Privacy policy

Ceresgreen (“we”, “us”) provides carbon accounting software to businesses in the United Kingdom. This policy explains what personal data we collect, why, and the choices you have. It applies to this website and the Ceresgreen application.

Who is responsible

Ceresgreen is the data controller for the personal data described here. Contact us at hello@ceresgreen.co.uk.

What we collect

• Account data. Your name and email address, used to create your account and send the one-time codes you sign in with. If you sign in with Google, we also receive your Google account identifier and, if you have one, your profile picture.
• Organisation data. Your company name, sector, location and settings, and the memberships that link people to an organisation.
• Business records. Schedules of rates and jobs, bills, bank transactions you share through Open Banking or Xero, meter readings, and activities you describe. This is what we turn into emissions figures. It is mostly business data, but can contain personal data such as names on invoices.
• Supplier and customer contacts. Details of suppliers you ask for emissions data and of customers you produce reports for, and any figures suppliers submit.
• Usage data. Standard server logs (IP address, browser, pages requested), kept for one month to run and secure the service. We do not use analytics or advertising trackers.

Why we use it

• To provide the service you signed up for: calculating emissions, producing reports and matching funding schemes (contract).
• To keep the service secure and prevent abuse (legitimate interests).
• To email you about your account and material changes to the service (contract).
• To meet legal obligations.

We do not sell personal data and we do not use it for advertising.

How we protect it

Business records are stored in a separate data vault, encrypted with a key that belongs only to your organisation. See Security for details.

Who processes it for us

We use these providers to run the service. Each processes data only on our instructions. Those marked “if you connect” are only involved when you turn that connection on.

• Amazon Web Services: Application hosting (London region).
• Neon: Managed Postgres databases.
• Resend: Sign-in codes and account emails.
• Google: Sign-in, if you choose “Continue with Google”.
• GoCardless: Open Banking connections, if you link a bank account.
• n3rgy: Smart-meter data, if you connect a meter.
• Xero: Accounting data, if you connect Xero.
• Anthropic: Language processing used to read bills, classify transactions, interpret activities you describe and answer support questions.

We share supplier requests with the suppliers you name, and nothing else with third parties unless the law requires it.

How long we keep it

For as long as your organisation has an account. To close your account and have your organisation's data deleted, email us from an address that belongs to a member of the organisation.

Your rights

Under UK GDPR you can ask for a copy of your personal data, ask us to correct or delete it, object to or restrict certain processing, and ask for it in a portable format. Email hello@ceresgreen.co.uk and we will respond within one month. You can also complain to the Information Commissioner's Office at ico.org.uk.

Cookies

We set one strictly necessary cookie to keep you signed in. See Cookies.

Changes

If we make material changes we will email account holders and update the date at the top of this page.