Privacy notice

KarbonBook is currently operated by [Khoo Daw Chang], as an individual, while a company for KarbonBook is being set up. Contact us about anything in this notice at autodc2026@gmail.com.

If KarbonBook is transferred to a company, we will tell you which company before your details are passed on to it, and you can ask us to delete them instead.

We have two roles. For your account and your enquiries (your name, email and how you use KarbonBook) we decide how the data is used. For the documents your organisation uploads, your organisation decides what goes in, and we process the personal data in them only to provide KarbonBook to your organisation.

When you send the request form on the KarbonBook website, we keep your name, work email, company, job title (if given), the type of company, what you are interested in, your message (if any), when you gave consent, and which page the form was sent from.

We use these details only to reply to you and to arrange a conversation about the beta or a proof of concept. They are stored by Supabase in Singapore and can be seen only by the people who run KarbonBook.

We keep them for up to 12 months after we were last in touch, unless you join the beta, in which case the rest of this notice applies. You can ask us to delete them at any time, and we will do so within 30 days.

Account details: your name, work email, organisation, role, and sign-in records (time, and the technical details our login provider records, such as IP address).

Documents you upload and the details read from them. Depending on the document these can include names, addresses, account and meter numbers, vehicle registration numbers, partly masked fuel card numbers, and the names or identity numbers of drivers and contractors on waste forms.

Activity records: who uploaded, reviewed, corrected, approved or changed a record, and when. This audit trail is part of what makes the numbers checkable.

Usage: how many documents and action plans your organisation has processed and the amount of AI processing used, so we can apply the beta limits.

To run KarbonBook for your organisation: reading documents, calculating emissions, producing your report and action plans, and keeping the audit trail. To keep the service secure and each organisation's data separate. To manage the beta: usage limits, support, and contacting you about the beta and what comes after it. To reply to enquiries sent through our website.

We do not sell personal data, show advertising, or use your documents to train AI models.

Three service providers handle the data on our behalf, each only for the part it does:

Supabase stores the database, the uploaded files, the login accounts and website enquiries, in Singapore.

Vercel runs the KarbonBook website and app; its application servers are in Singapore.

Anthropic (United States) provides the AI model that reads each document. The document is sent to Anthropic when you upload it, and the extracted details come back to KarbonBook. When an owner, admin or sustainability lead generates an action plan in the Report, a summary of your organisation's figures is sent to Anthropic to write it: totals by source and the names of your sites, but no documents and no names of people. Under Anthropic's commercial terms, this data is not used to train its models and is kept only for a limited period.

We do not share personal data with anyone else, unless the law requires it.

Using KarbonBook, or sending us an enquiry, means personal data is transferred to Singapore, and for KarbonBook users also to the United States, as described above. We rely on these providers' contractual commitments on data protection and security. Data is encrypted in transit and stored encrypted.

Account and organisation data: for the duration of the beta. If your organisation asks us to delete its data, or the beta ends and your organisation does not continue on a paid plan, we delete the organisation, its records, its audit trail, its uploaded files, its action plans and its users' logins within 30 days. We keep only a note that the deletion happened (organisation name, date, and numbers of records), with no personal data.

Website enquiries: as described in “If you send an enquiry through our website” above.

Copies held by our providers in routine logs and backups expire on their normal cycles.

Each organisation can see only its own data; this is enforced in the database itself. Uploaded files are private, and users cannot delete or overwrite an original document, so the evidence behind each number stays intact. Every change to a record is logged. Website enquiries are kept apart from organisations' data and cannot be read through the website. Access to the systems is limited to the people who run KarbonBook.

If a breach affects your personal data, we will tell you promptly and notify the authorities where the law requires.

You can ask us for a copy of your personal data, to correct it, to delete it, or to have your organisation's data exported. You can also withdraw your consent, which means we stop processing and delete your account or enquiry. Email autodc2026@gmail.com; we reply within 21 days.

If your personal data appears in a document another organisation uploaded (for example as a driver or contractor), please contact that organisation first; we will help them respond.

Please upload only documents your organisation needs for its emissions reporting, make sure your organisation may share them with us, and tell the people named in them (such as staff or drivers) that their details are processed for this purpose.

If we change this notice, we will update the date above and tell beta users of any significant change before it applies.