Privacy Policy

Who we are

Carbonform is operated by Chris Ilabaca, a UK sole trader. Our contact address is hello@carbonform.dev. The website is carbonform.app.

We are the data controller for any personal data you share with us directly (such as your email address when joining the waitlist or creating an account).

What we collect and why

Free plan (in-browser demo)

When you use the free demo, your PDF is processed entirely inside your own browser using WebAssembly. The file is never uploaded to our servers. We do not see it, store it, or transmit it. No personal data from your document is collected.

Waitlist and account registration

We collect your email address when you join the waitlist or create an account. We use this to:

• Send you product updates and your account details.
• Provide support when you contact us.

We do not sell your email address or share it with third-party marketers.

Pro and Team plans (server-side processing)

On paid plans, PDFs you upload are transmitted to our servers over TLS 1.3 and stored temporarily to process your request. Files are deleted from our servers within 24 hours of upload. We do not use your documents to train AI models, and we do not share them with third parties.

Usage data

We collect minimal server-side logs (IP address, browser type, pages visited) for security and debugging purposes. Logs are retained for up to 30 days and then deleted. We do not currently use any third-party analytics. When we add analytics, we will update this policy and choose a tool that does not require consent under PECR (such as Plausible Analytics, which does not set cookies or fingerprint users).

Cookies

Carbonform does not set any non-essential cookies. We do not use advertising, tracking, or analytics cookies. The only cookies that may be set are strictly necessary session cookies required for your account login. No cookie consent banner is required under PECR because we only use essential cookies.

Lawful basis for processing

We process personal data under the following lawful bases (UK GDPR Article 6):

• Contract: to provide the service you have signed up for (account, billing, file processing).
• Legitimate interests: to maintain server security logs and prevent abuse.
• Consent: for any optional marketing emails (you can unsubscribe at any time).

Data retention

• Free plan demo: no data stored (in-browser only).
• Pro and Team uploads: deleted within 24 hours.
• Account data (email, billing): retained while your account is active and for 90 days after deletion.
• Security logs: retained for 30 days.

Data residency

Pro and Team plan data is stored within the UK or EU. We do not transfer personal data to countries outside the UK or EEA without appropriate safeguards.

Your rights

Under UK GDPR, you have the right to:

• Access the personal data we hold about you.
• Rectify any inaccurate data.
• Erase your data (right to be forgotten), subject to our legal obligations.
• Restrict or object to processing.
• Portability of your data in a machine-readable format.
• Withdraw consent at any time for processing based on consent.

To exercise any of these rights, email hello@carbonform.dev. We will respond within 30 days.

You also have the right to lodge a complaint with the UK supervisory authority, the Information Commissioner's Office (ICO), at ico.org.uk.

Contact

For any privacy-related questions, contact us at hello@carbonform.dev.

Changes to this policy

We may update this policy from time to time. When we do, we will update the "Last updated" date at the top of this page. Continued use of Carbonform after changes constitutes acceptance of the updated policy.