Privacy Policy

Last updated: September 12, 2025

Introduction

This Privacy Policy explains how Stellarcarbon collects, uses, and protects your personal data when you use our services. We are committed to protecting your privacy and complying with the General Data Protection Regulation (GDPR) and other applicable laws. This Privacy Policy applies universally to all users, with no special treatment for EU or non-EU residents, though we may distinguish between consumers and business users where necessary for compliance.

Our services, including the dApp, HTTP API, and Soroban smart contracts, involve minimal personal data collection. We do not use cookies but rely on browser local storage for functionality. Data submitted to the Stellar Network is permanent and cannot be modified or removed.

Reading the Terms of Use first will help you understand the terminology used in this Privacy Policy. If you have questions, contact us at [email protected].

Legal Basis for Processing

We process personal data on the following legal bases under the General Data Protection Regulation (GDPR). This ensures that all processing activities are lawful and transparent.

Legal Obligation: We process data to comply with tax requirements, such as VAT records and the retention of transaction and geolocation data.

Legitimate Interests: We process data for security purposes, such as logging IP addresses, and for analytics through Plausible, as well as for service delivery, including Stellar Account identification.

Consent: We process data for optional features like invoice requests or personal certificates, that require sharing your name and email. If you do not wish to use these features, you do not need to provide us with your personal data.

We do not engage in automated decision-making or profiling with legal effects.

Data We Collect

We collect only the data necessary to provide our services, comply with legal obligations, and ensure security. The following categories outline what we gather and why it is essential.

Identification Data: Your Stellar Account address, used to uniquely identify you as a recipient for CARBON sinking and CarbonSINK issuance.

Contact Data: Name and email address, collected during recipient registration for communication and certificate issuance.

Transaction Data: Stellar Transaction IDs and related details, such as the amount sunk and the amount paid, stored for auditability and tax compliance.

Geolocation and Access Data: IP addresses, Cloudflare CF-IPCountry headers, and device fingerprints, logged for security and VAT compliance. Currently, we store full IP addresses, but we are investigating anonymization options for long-term storage.

Self-Declared Data: Country of establishment or residence, provided during recipient registration.

Invoice Data: Name, address, VAT number (with VIES verification for EU users), and business details, only if you request an invoice. This is optional for consumers and business users, and the VAT number and other business details can only be provided by business users.

Analytics Data: Anonymous usage data via Plausible Analytics, which uses a cookieless, compliant tracking approach using local storage for aggregate statistics like page views and device types.

Local Storage Data: Browser local storage for session management, preferences, and Plausible analytics. This data is non-personal.

How We Use Your Data

We process data for specific purposes, ensuring each use is justified and limited to what is necessary. Below, we detail how your data supports our operations.

Service Delivery: We use data to identify recipients via Stellar Account addresses, process sinking transactions, and issue certificates.

Compliance: We use data to verify country of residence for VAT, with geolocation logs as supporting evidence. Business users’ VAT numbers are verified via VIES for EU compliance.

Security: We use data to log access details, such as IP addresses and device fingerprints, to prevent abuse.

Analytics: We use anonymous tracking via Plausible to improve services. This does not involve individual profiling.

Certificates and Invoices: We use name and email for retirement certificates. We use invoice data for billing requests.

Data Retention

We retain data only as long as necessary for the stated purposes or to meet legal requirements. Below, we explain the retention periods for each category.

Transaction and Identification Data: This data is retained indefinitely on the Stellar Network, which is public and immutable. For tax purposes, we retain basic records for 7 years and cross-border EU data for 10 years.

Contact and Invoice Data: This data is retained for 7 to 10 years per tax obligations, or until no longer needed for certificates or invoices.

Geolocation and Access Data: This data is retained for 30 days for full IP addresses due to security needs. For long-term tax records, we use full IP addresses, but we are investigating anonymization for GDPR compliance.

Analytics Data: This data is aggregate only and retained per Plausible’s policy. It is anonymized, with no personal retention.

Local Storage Data: This data is retained until cleared by your browser.

Data is deleted or anonymized when no longer needed, with backups to prevent loss while enabling deletion after retention periods.

Data Sharing and Transfers

We share data only when necessary and with appropriate safeguards. Below, we detail our sharing practices.

Verra: Name and email for certificate issuance; Verra’s privacy policy at verra.org/privacy-policy applies.

Twilio Inc.: Email addresses when we send you automated emails; Twilio’s privacy policy at twilio.com/legal/privacy applies.

Plausible Analytics: Anonymous data for web tracking; Plausible’s privacy policy at plausible.io/privacy applies.

Plausible is GDPR-compliant because it does not use cookies and collects only anonymous, aggregate data for website visitors, focusing on trends without tracking personal information, all stored on EU servers. Compliance is maintained through GDPR-friendly practices, including using services like hCaptcha and ensuring data never leaves the EU, aligning with user privacy rights.

Legal Requirements: We may share data with authorities for tax or regulatory compliance (e.g., Belastingdienst).

Cloud infrastructure: the dApp and API are hosted in an EU datacenter, operated by DigitalOcean. International transfers use GDPR safeguards, detailed in the Data Processing Agreement (digitalocean.com/legal/data-processing-agreement).

No data is shared for marketing or sold.

Your Rights

Under GDPR, you have rights to access, rectification, erasure, restriction, portability, objection, and withdrawal of consent. Contact us at [email protected] to exercise them (response within 1 month). Note: immutable Stellar Network data cannot be erased (GDPR Article 17(3)(b) exception). You may lodge complaints with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl.

Security

We implement appropriate technical and organizational measures (e.g., encryption, access controls) to protect data from unauthorized access, loss, or disclosure. We notify you and authorities of breaches as required by GDPR.

Data Protection Officer

As a small sole proprietorship, we are not required to appoint a Data Protection Officer under GDPR Article 37, but privacy inquiries can be directed to [email protected].

Children’s Data

Our services are not directed to children under 13, and we do not knowingly collect their data. Minors under 18 require parental consent.

Changes to This Privacy Policy

We may update this Privacy Policy, with changes posted on our website or dApp and notified via email where required. Continued use of our services constitutes acceptance of this Privacy Policy.

Contact Information

For questions or to exercise your rights, contact us at [email protected].