Privacy Policy

1. Who We Are

Yeco AI is the data controller responsible for your personal data. If you have any questions about how we handle your data, or wish to exercise your rights, please contact us at:

2. What Data We Collect

We collect and process the following categories of personal data:

Account & Identity Data

• Name and email address (provided at registration)
• Password (stored in hashed, non-reversible form)
• Account role and organisation membership
• Profile settings and preferences

Organisation & Emissions Data

• Organisation name, sector, and size
• Carbon emission figures across Scope 1, 2, and 3 categories
• Supporting data entered into the reporting wizard (fuel use, electricity consumption, employee commuting, waste, purchased goods, etc.)
• Completed and draft carbon emission reports
• Geographic data associated with emissions, where provided

Usage & Technical Data

• IP address and approximate location (country/region level)
• Browser type and version, operating system
• Pages visited, features used, and time spent on the platform
• Auto-save activity and draft history
• Error logs and performance diagnostics

Communications Data

• Messages sent to our support team
• Feedback or survey responses you provide voluntarily

3. How We Use Your Data

We process your personal data on the following legal bases and for the following purposes:

Performance of a Contract

• Creating and managing your account
• Providing the carbon reporting wizard and associated tools
• Enabling team collaboration and organisation management
• Delivering auto-save, draft management, and report generation

Legitimate Interests

• Improving the accuracy and usefulness of AI-powered features
• Analysing platform usage to enhance user experience
• Detecting and preventing fraud, abuse, or security incidents
• Maintaining and improving the technical infrastructure

Legal Obligation

• Complying with applicable UK and international laws
• Responding to lawful requests from regulatory or government authorities

Consent (where applicable)

• Sending optional product updates or newsletters (you may withdraw consent at any time)
• Using non-essential cookies or analytics trackers

4. AI Features and Data Processing

Our AI-powered assistant uses the content of your current reporting session, such as the section you are completing and the data you have entered, to provide contextual guidance and suggestions. This processing occurs in real time and is used solely to deliver the AI assistance feature.

We do not use your emissions data or personal details to train general-purpose AI models shared across unrelated users or third parties without your explicit consent.

5. Emissions Heatmap and Anonymity

The emissions heatmap feature may display aggregated, geographic emissions data. Where this involves data from your organisation, it is either anonymised before display or subject to your explicit opt-in. You can control your heatmap visibility settings within your account.

6. Data Sharing

We do not sell your personal data. We may share your data in the following limited circumstances:

Service Providers

We use trusted third-party providers to help operate the Service, including cloud hosting, database, and analytics services. These providers act as data processors under contract and may only process your data as instructed by us.

Organisation Team Members

If you are part of an organisation account, other members of your organisation with the appropriate role (owner or admin) may be able to view your activity and contributions within that workspace.

Legal Requirements

We may disclose your data where required by law, court order, or a legitimate request from a public authority.

Business Transfers

In the event of a merger, acquisition, or sale of assets, your personal data may be transferred as part of that transaction. We will notify you before your data becomes subject to a different privacy policy.

7. Data Retention

We retain your personal data only for as long as necessary for the purposes described in this policy:

• Account data: retained for the duration of your account, plus up to 2 years after deletion for legal and audit purposes
• Emissions reports: retained for the duration of your account; deleted within 90 days of account deletion unless you request earlier deletion
• Draft data: retained as long as your account is active; auto-deleted after 12 months of inactivity
• Usage and technical logs: retained for up to 12 months for security and performance purposes
• Support communications: retained for up to 3 years

8. Cookies

We use cookies and similar technologies to operate and improve the Service. These include:

• Essential cookies: required for authentication, session management, and security. These cannot be disabled.
• Preference cookies: used to remember your settings, such as your selected theme (light or dark mode).
• Analytics cookies: used to understand how the platform is used so we can improve it. These are only placed with your consent.

You can manage cookie preferences through your browser settings at any time.

9. Data Security

We take the security of your data seriously. We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These include encrypted data transmission (HTTPS), hashed password storage, role-based access controls, and regular security reviews.

No method of transmission over the internet is completely secure. While we strive to protect your data, we cannot guarantee absolute security. If you become aware of any security vulnerability, please notify us immediately at contact@yeco-ai.co.uk.

10. Your Rights Under UK GDPR

As a data subject, you have the following rights in relation to your personal data:

• Right of access: request a copy of the personal data we hold about you
• Right to rectification: request correction of inaccurate or incomplete data
• Right to erasure: request deletion of your personal data in certain circumstances
• Right to restriction: request that we limit how we process your data
• Right to data portability: receive your data in a structured, machine-readable format
• Right to object: object to processing based on legitimate interests
• Right to withdraw consent: where processing is based on consent, you may withdraw it at any time

To exercise any of these rights, please contact us at contact@yeco-ai.co.uk. We will respond within 30 days. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

11. International Transfers

Your data is primarily stored and processed within the United Kingdom and European Economic Area. Where we transfer data outside these areas, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the relevant data protection authority.

12. Children's Privacy

The Service is not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a minor, please contact us so we can delete it promptly.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify registered users by email or via an in-app notice before the changes take effect. The updated policy will always be available on this page with a revised "last updated" date.

14. Contact Us

For any privacy-related queries or to exercise your rights, please contact: