Privacy Policy

CarbonCore AI Limited ("CarbonCoreAI") is the Data Controller for all personal and organisational data processed through the CarbonCoreAI platform. We are incorporated in Dublin, Ireland and operate under GDPR and the Irish Data Protection Act 2018.

Data Controller Contact: info@carboncoreai.tech | Landscape House, Baldonnell, Dublin, D22 P3K7, Ireland

• Contract performance (Art. 6(1)(b)) — processing necessary to deliver subscribed services
• Legitimate interests (Art. 6(1)(f)) — security, fraud prevention, and anonymised service improvement
• Legal obligation (Art. 6(1)(c)) — compliance with Irish, EU, and applicable international law
• Consent (Art. 6(1)(a)) — for optional marketing communications, withdrawable at any time

Where data is transferred outside the EEA, appropriate safeguards are in place including Standard Contractual Clauses (SCCs), EU adequacy decisions, and contractual safeguards with partners.

Users in Nigeria, Kenya, UAE, Saudi Arabia, and other regions should note that data is processed primarily on EU infrastructure. We respect applicable local data protection laws in all markets we serve.

We retain your data only as long as necessary for the purposes outlined in this Policy or as required by law. Active account data is retained for the duration of your subscription plus 30 days. After account termination, data is permanently deleted within 30 days upon request. Financial transaction records are retained for 7 years per Irish tax law. Anonymised usage analytics may be retained indefinitely as they cannot identify individuals.

• Encryption in transit — TLS 1.3 for all data transmission
• Encryption at rest — AES-256 for all stored data
• Role-Based Access Control (RBAC) — users access only what their role permits
• Tenant isolation — Organisation data is strictly isolated at all times
• Multi-factor authentication — available for all accounts, required for admin roles
• Regular penetration testing and OWASP Top 10 compliance checks
• Incident response plan with documented breach response procedures
• Sub-processor security reviews — all third-party processors assessed against security standards

In a personal data breach posing risk to your rights, we will notify the Irish Data Protection Commission within 72 hours and notify affected Organisations without undue delay per GDPR Article 33.

The following rights apply to all users regardless of location. EU users have these rights under GDPR:

• Right of Access — request a copy of personal data held about you
• Right to Rectification — correct inaccurate personal data
• Right to Erasure — request deletion of personal data (subject to legal retention obligations)
• Right to Restriction — request limitation of processing in certain circumstances
• Right to Data Portability — receive your data in JSON format (available in-platform)
• Right to Object — object to processing based on legitimate interests
• Right to Withdraw Consent — where processing is consent-based, withdraw at any time without penalty

To exercise rights: email info@carboncoreai.tech with subject line 'GDPR Data Request'. Response within 30 days. EU users may complain to the Irish Data Protection Commission at www.dataprotection.ie.

The Platform is for business use by individuals aged 18 and over. We do not knowingly collect data from minors. If you believe we have inadvertently collected data about a minor, contact us immediately.

Material changes will be notified by email and in-platform notice at least 14 days before effect. Continued use after that date constitutes acceptance. Current version always at carboncoreai.tech/privacy.