Privacy Policy

1. What we collect

EcoDiligence collects the minimum data needed to operate the service:

• Account information: name, email address, and organization details you provide when signing up.
• ESG profile data: the answers you enter into the wizard (company information, energy consumption, waste, supply chain, certifications).
• Coverage Check text: the questionnaire text you paste into Coverage Check is sent to our AI provider for one classification call and is then discarded. It is never written to our database, our logs, or our analytics. What we retain is the result in our own vocabulary — which of our datapoint names matched, how many questions there were, and which band the result fell into — which cannot be used to reconstruct what you pasted.
• Uploaded documents: electricity bills or other documents you upload to the AI bill parser. The file itself is sent to our AI provider for one-time extraction and is not retained on our servers afterward. The values extracted from it — such as consumption in kWh, the billing period, the provider name, and the amount charged — are stored against your organization so they can populate your Passport and so we can count your monthly parser usage.
• Technical logs: standard server logs (IP, user agent, timestamps) retained for 30 days for security and abuse prevention.
• Product analytics and diagnostics: page paths, device and browser information, coarse location derived from IP, performance data, and error details. Anonymous person profiles are not collected.
• Session recordings: a visual replay of how you interact with pages (clicks, scrolling, mouse movement) so we can diagnose issues and improve the product. Form field values and page text are both masked, so a replay shows layout and interaction rather than content — the figures in your ESG Passport are not captured. Recordings are not linked to a persistent identifier across visits. See our Cookie Policy for how to opt out.

2. How we use your data

We use your data to:

• Operate the EcoDiligence platform and generate your ESG Passport.
• Send transactional emails (sign-in links, profile updates, account notifications) via Resend.
• Improve service reliability through aggregated, anonymized usage analysis.
• Comply with legal obligations and respond to lawful requests.

We do not sell your data, do not show ads, and do not share data with third parties for marketing purposes.

3. Third-party processors

EcoDiligence uses a small number of trusted subprocessors to deliver the service:

• Clerk — authentication and account management.
• Supabase — database and file storage (EU region).
• Anthropic — AI bill parsing (Claude Vision API) and Coverage Check. Uploaded bills and pasted questionnaire text are sent for one-time processing only.
• Resend — transactional email delivery.
• Vercel — application hosting and edge networking.
• PostHog (EU cloud) — cookieless product analytics and session recordings, with in-memory persistence, masked form inputs, masked page text, do-not-track honoured, and no anonymous person profiles.
• Sentry — application error and performance monitoring. Sensitive request headers, bodies, and query strings are removed before events are sent.
• Vercel Web Analytics — aggregate, cookieless web traffic measurement.

4. Cookies

EcoDiligence currently uses only essential cookies required for authentication (Clerk) and session management (Vercel). We do not set analytics or marketing cookies. We do use cookieless, in-memory analytics as described above. See our Cookie Policy for details.

5. Your rights (GDPR)

Under the EU General Data Protection Regulation, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Request deletion of your account and all associated data.
• Export your data in a portable format.
• Object to specific processing.
• Lodge a complaint with your local data protection authority.

To exercise any of these rights, email privacy@ecodiligence.com. We respond within 30 days.

6. Data retention

We retain your account and ESG profile data for as long as your account is active. When you delete your account, all profile data is removed within 30 days. Server logs are retained for 30 days. Backups containing your data are rotated out within 90 days. Product analytics and diagnostic data is retained according to our processors' configured retention periods and only for as long as needed to understand usage, secure, and improve the service.

We process essential service and security data to perform our contract with you and protect the service. Our legitimate interests are the lawful basis for privacy-preserving analytics and reliability monitoring. You may object to that processing by contacting privacy@ecodiligence.com.

7. International transfers

Our database and file storage are hosted in the European Union (Supabase EU region), and our product analytics run on PostHog's EU cloud. Other subprocessors we rely on — Clerk (authentication), Anthropic (AI bill parsing), Resend (transactional email), Vercel (hosting and edge networking), and Sentry (error monitoring) — are established in or process data in the United States. Those transfers rely on the European Commission's Standard Contractual Clauses (SCCs) and, where the processor is certified, the EU–US Data Privacy Framework.

8. Children

EcoDiligence is a business tool and is not intended for individuals under the age of 18. We do not knowingly collect data from minors.

9. Changes to this policy

We may update this policy from time to time. Material changes will be announced via email to account holders. The “Last updated” date at the top of this page reflects the most recent revision.

10. Who is responsible, and how to reach us

EcoDiligence is operated by ECODILIGENCE, 15 Nahal Kana, Hod Hasharon, Israel. That provider is the controller of the personal data described in this policy and decides how and why it is processed.

Questions about this Privacy Policy, or about our handling of your data: privacy@ecodiligence.com.