Privacy Policy

1. Who we are

321ZERO is a carbon measurement and reporting platform built in Jersey, Channel Islands. We handle personal data in accordance with the Data Protection (Jersey) Law 2018. JOIC registration is in progress. You can contact us at privacy@321zero.je about this policy or a data rights request.

2. What data we collect

• Account data: Your email address and account metadata, such as your company name and selected tier.
• Emissions data: Energy, fuel, waste, travel and other activity figures you enter, together with calculated CO₂e values.
• Optional cost data: Costs you choose to enter alongside consumption records.
• Published data: Company and emissions information you deliberately publish through a public ticker or other opt-in public feature.
• Technical data: Hosting and authentication providers may process IP addresses, browser information, request timestamps and security logs when you access the service.

We do not currently operate a separate product analytics or behavioural tracking system. We do not collect data directly from utility providers.

3. How we use your data

• To create and authenticate your account.
• To calculate greenhouse gas emissions from information you provide.
• To display dashboards, charts, summaries and exports on your device.
• To generate reporting files for you to review and submit to the relevant organisation yourself.
• To operate a public ticker when you explicitly choose to publish one.
• To maintain service security, diagnose faults and respond to support or legal requests.

4. Where and how data is stored

The platform's primary store for dashboard and emissions data is your browser's localStorage. This means the data is normally kept on the device and within the browser profile you use. It is not automatically protected by Supabase Row Level Security and may be accessible to other people who can use your unlocked device or browser profile. Clearing site data, using private browsing, changing device or reinstalling the browser may remove locally stored data.

Supabase is used for authentication and may store account metadata, published ticker information, or other server-side records required by enabled features. Netlify hosts and delivers the website and may process request and deployment logs.

Supabase infrastructure used by this service may be located in the London AWS region (eu-west-2). London is in the United Kingdom and is not in the European Union. Provider processing may also involve other locations described in their own service and subprocessors documentation.

5. Processors and disclosures

We do not sell your personal data. We do share or make data available to service providers where necessary to run the platform:

• Netlify: website hosting, content delivery and associated technical logs.
• Supabase: authentication, account services and relevant server-side database functions.

These providers act as processors or subprocessors for relevant data. They may use their own subprocessors as described in their terms and privacy documentation.

We do not send your emissions data to the Government of Jersey, JFSC or another reporting body on your behalf unless a feature clearly asks for your authorisation. Reports generated for download or email remain your responsibility to review and submit.

Information you opt to publish in a ticker is intentionally made public and may be viewed, copied or indexed by others.

6. Legal grounds and international processing

Depending on the context, we process data to provide the service you request, to pursue legitimate interests such as security and support, to comply with legal obligations, or on the basis of consent for optional publication.

Where providers process data outside Jersey, including in the United Kingdom, we rely on the provider arrangements and applicable legal safeguards available for that processing.

7. Your data protection rights

Subject to applicable conditions and exemptions under Jersey law, you may have rights to:

• Ask whether we process your personal data and request a copy.
• Ask us to correct inaccurate or incomplete personal data.
• Ask us to erase personal data we hold on the server.
• Request restriction or object to certain processing.
• Request portable data where the legal requirements apply.
• Withdraw consent for optional processing, including publication.

Local dashboard data can be reviewed or removed through the platform and your browser's site-data controls. To exercise a right concerning server-side data, email privacy@321zero.je. We may need to verify your identity before acting on a request.

8. Retention and deletion

Browser data remains in localStorage until you delete it, clear the browser's site data, or the browser removes it. Account and other server-side records are retained while needed to provide the service and for reasonable security, support or legal purposes.

A dashboard deletion action first removes data available on the device and may also attempt to remove related server records. Server deletion is not guaranteed to be immediate: it can be delayed or fail because of a network, authentication or provider error. If the interface reports a failure, or if you want confirmation that server-side data has been removed, contact us at privacy@321zero.je. Limited records may be retained where required by law or necessary to resolve security and legal matters.

9. Security

Connections to the deployed service use HTTPS. Supabase Auth handles account authentication and password storage; 321ZERO does not receive or store your plain-text password. No internet or browser storage system is completely secure, so you should use a strong, unique password, protect access to your device and keep your own exports or backups where appropriate.

10. Changes to this policy

We may update this policy as the service and its providers change. The date at the top identifies the latest version. Material changes will be presented through the platform or another reasonable channel where practicable.

11. Contact

Questions or requests can be sent to privacy@321zero.je.

321ZERO
Jersey, Channel Islands
JOIC registration in progress