Privacy policy

Who we are

CBAM Data is a product of SASU R SOCIETY, 15 rue des Halles, 75001 Paris, France. We are the data controller for the personal data described here. Contact us at contact@cbamdata.eu.

Data we collect

When you use the free calculator or API, we process the request data you send, such as a CN code, country of origin, quantity and year. We use it to return the requested CBAM result and to protect the service from abuse.

When you create an account, we process your email address, authentication records and API key metadata. When you subscribe, Stripe processes payment details. We receive billing status and customer details from Stripe, but we do not receive your full card number. If you subscribe to the daily brief without an account, we store your email address and a private unsubscribe token so we can send the brief and honor unsubscribes. Neither an account nor the brief starts any other email. Both forms offer the 5 emails under Emails about CBAM 2027, behind an unticked box and a confirmation link.

The free calculator and the unkeyed API allow a set number of calls a day from one address. To count them we store a one-way hash of your address with the date, never the address itself, and we delete the row the next day. The legal basis is our legitimate interest in preventing misuse.

We use a privacy-friendly analytics tool to measure visits to the public website.

Emails about CBAM 2027

The CBAM cost report downloads without an email address. Apart from it, and only if you want them, you can ask for 5 short emails on what CBAM 2027 means for your CN codes. The box starts unticked, and nothing is sent until you click the link in our confirmation email.

What we collect: your email address, the page language, the CN code and origin of the cost sheet you came from if any, the consent sentence you ticked, when you asked and when you confirmed, and a keyed one-way hash of your IP address as a record of the request. We use it only to send those 5 emails and to show that you agreed to them. Resend delivers them for us.

The legal basis is your consent, Article 6(1)(a) GDPR.

If you don't confirm, we delete the request after 30 days. If you confirm, we keep the record of your consent for 3 years from that day, then delete it.

You can withdraw at any time with the unsubscribe link in every one of the emails, or by replying to one. Withdrawing doesn't make the emails already sent unlawful. The controller is SASU R SOCIETY, 15 rue des Halles, 75001 Paris, France, contact@cbamdata.eu.

Purpose of processing

We use personal data to provide the service, manage accounts, process subscriptions, answer requests, prevent misuse, keep records required by law and improve the product. We do not sell personal data or use it for targeted advertising.

Our legal bases are performance of a contract for accounts and subscriptions, legitimate interest for security, service operations and measuring how the site is used.

Cookies and local storage

We use essential storage for your theme choice and for your privacy choice. These do not track you. Our analytics, Umami on our own server, sets no cookie and stores nothing on your device. It counts page views and actions such as running the calculator or starting a checkout. When you are signed in, those actions carry your internal account id, never your email.

Storage and sharing

Account and usage records are stored with our service providers, including Cloudflare for hosting, database services and the routing of replies, Stripe for billing, and Resend for email. These providers process data only to provide their services to us.

When the site or the API fails, we send the error to Sentry, in its EU region. A report holds the error message, the code location, the page or endpoint that failed and the site version. Sentry does not store IP addresses for these reports, and we attach no account id or email to them.

Some providers may process data outside the European Economic Area. Where required, we use appropriate safeguards such as an adequacy decision or standard contractual clauses.

We keep data for as long as needed to provide the service, meet legal duties and resolve disputes. Public calculator requests are not linked to an account unless you sign in.

Your rights

Depending on your location, you may ask for access, correction, deletion, restriction or a copy of your personal data. You may also object to some processing. Email contact@cbamdata.eu to make a request. You may also complain to your local data protection authority.

Complaints and automated decisions

You may complain to the Commission Nationale de l'Informatique et des Libertés or the data protection authority where you live. We do not make decisions about you solely by automated means that produce legal or similarly significant effects.

Changes

We may update this policy when the service or the law changes. The date above shows the current version.