Privacy Notice

Last updated: 8 September 2026

This notice explains how Carbon Verify CBAM handles personal information. The data controller is Jesse Seaward, trading as Carbon Verify, Unit 20 Woolton Farm, Bekesbourne Lane, Canterbury, CT4 5EA, United Kingdom. For privacy questions or rights requests, email hello@carbonverify.co.uk.

Your CBAM working records

Import, supplier, evidence and workspace information entered in the app is processed in your browser. Carbon Verify does not upload those business records to its own database. Browser storage keeps the current workspace available on the same browser.

Keep your own backup. Clearing site data, changing browser profile, losing the device or a browser policy can remove the local copy. Export a workspace file before clearing data and at sensible points while you work.

Licence activation

When you activate or check a paid licence, the licence key and a randomly generated browser or activation identifier are sent to Lemon Squeezy's licensing service. The purchaser email address entered for activation is matched against the customer email returned by that service. This is used to provide the purchased access, enforce the active-browser limit and check licence status. Your import, supplier and evidence records are not included in a licence request.

Checkout and billing

Purchases take place through Lemon Squeezy's checkout. Lemon Squeezy acts as merchant of record and handles payment, billing and subscription information. Carbon Verify does not receive or store your card details. Read Lemon Squeezy's privacy notice for its processing.

Website analytics and support

• Google Analytics is available on the public CBAM product, guide and legal pages only. It is not included in the CBAM app.
• Unless you select Allow analytics, the Google tag is not downloaded and Carbon Verify sends no analytics request to Google. A declined or unset choice therefore produces no analytics measurement.
• After you allow analytics, Carbon Verify sends a page view containing the page title and pathname without its query string or fragment. It also sends the referring path without its query or fragment when you arrived from Carbon Verify, or only the other site's origin when you arrived from elsewhere. Depending on the web stream settings, Google Analytics may also measure basic interactions on these public pages, such as scrolling, file downloads and links to other websites. Carbon Verify additionally sends one of five fixed destination labels when you select a relevant product link: free_scope, record_book, checkout, core_product or secr_product.
• The analytics code does not read or send any information entered in the CBAM app. Advertising storage, advertising personalisation and Google signals are disabled.
• The hosting provider may create routine security and access logs containing an IP address, browser details, requested page and timestamp.
• If you contact support, the message and contact details are used to answer the request and maintain an appropriate business record.

Purposes, legal bases and retention

• Licence and purchase administration: performance of the contract and legitimate interests in preventing licence misuse.
• Optional public-page analytics: your consent, which you may withdraw at any time through Cookie settings.
• Support correspondence: performance of the contract and legitimate interests in supporting and improving the service.
• Hosting security logs: legitimate interests in maintaining a secure and reliable website.

Support and transaction records are kept only as long as reasonably required for support, accounting, tax, fraud prevention and legal obligations. Hosting and Lemon Squeezy retention periods are controlled by those providers. Locally stored app data remains until the browser, user or browser policy deletes it.

International processing

Google, Lemon Squeezy and hosting providers may process personal information outside the UK. Their privacy notices explain the safeguards they use for international transfers. Read Google's privacy policy.

Your rights

Depending on the circumstances, UK data-protection law may give you rights to access, correct, erase or restrict personal information, object to certain processing, and receive portable data. Email the address above to make a request. You may also complain to the Information Commissioner's Office.

Local storage, analytics and checkout cookies

The app uses browser local storage for workspace data, a random activation identifier and the minimum licence details needed to restore access. These are used for the functions you request, not behavioural advertising.

The public Carbon Verify pages store your analytics choice in same-origin browser storage so it can be respected across the product family and on your next visit. If you allow analytics, Google Analytics may set cookies such as _ga for up to 13 months. Use the Cookie settings button shown on every tracked public page to decline later; this stops future measurement and removes accessible Google Analytics cookies. Clearing browser site data also removes the saved choice.

The Google Analytics measurement ID is G-GM3QJ57W8N. Google receives the technical information needed to deliver the request, which can include device and browser details and an IP address in transit. Analytics reports are retained according to the property's Google Analytics settings.

Lemon Squeezy may use its own storage or cookies when checkout or billing is opened; its privacy notice governs that activity.

Changes

This notice may be updated when the service, suppliers or legal requirements change. The date at the top identifies the current version.