In short
- We collect only what we need to answer enquiries and run the platform. We do not sell personal data or use it for advertising.
- The public website sets no cookies and runs no analytics or tracking.
- Emissions and company data you load into the platform belong to your organisation; we process it only to provide the service.
- You can ask to see, correct or delete your personal data at any time by writing to business@thewmad.com.
01Who we are
MintCarb™ is a carbon intelligence platform built and operated by MintCarb Pvt. Ltd. (“MintCarb”, “we”, “us”), a company incorporated in India. For personal data we decide how to use — such as website enquiries and platform user accounts — we are the data controller (a “data fiduciary” under India’s Digital Personal Data Protection Act, 2023).
02What this policy covers
This policy applies to:
- the public website at mintcarb.com, including the briefing request form;
- the MintCarb platform and its portals, used by client organisations, their team members and verifiers; and
- emails and other communications we exchange with you about MintCarb.
Where your organisation has a separate written agreement with us, that agreement also applies and takes precedence for the data it covers.
03Personal data we collect
When you request a briefing on mintcarb.com
- First and last name, work email address and company name;
- optional details you choose to give: country, industry, area of interest and your message;
- for security, a one-way keyed fingerprint of your IP address (not the address itself) and your browser’s user-agent string, used to block spam and abuse.
When you use the MintCarb platform
- Account details: name, work email, role, organisation, and a securely hashed password;
- optional multi-factor authentication settings;
- records of actions you take, kept in audit trails so changes to carbon data can be traced;
- technical data needed to run and secure the service, such as request logs and IP addresses.
When you contact us directly
The details in your email or WhatsApp message, and our reply.
We do not ask for, and ask you not to send, sensitive personal data such as health, financial account or government identity numbers.
04How we use it, and why
| Purpose | Data used | Basis |
|---|---|---|
| Respond to a briefing request and arrange a meeting | Enquiry details | Your consent when you submit the form; our legitimate interest in replying |
| Provide, maintain and support the platform | Account and usage data | Performance of our contract with your organisation |
| Keep the website and platform secure, and prevent spam and misuse | IP fingerprint, logs, audit trails | Legitimate interest; legal obligations |
| Send service messages (invitations, password resets, report and verification notices) | Name, email | Performance of contract |
| Meet legal, tax and regulatory obligations | Records we are required to keep | Legal obligation |
We do not sell personal data, use it for advertising, or build marketing profiles. We will only send marketing emails if you have asked to receive them, and every such email lets you opt out.
05Data you load into the platform
Emissions records, energy, water and waste figures, facility details, evidence documents and reports that client organisations enter into MintCarb belong to that organisation. For this data we act on the organisation’s instructions (as a data processor), use it only to provide the service, and keep each organisation’s data separated from every other organisation’s at the database level.
Accredited verifiers engaged by an organisation can see that organisation’s data only within the verification engagements they are assigned to.
06AI features
Some platform features use AI models to draft report commentary, answer questions and highlight anomalies. To do this, the relevant excerpts of your organisation’s data are sent to AI model providers through OpenRouter and Groq. We send only what a feature needs, do not send passwords or payment details, and AI-drafted report commentary is checked against your data and must be approved by a person in your organisation before it is published.
AI providers process this data under their own terms, which may allow them to keep requests for a limited time for safety and abuse monitoring. We do not use your data to train our own models.
08Where your data is stored
Platform and website data is stored on servers in Germany. Some providers listed above process data in other countries. Where personal data leaves the country it was collected in, we rely on the safeguards required by the applicable law — including contractual commitments from the provider — and do not transfer data to any country restricted by the Government of India.
09How long we keep it
- Briefing requests: 12 months from submission, then deleted.
- Platform accounts and client data: for the duration of the subscription, then available for export for 30 days, and deleted within 90 days of the subscription ending unless the organisation asks us to keep it or the law requires us to.
- Audit trails and security logs: as long as needed to keep reported figures traceable and the service secure, or as required by law.
10How we protect it
- Encrypted connections (HTTPS) for the website and platform;
- passwords stored only as Argon2id hashes, with multi-factor authentication available;
- row-level separation of each organisation’s data in the database, and role-based access within it;
- servers reachable only through a hardened gateway, with rate limits and abuse protection on public forms;
- audit trails of changes to carbon data and access restricted to authorised MintCarb personnel and our technical partner’s engineers under contract.
No system is completely secure. If a personal data breach affects you, we will notify you and the relevant authorities as the law requires.
11Your rights
Depending on where you are — including under India’s DPDP Act, Singapore’s PDPA and, for people in the EU or UK, the GDPR — you can:
- ask what personal data we hold about you and how we use it;
- ask us to correct, complete or update it;
- ask us to delete it, where we no longer need it or you withdraw consent;
- withdraw consent you have given, at any time, without affecting what was done before;
- object to or ask us to restrict certain processing, and receive a copy of your data in a portable format where applicable;
- nominate another person to exercise your rights if you die or become unable to (India);
- complain to us, and to your data protection authority if you are not satisfied with our response.
Write to business@thewmad.com from the email address linked to your data. We may ask you to confirm your identity, and we respond within 30 days. If you use MintCarb through your employer, some requests about platform data may need to go through your organisation’s administrator.
12Children
MintCarb is a business service. It is not directed at anyone under 18, and we do not knowingly collect their personal data. If you believe a child has given us personal data, contact us and we will delete it.
14Changes to this policy
We will update this policy when our practices change and show the new date at the top. If a change materially affects how we use personal data, we will tell platform users by email or in the platform before it takes effect.
15Contact and grievances
For privacy questions, requests or complaints, contact our Grievance Officer. We acknowledge every request and aim to resolve it within 30 days.
MintCarb Pvt. Ltd.
#201, Venkateswara Grand Apartments, 1/5 Line Ramannapet, Koritepadu, Guntur, Amaravati, Andhra Pradesh, India - 522007
Grievance Officer: business@thewmad.com