Privacy Policy

1. Personal Data We Collect

1.1 Data provided directly by you: registration data (full name, corporate email, job title, company, phone number, and organization's CNPJ), contractual data (company name, fiscal address, banking details of authorized representative), and communications (content of messages via forms, email, chat, or support calls).

1.2 Data collected automatically: browsing data (IP address, browser type, operating system, pages visited, time spent, referral URL, and device identifiers), cookies and similar technologies (as per Section 8), and platform usage data (access logs, actions within CarbonOS, API queries, generated reports, and AI agent configurations).

1.3 Data obtained from third parties: data from authorized integrations (ERP, SCADA, IoT systems, and other platforms connected by the client) and public sources (public records, regulatory databases, and government agency information for compliance purposes).

1.4 Data processed by AI agents: The CarbonOS platform operates with 15 specialized artificial intelligence agents. We clarify that: (i) the agents predominantly process industrial and operational data, not personal data; (ii) when personal data is incidentally included in operational datasets, we apply minimization and pseudonymization techniques; (iii) no automated decision that produces significant legal effects on natural persons is made exclusively by our AI agents without human review; and (iv) Carbonova's AI models do not use clients' personal data for training general-purpose models.

2. Purposes and Legal Bases for Processing

We process your personal data for the following purposes and based on the following legal bases under the LGPD: Execution of contracted services (CarbonOS, API, Trading Desk) – Contract performance (Art. 7, V). Issuance of invoices and financial management – Legal obligation compliance (Art. 7, II). Operational and support communications – Contract performance (Art. 7, V). Sending newsletters and educational content – Consent (Art. 7, I). Product improvement and development – Legitimate interest (Art. 7, IX). Fraud prevention and platform security – Legitimate interest (Art. 7, IX). Regulatory compliance (CBAM, SBCE, CSRD, CVM) – Legal obligation compliance (Art. 7, II). Generation of audit and traceability reports – Contract performance and legal obligation (Art. 7, II and V).

3. Data Sharing

We share your personal data only with: (a) Service providers that assist us in operations, including cloud infrastructure providers (AWS, Google Cloud), analytics tools, payment processors, and communication services, all contractually bound to process data according to our security standards; (b) Regulatory and market partners, when necessary for service execution, such as carbon registries (Verra, Gold Standard), carbon exchanges, and regulatory bodies (MMA, IBAMA, CVM); (c) Judicial, regulatory, or administrative authorities, when required by law, court order, or valid administrative order; (d) In the event of corporate transactions (merger, acquisition, reorganization), maintaining the guarantees of this Policy. We do not sell, rent, or commercialize your personal data.

4. International Data Transfers

Carbonova operates with global infrastructure and may transfer data to countries outside Brazil, including the United States and European Union countries. These transfers are carried out based on standard contractual clauses approved by ANPD, guarantees that the destination country provides an adequate level of data protection, or specific consent from the data subject, where applicable. For clients subject to the GDPR, transfers are carried out in compliance with Chapter V of the GDPR and mechanisms approved by the European Commission.

5. Data Retention

We retain your personal data for as long as necessary to fulfill the purposes for which it was collected: Contractual and fiscal data – 5 years after contract termination (Art. 173, CTN; Art. 205, CC). Platform access logs – 6 months (Art. 15, Marco Civil da Internet). Emissions inventory and audit data – for the period required by applicable regulations (minimum 7 years for CBAM/CSRD records). Marketing data (consent) – until consent is revoked. After the retention period ends, data is anonymized or securely deleted.

6. Your Rights as a Data Subject

Under the LGPD, you have the following rights: (a) Confirmation and access – to know whether we process your data and access a copy; (b) Correction – to request the update of incomplete, inaccurate, or outdated data; (c) Anonymization, blocking, or deletion – of unnecessary, excessive, or non-compliantly processed data; (d) Portability – to request the transfer of your data to another provider; (e) Deletion – of data processed based on consent; (f) Information – about public and private entities with which we share data; (g) Consent revocation – at any time, at no cost; (h) Opposition – to processing based on consent waiver grounds, in case of LGPD non-compliance; (i) Review of automated decisions – to request human review of decisions made solely based on automated processing.

To exercise your rights, contact our Data Protection Officer (DPO) at privacidade@carbonova.ai. We will respond to requests within 15 business days, as provided by the LGPD.