Privacy notice

Tender Carbon is a UK-based service and acts as the data controller for the personal data described in this notice under the UK GDPR and the Data Protection Act 2018.

Everything you type into the wizard — company details, emissions figures, targets — is stored in your browser's local storage on your own device. It is not transmitted to or stored on our servers, and we cannot see it. Clearing your browser storage permanently deletes it.

Because your plan data never reaches us, rights like access or erasure are exercised simply by using your browser's storage controls — you hold the only copy.

When you purchase an export, payment is processed by Stripe Payments Europe Ltd / Stripe, Inc. Your card details go directly to Stripe and are never visible to us. We receive from Stripe the information needed to confirm and support your purchase — typically your email address, billing country and the amount paid.

Lawful basis: performance of a contract (delivering your purchase) and our legitimate interests in record-keeping, fraud prevention and customer support.

We currently run no advertising trackers and set no analytics or marketing cookies. The site uses local storage only for the functional purposes described above (your draft, wizard progress and purchase status). If this changes, we will update this notice before deploying anything new.

We share personal data only with the service providers needed to operate: Stripe (payments) and our hosting provider (serving the website). Stripe processes data internationally under appropriate safeguards, including standard contractual clauses where required. We do not sell your data to anyone.

We keep purchase records for as long as needed for tax, accounting and legal purposes — typically six years for transaction records. Your draft data is retained only in your own browser, for as long as you keep it.

Under UK data protection law you have the right to access, rectify, erase, restrict or object to our processing of your personal data, and the right to data portability. To exercise any of these, contact us via the details on this site. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.

The site is served over HTTPS, payments run through Stripe's PCI-compliant infrastructure, and our servers hold no draft content. No system is perfectly secure, but the architecture is deliberately designed so that the most sensitive thing — your emissions data — never leaves your device.