← Back to Home

Privacy Policy

Last updated: 6 January 2026

1. Who We Are

Embodied Carbon Index Ltd ("we", "us", "our") is a company registered in the United Kingdom. We operate the Embodied Carbon Index platform, a web-based application that provides building professionals with access to environmental product data for construction materials.

For any questions about this Privacy Policy or how we handle your data, please contact us at: legal@embodiedcarbonindex.com

2. What Data We Collect

We collect and process the following categories of personal data:

2.1 Information You Provide

  • Waitlist Registration: Email address when you register interest in our platform
  • Account Information: Name, email address, job role, and organisation name when you create an account
  • Profile Information: Any additional information you choose to add to your profile

2.2 Information Collected Automatically

  • Session Data: IP address, browser type, and device information for security and authentication purposes
  • Usage Data: How you interact with our platform to help us improve the service
  • Cookies: Essential cookies for authentication and session management (see our Cookie Policy for details)

3. How We Use Your Data

We use your personal data for the following purposes:

  • Waitlist Management: To notify you when beta access becomes available
  • Service Provision: To provide and maintain your account and access to the platform
  • Communication: To send you important updates about the service
  • Security: To protect against fraud and unauthorised access
  • Improvement: To understand how users interact with our platform and make improvements

4. Legal Basis for Processing

Under UK GDPR, we process your personal data on the following legal bases:

  • Consent: When you submit the waitlist registration form, you consent to us contacting you about beta access
  • Contract: Processing necessary to provide you with the service when you create an account
  • Legitimate Interests: For security, fraud prevention, and service improvement, where these interests do not override your rights

5. Who We Share Your Data With

We share your personal data with trusted service providers who help us operate the platform:

  • Convex: Our database provider, which stores your account and application data
  • Resend: Our email service provider, which sends transactional emails such as verification codes
  • Hosting Provider: Our web hosting infrastructure

These providers act as data processors on our behalf and are contractually bound to process your data only as we instruct and to maintain appropriate security measures.

We do not sell your personal data to third parties.

6. International Data Transfers

Some of our service providers are based in the United States. When your data is transferred outside the UK/EEA, we ensure appropriate safeguards are in place, including Standard Contractual Clauses approved by the UK Information Commissioner's Office.

7. Data Retention

We retain your personal data for as long as necessary to fulfil the purposes outlined in this policy:

  • Waitlist Data: Until you unsubscribe or we complete the beta registration process
  • Account Data: For the duration of your account, plus a reasonable period for backup and legal compliance
  • Session Data: Automatically deleted when sessions expire or you log out

8. Your Rights

Under UK GDPR, you have the following rights regarding your personal data:

  • Access: Request a copy of the personal data we hold about you
  • Rectification: Request correction of inaccurate or incomplete data
  • Erasure:Request deletion of your personal data ("right to be forgotten")
  • Restriction: Request that we limit how we use your data
  • Portability: Request your data in a machine-readable format
  • Objection: Object to processing based on legitimate interests
  • Withdraw Consent: Withdraw consent at any time where processing is based on consent

To exercise any of these rights, please contact us at legal@embodiedcarbonindex.com.

9. Complaints

If you are not satisfied with how we handle your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

10. Security

We implement appropriate technical and organisational measures to protect your personal data, including:

  • Encryption of data in transit (HTTPS)
  • Secure password hashing
  • Session management and automatic expiry
  • Access controls and authentication

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any significant changes by posting the new policy on this page and updating the "Last updated" date.

12. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us:

Embodied Carbon Index Ltd
Email: legal@embodiedcarbonindex.com

Terms of ServiceCookie PolicyHome