Privacy Policy

The controller of your personal data is:

• SAS STAAQ ENGINEERING
• 10 rue de Penthièvre, 75008 Paris, France
• French business ID (SIREN): 103 587 895
• Represented by its Chairman, Fabien Aupretre

Dedicated contact for personal data questions: rgpd@zerocarbonsquad.com.

Depending on your interaction with the site, we may collect:

• When you join the waitlist: first name, last name, email, postal code, acquisition source (LinkedIn, word of mouth, search, community).
• When you subscribe: first name, last name, email, postal address (billing), selected plan, and payment data processed directly by Stripe (we never store any credit card number).
• Navigation data: IP address, device and browser type, pages visited, date and time of visit (server logs, aggregated metrics).

Your data is processed for the following purposes:

• Execution of the subscription contract (account management, monthly capture, certificate, invoicing) — legal basis: performance of the contract (art. 6.1.b GDPR).
• Waitlist registration and sending of the Climate Guide — legal basis: consent (art. 6.1.a).
• Marketing communication ("Carbon Brief" newsletter, project news) — legal basis: consent, with one-click unsubscribe at any time.
• Legal and accounting obligations (invoicing, anti-money laundering, accounting retention) — legal basis: legal obligation (art. 6.1.c).
• Site improvement and security (logs, aggregated audience metrics) — legal basis: legitimate interest (art. 6.1.f).

Your data may be transmitted to the following subprocessors, each bound by a contract compliant with article 28 of the GDPR:

• Supabase Inc. — database (EU region for waitlist and subscription data).
• Stripe Payments Europe Ltd — credit card payment processing (established in Ireland, subject to the GDPR).
• Vercel Inc. — web hosting (USA, certified under EU-US Data Privacy Framework + standard contractual clauses).
• IONOS SARL — email and domain name (France).
• Brevo (formerly Sendinblue) SAS — transactional and marketing emails (France).

No data is sold to third parties for advertising purposes.

Some of our subprocessors (notably Vercel Inc.) are established in the United States. These transfers are framed by:

• EU-US Data Privacy Framework certification where applicable
• Standard contractual clauses approved by the European Commission
• Additional technical security measures (encryption in transit and at rest)

We keep your data only for as long as strictly necessary:

• Waitlist: until you unsubscribe, or automatic deletion after 3 years of inactivity.
• Active subscription data: for the entire duration of the subscription.
• Billing data: 10 years from the end of the contractual relationship (accounting obligations, art. L.123-22 of the French Commercial Code).
• Technical logs: 12 months maximum.

Under the GDPR, you have the following rights over your personal data:

• Right of access: obtain a copy of the data concerning you.
• Right of rectification: correct inaccurate data.
• Right to erasure ("right to be forgotten"): in cases provided for by law.
• Right to restriction of processing
• Right to portability: receive your data in a structured, machine-readable format.
• Right to object to processing, particularly for marketing.
• Right to withdraw your consent at any time, without affecting previous processing.

To exercise these rights: rgpd@zerocarbonsquad.com. We respond within one month maximum (extendable to three months for complex requests).

You also have the right to lodge a complaint with the French data protection authority, the CNIL (www.cnil.fr) if you believe your rights are not being respected.

The site uses only strictly necessary cookies for its operation (session, language preference). No advertising or profiling cookies are set without your consent.

We use anonymized audience metrics from Vercel Analytics, which do not set third-party cookies and do not track users across sites.

We implement appropriate technical and organizational measures to protect your data against unauthorized access, disclosure, alteration or destruction:

• TLS encryption across the entire site (HTTPS mandatory).
• Encryption at rest of the database.
• Strong authentication and limited data access.
• Continuous monitoring and security testing.

In the event of a data breach likely to cause a high risk to your rights, we undertake to notify you without delay, in accordance with article 34 of the GDPR.

This policy may be updated to reflect changes in our services or in regulations. The date at the top of the page indicates the last effective update. Any substantial modification will be notified to you by email.