Privacy Policy

1. Data controller

Global Business Group LLC operates Karboni and is the data controller responsible for determining the purposes and means of processing personal data for its service, under the UAE Personal Data Protection Law and other applicable laws. Contact for privacy and rights requests: info@karboni.app.

If your company uploads personal data about employees or others, it must have authority to share it. We process workspace data to deliver the service according to the company's instructions and member permissions.

2. Data categories and purposes

Account data: name, email address, preferred language and authentication data, to create accounts, sign in, manage membership and send service communications.

Company and activity data: company name, country, headcount, electricity, fuel, travel, Excel and CSV uploads, reports, tasks and team membership, to calculate emissions, store and compare results and manage work.

Contact data: name, email, company, country and message, to respond to enquiries and provide support. Usage and device data such as pages visited, browser or cookie identifiers and network information processed by hosting and analytics services, to secure the service, understand usage and improve it. We use Google Analytics to measure visits.

Subscription data: customer, transaction and subscription identifiers, plan, status and period end, to manage billing and access. Card details are processed within Paddle checkout; we do not store your full card number or security code.

3. Legal bases

We process account, workspace and subscription data to perform the service contract; security, support and improvement data for legitimate interests where permitted by law and with regard to your rights; and legally required records to comply with legal obligations. We rely on consent where required, including non-essential analytics where the law requires it. Consent can be withdrawn without affecting earlier lawful processing.

4. Sharing and Paddle's role

We do not sell personal data. We share necessary data with hosting, authentication, email, support and analytics providers, including Lovable Cloud and Google Analytics, to provide the service. Only when you explicitly request an AI summary, numeric activity data without company name or user identity is sent to the AI service through Lovable AI Gateway; avoid including personal information in activity data.

Paddle.com is the Merchant of Record for purchases made through it and receives data needed for sales, subscription management, payments, tax compliance, invoices, fraud prevention and refunds. Paddle processes that data under its own privacy notice and may act as an independent controller.

We may share necessary data with legal and accounting advisers and authorities when required by law. Our providers may process data outside your country; we use appropriate safeguards required by applicable law for transfers.

5. Security

We use appropriate technical and organisational measures, including encryption, access controls and workspace permissions, to protect data. Company members access data according to their roles. No transmission or storage method guarantees absolute security.

6. Cookies and your choices

We use essential cookies or local storage for authentication and language/country preferences, and Google Analytics cookies for analytics. We do not use advertising marketing cookies in the current service. You can block or delete cookies in your browser and use Google's Analytics opt-out tool; blocking essential storage may affect sign-in and preferences. Contact us to object or withdraw consent where applicable.

7. Retention

We retain account and workspace data while needed to provide the service, and contact requests while resolving and following up on them. Financial or security records may be retained as legally required or to resolve disputes. Subscription expiry does not automatically delete reports; they remain readable according to company permissions. When no longer needed, data is deleted or anonymised, subject to backup retention and legal obligations.

8. Your rights and contact

Subject to applicable law, you may request access, correction, deletion, restriction or portability, object to processing, withdraw consent and complain to the competent authority. Send requests to Global Business Group LLC at info@karboni.app. We may verify your identity and authority over company data before responding within the applicable legal timeframe. Some rights are subject to legal exceptions.