EQEmitIQ

Privacy Policy

Last updated: February 17, 2026

1. Information We Collect

EmitIQ collects the following categories of information:

  • Account Data: Name, email address, company name, job title, and account credentials provided during registration.
  • Emissions Data: Greenhouse gas emissions records, facility information, vendor/supplier data, utility bills, invoices, fuel receipts, and other documents uploaded for processing.
  • Usage Data: Log data, page views, feature usage, API requests, and platform interactions collected automatically during your use of the Service.
  • Device Data: Browser type, operating system, IP address, and device identifiers collected automatically via standard web protocols.

2. How We Use Your Information

We use your information for the following purposes:

  • Service Delivery (legal basis: contract performance) — to provide, maintain, and improve our emissions tracking and compliance reporting services, process your data, and generate reports.
  • Security & Fraud Prevention (legal basis: legitimate interest) — to protect the platform, detect anomalies, and prevent unauthorized access.
  • Communications (legal basis: legitimate interest / consent) — to send service notifications, security alerts, and product updates.
  • Compliance (legal basis: legal obligation) — to comply with applicable laws, regulations, and legal processes.

3. AI Processing Disclosure

When you upload documents to EmitIQ, your data may be processed by artificial intelligence (AI) models provided by Anthropic (Claude) for the purpose of extracting structured data from unstructured documents (e.g., invoices, utility bills, fuel receipts).

AI processing is performed within United States infrastructure. Extracted data is returned with confidence scores indicating the reliability of each extracted field. All AI-extracted data is presented to you for review and approval before it is used to create emissions records. No data is used to train AI models — your documents are processed solely for the purpose of data extraction within the Service.

4. Third-Party Sharing & Sub-Processors

We do not sell, rent, or trade your personal information. We share data only with the following categories of service providers who are contractually bound to protect your data:

  • Amazon Web Services (AWS) — Infrastructure hosting, data storage, and compute (US-West-2 region).
  • Anthropic — AI-powered document data extraction.
  • Climatiq — Emission factor lookups and carbon intensity data.
  • Clerk — Authentication and identity management services.
  • Stripe — Payment processing and subscription management.

For a complete and current list of sub-processors, see our Data Processing Agreement.

5. Data Security

We implement industry-standard security measures to protect your data, including AES-256 encryption at rest, TLS 1.3 encryption in transit, row-level tenant isolation, role-based access control, immutable audit logging, and regular security assessments. Our infrastructure is designed for SOC 2 Type II compliance. See our Security page for details.

6. Data Retention

We retain different categories of data for different periods:

  • Emissions data and compliance records: Retained for the duration of your subscription plus seven (7) years to satisfy SB 253 regulatory retention requirements.
  • Account data: Retained for the duration of your subscription and deleted within thirty (30) days of account termination, unless legal retention obligations apply.
  • Audit logs: Retained for seven (7) years in immutable storage with optional AWS QLDB blockchain verification.
  • Usage and device data: Retained for up to twenty-four (24) months for security and product improvement purposes.

7. International Transfers

All EmitIQ data is processed and stored in the United States (AWS US-West-2 region, Oregon). If you are located outside the United States, your data will be transferred to and processed in the US. For data subjects in the European Economic Area (EEA), United Kingdom, or Switzerland, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission to ensure adequate data protection safeguards for cross-border transfers. Our Data Processing Agreement provides further details.

8. Cookies & Tracking

EmitIQ uses the following types of cookies:

  • Essential cookies (httpOnly session cookies) — Required for authentication and platform functionality. These cannot be disabled.
  • Analytics cookies (optional) — Used to understand platform usage and improve the Service. You may opt out at any time.

We do not use third-party advertising trackers. We do not sell or share cookie data with advertisers.

9. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

  • Under GDPR (EU/EEA residents): Right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), objection (Art. 21), and rights related to automated decision-making (Art. 22).
  • Under CCPA/CPRA (California residents): Right to know what personal information is collected, right to delete, right to opt out of sale (we do not sell personal information), and right to non-discrimination for exercising your rights.

To exercise any of these rights, contact us at [email protected]. We will respond to verified requests within thirty (30) days.

10. Children's Privacy

The Service is not directed at individuals under the age of 16. We do not knowingly collect personal information from children. If we become aware that we have collected personal data from a child under 16, we will take steps to delete that information promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. For material changes, we will provide at least thirty (30) days' notice via email or an in-product notification before the changes take effect. Continued use of the Service after the effective date of a revised policy constitutes acceptance of the changes.

12. Contact Us

For privacy inquiries, data subject requests, or questions about this policy, email us at [email protected].