Privacy Policy

This Privacy Policy applies to all users of the Trust Carbon Protocol platform, including website visitors, mobile app users, and participants in our carbon credit verification pilot program.

Who We Are

Trust Carbon Protocol is operated by PIESKE ONE LTDA, a company duly registered in Brazil, dedicated to democratizing access to carbon credit markets through innovative technology.

Scope of This Policy

This policy covers:

• Personal data collected through our website (trustcarbon.org)
• Information gathered through our mobile application (iOS and Android)
• Data obtained during the property verification process
• Information from interactions with our support team
• Data collected through cookies and similar technologies
• Information from third-party integrations (CAR/SICAR, satellite providers, etc.)

Data Controller

Under LGPD, the data controller is the entity responsible for decisions regarding the processing of personal data. For Trust Carbon Protocol, the data controller is:

Data Protection Officer (DPO)

We have appointed a Data Protection Officer (DPO) who is responsible for:

• Ensuring compliance with LGPD and other data protection regulations
• Acting as a point of contact between the company, data subjects, and the ANPD (National Data Protection Authority)
• Overseeing data protection strategies and implementations
• Conducting privacy impact assessments
• Handling data subject requests and complaints

We collect different types of data depending on your interaction with our platform. Below is a comprehensive breakdown of all data categories:

We collect data through various methods and sources:

1. Direct Collection (Information You Provide)

• Account Registration: When you create an account on our platform
• Verification Submissions: When you submit a property for verification
• Mobile App Usage: When you use features like GPS, camera, 360° capture
• Form Submissions: Contact forms, support requests, surveys
• Communications: Emails, chats, phone calls with our team
• Document Uploads: Property documentation, identification documents

2. Automatic Collection (Technology-Based)

• Cookies and Similar Technologies: Tracking your website/app usage
• Server Logs: Automatically recorded when you access our services
• Mobile App Permissions: GPS, camera, storage, sensors (with your permission)
• Analytics Tools: Google Analytics, Firebase, custom analytics
• Error Tracking: Crash reports and performance monitoring

3. Third-Party Sources

• CAR/SICAR Database: Property registration data from Brazilian government
• Satellite Providers: Imagery and geospatial data from commercial providers
• Public Records: Publicly available property and environmental data
• Weather Services: Precipitation and climate data
• API Integrations: Data from authorized third-party services

We use your personal data for specific, explicit, and legitimate purposes. Here's exactly why we need your data:

Primary Purposes

Secondary Purposes

• Account Management: Create and maintain your user account, authentication, password recovery
• Communication: Send verification updates, system notifications, respond to support requests
• Platform Improvement: Analyze usage patterns to enhance user experience and features
• Algorithm Training: Improve AI models and analysis accuracy (anonymized data only)
• Research & Development: Develop new features and verification methodologies
• Customer Support: Provide technical assistance and resolve issues
• Legal Compliance: Meet legal obligations, respond to authorities, enforce terms
• Analytics: Understand how users interact with our platform
• Quality Assurance: Monitor and improve service quality

Marketing & Communications (With Your Consent)

• Send newsletters about platform updates
• Inform about new features and improvements
• Share educational content about carbon credits
• Conduct surveys and request feedback
• Promotional campaigns (only with explicit consent)

Future Purposes (Post-Pilot)

When commercialization features are implemented, we may also use data to:

• Facilitate carbon credit transactions
• Connect sellers with buyers
• Process payments and financial transactions
• Generate invoices and tax documents
• Provide market analytics and insights

We will request new consent before implementing these features if required by law.

Under Article 7 of the Brazilian LGPD, personal data processing must be based on at least one legal basis. Here are the legal bases we rely on for different types of processing:

We value your privacy and only share your data when necessary and with trusted partners. We NEVER sell your personal data to third parties.

Who We Share Data With

When We Must Share Data

We may be legally required to share data in the following situations:

• Court orders or legal processes
• Investigations by regulatory authorities (ANPD, environmental agencies)
• Tax audits and financial reporting requirements
• Protection of our rights, property, or safety
• Prevention of fraud or illegal activities
• Compliance with environmental regulations

Some of our service providers and technology partners are located outside Brazil. This means your data may be transferred to and processed in other countries.

Countries Where Data May Be Processed

• United States: Cloud services (AWS, Google Cloud), AI providers (OpenAI, Anthropic)
• European Union: Satellite data providers, some cloud services
• Other countries: Where service providers have infrastructure

How We Protect Your Data Internationally

• All service providers sign Data Processing Agreements (DPAs)
• We use standard contractual clauses where applicable
• Data is encrypted in transit and at rest
• We regularly audit our providers' security practices
• We maintain copies of data within Brazil when possible
• We minimize data shared with international providers

We implement rigorous technical and organizational measures to protect your personal data against unauthorized access, accidental loss, destruction, alteration, or disclosure.

Security Measures We Implement

Your Security Responsibilities

While we implement strong security measures, you also play a crucial role:

• Strong Passwords: Use unique, complex passwords (minimum 12 characters)
• Account Security: Never share your login credentials
• Device Security: Keep your devices and apps updated
• Phishing Awareness: Be cautious of suspicious emails or messages
• Secure Networks: Avoid using public Wi-Fi for sensitive operations
• Log Out: Always log out from shared devices
• Report Suspicions: Contact us immediately if you notice unusual activity

We only retain your personal data for as long as necessary to fulfill the purposes for which it was collected, or as required by law.

Retention Periods

Exceptions to Deletion

We may retain data beyond the standard retention period if:

• Required by law (e.g., court orders, investigations)
• Necessary for legal claims or defense
• You explicitly consent to extended retention
• Needed to comply with legal obligations
• Anonymized for statistical or research purposes

Early Deletion Requests

You can request deletion of your data before the retention period expires by contacting legal@trustcarbon.org. However, we may need to retain certain data to comply with legal obligations or for legitimate business purposes (e.g., maintaining certification records).

The Brazilian LGPD (Article 18) grants you comprehensive rights regarding your personal data. Here's what you can do:

How to Exercise Your Rights

Response Timeline

• Acknowledgment: Within 48 hours of receiving your request
• Response: Within 15 days (may be extended to 30 days for complex requests)
• Free of Charge: First request is always free; subsequent requests may incur reasonable fees

When We May Refuse a Request

We may deny your request if:

• We cannot verify your identity
• The request is manifestly unfounded or excessive
• Legal obligations require us to retain the data
• The data is necessary for exercising our legal rights
• Public safety or health is at risk

If we refuse your request, we will explain the reasons and inform you of your right to complain to the ANPD.

We use cookies and similar tracking technologies to enhance your experience, analyze usage patterns, and improve our services.

What Are Cookies?

Cookies are small text files stored on your device when you visit our website or use our app. They help us remember your preferences and understand how you use our platform.

Types of Cookies We Use

Third-Party Cookies

Some cookies are set by third-party services we use:

• Google Analytics: Website traffic analysis
• Firebase: Mobile app analytics and crash reporting
• Mixpanel: User behavior tracking
• Hotjar: Heatmaps and session recordings

Other Tracking Technologies

Besides cookies, we also use:

• Web Beacons: Small graphic images to track email opens and clicks
• Local Storage: HTML5 storage for app functionality
• SDKs: Software development kits in our mobile app for analytics
• Fingerprinting: Device characteristics for fraud prevention (not for tracking)

LGPD Protection for Minors

According to LGPD Article 14, the processing of personal data of children and adolescents must be carried out in their best interest, with:

• Specific consent from at least one parent or legal guardian
• Information provided in clear and accessible language
• Minimum collection of data necessary for the service

If You Are a Minor

If you are under 18 years old and wish to use Trust Carbon:

1. You must have your parent or legal guardian create the account
2. All communications will be directed to the adult account holder
3. The adult is responsible for supervising all platform activities
4. Verification processes must be conducted by the adult

If You Are a Parent/Guardian

If you discover that your child has provided personal data without consent:

• Contact us immediately at legal@trustcarbon.org
• We will delete the data within 48 hours
• We will investigate how the data was collected
• We will implement additional safeguards to prevent recurrence

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons.

How We Notify You of Changes

What Constitutes a "Material Change"

Material changes include:

• New types of personal data being collected
• Changes in how we use your data
• New third parties receiving your data
• Changes in data retention periods
• International data transfer to new countries
• Significant changes to your rights
• Changes in our security practices

Your Options

If you disagree with the updated policy:

• You can close your account before the changes take effect
• Contact us to discuss your concerns
• Exercise your LGPD rights (e.g., data deletion, withdrawal of consent)

Continued use of Trust Carbon after the effective date of changes constitutes acceptance of the updated Privacy Policy.

We are committed to addressing your privacy concerns and questions. If you have any inquiries about this Privacy Policy or our data practices, please contact us.

Contact Information

Filing a Complaint with ANPD

If you are not satisfied with our response to your privacy concerns, you have the right to file a complaint with the Brazilian National Data Protection Authority (ANPD):

What to Expect

When you contact us:

1. Acknowledgment: We will acknowledge receipt of your inquiry within 48 hours
2. Investigation: We will investigate your concern thoroughly
3. Response: We will provide a substantive response within 15 days (may extend to 30 days for complex matters)
4. Resolution: We will work with you to resolve the issue
5. Follow-up: We may contact you for clarification or additional information