Legal
Privacy Policy
Effective 23 August 2026 · Kilvera
This is the notice we owe you before you type anything in: what we collect, why, who else sees it, how long we keep it, and the rights you can use from the EEA, the UK, Switzerland, California and elsewhere. The playable demo stays in this browser. An account keeps your own inventories with you — not only in one browser.
1. Who we are
Kilvera is a software tool that turns activity data you enter into a greenhouse-gas inventory on the GHG Protocol. The controller of personal data processed through the service is the operator of Kilvera (a natural person established in the Netherlands) (“we”, “us”).
You can reach us at kilvera.support@proton.me. If we appoint a representative in the EEA or the United Kingdom, or a data-protection officer, we will name them here.
This notice is the information we are required to give you under the EU General Data Protection Regulation (GDPR), the UK GDPR, the Swiss Federal Act on Data Protection, the California Consumer Privacy Act as amended by the CPRA, and equivalent laws that apply where you use the service.
2. What this notice covers
It covers the public website, the playable demo, the interest form, the inventory wizard, saved reports, reduction targets, accounts, evidence notes and files, and the PDF you download. It does not cover third-party sites we link to (GHG Protocol, Ember, DEFRA, EPA, and similar sources).
If you use Kilvera on behalf of a company, that company is typically the controller of the business data you type in (energy use, headcount, revenue). We process that data as a processor for the company, and your account email as a controller for the account itself. Both roles are described below.
3. Accounts and the demo
You can open the playable demo without an account. That sample is a fictional company. It lives only in this browser, in a separate store from any account, and is never uploaded. Create a free account to run and keep your own inventories and targets, so they are still there if you later take a paid plan, change browsers, or come back on another device.
A copy may also sit in this browser as a cache. Anyone with access to that browser can read the cache. Clear it from Settings, or by clearing site data.
If you used the product earlier without an account, leftover local inventories are uploaded to your account the first time you sign in on that browser.
4. Personal data we process
Account: email address and a hashed password, held by our authentication provider. We do not store your password in reversible form.
Interest form: the work email, optional company name and note you type if you ask to hear when a later tier opens. Legal basis: consent. We use it only to write to you about Kilvera.
Workspace, when you save: company name, registration number, industry, country, contact name and email you enter, activity quantities, calculated results, any reduction target you set, and evidence notes or files you attach to an activity line (invoices, meter reads, certificates). Most of this is business data. It becomes personal data where it identifies a living person (a named contact, a sole trader, a small team).
Technical: the IP address, user-agent and request metadata that any web host sees in order to deliver the pages, plus authentication cookies while you are signed in.
We do not ask for government ID, payment cards, special-category data (health, politics, religion, biometrics), or data about children. Do not enter those into free-text fields.
We do not run advertising pixels, analytics suites, or session replay. We do not sell personal data and we do not share it for cross-context behavioural advertising.
5. Why we process it (purposes and legal bases)
To create and secure your account, keep you signed in, and show you your own inventories — contract (GDPR Art. 6(1)(b)) and, for security logs, legitimate interests (Art. 6(1)(f)).
To store inventories and targets you ask us to save, and to generate the PDF on your device — contract.
To operate, secure and debug the service (abuse, availability, fraud) — legitimate interests. You may object; see section 11.
To answer a rights request or a lawful demand from a public authority — legal obligation (Art. 6(1)(c)).
To send service messages about your account (for example a security notice). We do not send marketing mail today. If we ever do, we will only do so with a lawful basis (consent or, where allowed, soft opt-in) and an unsubscribe.
Where we act as a processor for your company, the contract with that company and our documented instructions are the basis between us and the company. The company must have its own basis for collecting the data it types in.
7. Who else sees it
Cloudflare, Inc. hosts the application on its Workers / edge network and sees the technical data needed to serve the site (IP address, URL, headers). Cloudflare acts as a processor.
Supabase (the hosted Postgres, Auth and Storage service we use) stores accounts and, when you are signed in, the inventories, targets and evidence files you save. Access is restricted by row-level security so one account cannot read another. Supabase acts as a processor.
We do not use a payment processor yet. If paid plans go live, the processor (and that it is a processor) will be added to this list before the first charge.
We may disclose data if required by law, to defend legal claims, or to a successor if the service is transferred, under the same protections.
Staff or contractors who help operate Kilvera may see account email and support messages, under confidentiality, and only as needed.
8. International transfers
The service is offered worldwide. Hosting and authentication may process data in the United States, the European Economic Area, the United Kingdom, and other countries where Cloudflare or Supabase (and their infrastructure providers) operate.
Where GDPR or UK GDPR applies and the destination has not been recognised as adequate, we rely on the European Commission’s Standard Contractual Clauses (and the UK International Data Transfer Addendum where required), plus the processors’ own transfer tools (for example the EU–US Data Privacy Framework for certified US organisations). Copies of the relevant clauses are available from the processors, or from us on request.
A transfer still happens when you, sitting outside the EEA, send data to a worker that happens to run in the EEA, and the other way around. That is inherent to an edge-hosted site.
9. How long we keep it
Browser cache: until you clear it, or the browser does. Clearing the cache does not delete the account copy.
Account and saved inventories: for as long as the account exists. You can delete individual local copies from Settings. To delete the account and all server-side rows, email us from the same address; we will erase them within 30 days unless we must keep a minimal record to handle disputes or legal claims.
Interest-form email, optional company and note: until you ask us to remove them, or we close the interest list. Email us from the same address to withdraw.
Server logs held by Cloudflare: according to Cloudflare’s standard retention for Workers request logs, typically days to weeks, not as a customer database.
Backups held by processors: until they rotate, usually within a few weeks, and are not used for other purposes.
10. Security
Transport is HTTPS. Passwords are hashed by the authentication provider. Saved rows are isolated per user id.
No method of transmission or storage is perfectly secure. Do not put secrets (API keys, passwords for other systems) into inventory fields. The PDF you download is a file on your machine; treat it as confidential business information.
11. Your rights (EEA, UK, Switzerland)
You can ask us to: access your personal data; correct it; erase it; restrict or object to processing based on legitimate interests; receive a portable copy of data you provided; and withdraw consent where processing was based on consent. You can also lodge a complaint with a supervisory authority — in the Netherlands that is the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl); in the UK the ICO; in other EEA states your local authority. You may complain in the country of your residence, workplace, or of the alleged infringement.
To exercise a right, email us from the address on the account, or another address that lets us verify you. We respond within one month (GDPR) and may extend by two further months for complex requests, with notice. We will not charge a fee unless a request is manifestly unfounded or excessive.
We will need to confirm it is you. We will not discriminate against you for exercising a right.
12. California and other US state rights
If you are a California resident, you have the right to know the categories and specific pieces of personal information we have collected, the categories of sources, the business purposes, and the categories of third parties to whom we disclose it; to delete; to correct; to opt out of sale or sharing; and to limit the use of sensitive personal information. In the last twelve months we have collected the categories in section 4, from you and from your device, for the purposes in section 5, and disclosed them only to the processors in section 7. We have not sold personal information and we have not shared it for cross-context behavioural advertising. We do not use or disclose sensitive personal information for purposes that require a right-to-limit notice.
You may designate an authorised agent. We will verify the request. We will not deny goods or services, charge a different price, or provide a different quality for exercising these rights, except as permitted to offer a bona fide loyalty or similar program — we do not run one today.
Residents of Virginia, Colorado, Connecticut, Utah, Oregon, Texas and other states with similar laws have comparable rights of access, deletion, correction and appeal. Email us; if we refuse, you may appeal to the same address within a reasonable time and we will explain the outcome in writing.
We do not sell or share personal information. A Global Privacy Control (GPC) or similar opt-out signal is treated as a request to opt out of sale and sharing; there is nothing further to turn off today. A “Do Not Sell or Share My Personal Information” request can also be sent to the contact email.
13. Other countries
Brazil (LGPD): you have rights of confirmation, access, correction, anonymisation, portability, information about sharing, and revocation of consent. Contact us; you may also complain to the ANPD.
Canada (PIPEDA and provincial laws): we process for the purposes stated, limit collection, and you may withdraw consent where processing is consent-based.
Australia (Privacy Act) and Singapore (PDPA): you may request access and correction. If we ever use overseas disclosure, the processors in section 7 are the destinations.
Japan (APPI), South Korea (PIPA), South Africa (POPIA) and Mexico (LFPDPPP): you may request access, correction and deletion of personal data we hold about you, and information about overseas recipients listed in section 7.
Where a local law gives you a stronger right than this notice, we will honour that right for you. This notice describes our actual practices; it is not a claim that every statute on earth has been certified by counsel in that country.
14. Children
Kilvera is a business tool. An account requires you to be at least 18 (see the Terms). It is not directed at children. We do not knowingly collect personal data from anyone under 16 (or under 13 where that is the US threshold). If you believe a child has created an account, email us and we will delete it.
15. Automated decisions
The calculator applies published emission factors to figures you typed. That is not a legal or similarly significant automated decision about a person under GDPR Art. 22. Reduction-target “on track / behind” status is arithmetic on your own inventories, not a credit, employment or similar decision by us.
16. Changes
We will update this notice when our practices or the law change. The date at the top will change. Material changes that affect your rights will be flagged on this page and, if you have an account, by email where we can. Continued use after the effective date is the notice taking effect for that use. The version published at /privacy is the current one.
Questions: kilvera.support@proton.me. Also see Privacy and Terms.