Privacy policy

• Zoa López Pastó
• NIF: 53399459Z
• Email: [email protected]

Data you give us when you sign up and use the platform:

• name, work email and password (stored hashed, never in plain text);
• consultancy name, if any;
• company details: name, country, sector, headcount, revenue, sites and group structure;
• the documents you upload (bills, receipts, spreadsheets and similar) and the activity data read from them;
• the reports, questionnaires and texts you create or complete.

Technical data: IP address and the server logs needed for security, and the session cookie.

We do not use analytics, advertising or tracking tools.

• Providing the service: creating and managing your account, reading the documents you upload, calculating emissions and generating reports. Legal basis: performance of the contract (Art. 6(1)(b) GDPR).
• Security and abuse prevention: technical logs, locking after failed sign-in attempts and review of new sign-ups. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
• Service messages: technical or administrative notices about your account. Legal basis: performance of the contract.
• Legal obligations, such as tax and accounting rules once there is billing. Legal basis: legal obligation (Art. 6(1)(c) GDPR).

We do not send marketing messages without your prior consent.

To read the documents you upload and to power the assistant we use Mistral AI models hosted in the European Union. The AI reads the document and proposes the data; the calculations are made by code with official factors, and a person confirms every record. We make no automated decisions with legal effects on anyone (Art. 22 GDPR).

We do not sell or share your data. Only the providers we need to run the service have access, as processors under a contract that meets Art. 28 GDPR:

• Hetzner Online GmbH (Germany): hosting of the platform, database and documents.
• Mistral AI (France): document reading and assistant.

If you work with a consultancy, it can access the data of the companies it manages. We may also disclose data to authorities when the law requires it.

Data is stored and processed inside the European Economic Area. We make no international transfers.

• Account and company data: while the account is active. If you close it, we delete it within 30 days, except what the law requires us to keep.
• Uploaded documents: while the account is active or until you delete them.
• Security logs: only as long as needed to keep the service secure.
• Billing data: the legal period (6 years, Spanish Commercial Code).

The documents you upload may contain other people's data (for example names on invoices or travel records). For that data, the customer company is the controller and EtherGreen acts as its processor, as set out in the Terms of service. The customer company must have a legal basis to upload it.

• encrypted connection (HTTPS) and hashed passwords;
• protected session cookie that browser scripts cannot read;
• role-based access and separation of each company's data;
• temporary lock after several failed sign-in attempts;
• backups.

You can exercise your rights of access, rectification, erasure, objection, restriction and portability at any time by writing to [email protected]. We will reply within one month.

If you think we have not handled your request properly, you can complain to the Spanish Data Protection Agency (www.aepd.es).

The platform is meant for companies and professionals, not for minors.

We may update this policy. We will tell registered users about important changes, and the date of the last update is shown on this page.