Privacy Policy

2.1 Who We Are

GreenTrack AI Ltd is a company registered in Scotland, United Kingdom. We operate the GreenTrack AI platform — a SaaS tool that helps UK SMEs calculate and report carbon emissions from utility bills.

2.2 Data We Collect

Account & Profile Data

• Email address, full name, organisation details (name, logo), user roles (Owner, Admin, Member)

Financial & Billing Data

• Stripe Customer ID and subscription status (we do not store raw credit card details — all payments are handled securely by Stripe)

Environmental & Utility Data (Core Data)

• Uploaded utility bills (PDFs/images) stored in Supabase Storage
• Extracted data via Mindee OCR: supplier names, account numbers, bill dates, usage (kWh, litres, etc.), costs
• Calculated carbon emissions (kg CO₂e) using official DEFRA factors

Technical & Analytics Data

• IP addresses (for rate limiting via Upstash), device/browser information via Vercel Analytics, authentication tokens via Supabase

2.3 Third-Party Data Processors

We use the following trusted processors. All are GDPR-compliant and, where possible, use UK/EU data centres:

We have Data Processing Agreements (DPAs) in place with all processors. Mindee and Supabase are our primary processors for sensitive utility bill data.

2.4 How We Use Your Data

• To provide and improve the Service (OCR processing, carbon calculations, dashboards, reports)
• To manage your account, subscriptions, and team access
• To send important service emails (invitations, billing, security alerts)
• To comply with legal obligations and prevent fraud

2.5 Data Retention

We retain your data for as long as your account is active or as needed to provide the Service. Upon cancellation:

• Uploaded bills and extracted data: Deleted or anonymised within 30 days of account closure (unless required for legal/tax reasons)
• Billing records: Retained for 7 years in line with UK tax law

2.6 Your Rights (UK GDPR)

You have the right to access, rectify, erase, restrict processing, data portability, and object to processing. To exercise these rights, email suhail@greentrackai.com. We will respond within one month.

2.7 Security

We use industry-standard security measures including Row Level Security (RLS) in Supabase, edge middleware authentication, encrypted connections (TLS), and regular security reviews. Uploaded bills are processed securely via Mindee and stored in UK/EU data centres.

2.8 International Transfers

Most data is stored and processed in the UK/EU. Where data is transferred outside the UK/EU (e.g. to Stripe or certain analytics providers), we ensure appropriate safeguards such as Standard Contractual Clauses or UK Addendums are in place.

2.9 Contact & Complaints

For any privacy questions or complaints, contact: suhail@greentrackai.com. You also have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO) at ico.org.uk.