kept for legal reasons: payment records (10 years, tax obligations), the pass access log (540 days, payment disputes only), card payment disputes and rating disputes you sent, a technical sign-in counter for your address (it keeps old sign-in cookies invalid) and a do-not-send marker for the newsletter.

Transactional emails

Pass holders receive a reminder email 3 days before their pass expires. These are transactional emails required for the service, not marketing.

Recipients of data

Personal data may be shared with:

• Google LLC (Google Analytics) — traffic analysis
• Cloudflare Inc. (KV storage) — newsletter subscriber storage
• hCaptcha (hcaptcha.com) — form protection
• Resend Inc. (resend.com) — transactional and newsletter email delivery
• Stripe Inc. (stripe.com) — card payment processing and, only in a payment dispute, the evidence described above
• NOWPayments (NOWPayments OU) — payment processing

These parties act as data processors or independent controllers, each under their own privacy policy.

CarbonMeld does not sell, transfer, or share personal data with third parties for marketing purposes.

Transfers outside the EU

Google Analytics, Cloudflare, and Resend may transfer data to the United States. These transfers are made on the basis of the EU-US Data Privacy Framework (for certified entities) and/or Standard Contractual Clauses approved by the European Commission.

NOWPayments (registered in Estonia) processes payment data within the EU.

Retention periods

Your rights

Under the GDPR, you have the right to:

• Access: obtain confirmation that processing exists and a copy of your data
• Rectification: correct inaccurate or incomplete data
• Erasure: request deletion of your data, within legal limits
• Restriction: request restriction of processing in certain cases
• Portability: receive your data in a structured, machine-readable format
• Objection: object to processing based on legitimate interest, including traffic analytics
• Withdrawal of consent: where processing is based on consent (newsletter subscription), withdraw it at any time by unsubscribing

To exercise these rights, write to [email protected]. We will respond within 30 days.

Right to lodge a complaint

If you believe that the processing of your data violates the GDPR, you may lodge a complaint with your national supervisory authority. If you are in the EU, you may also contact the supervisory authority in your country of residence. A list of EU supervisory authorities is available at edpb.europa.eu.

Changes to this policy

Any changes will be published on this page with the update date. In the event of material changes, we will update the date prominently.