CRBON LABS INC.
CRBONFREE
PRIVACY POLICY

Last Updated: October 8, 2026

This Privacy Policy explains how Crbon Labs Inc. ("Crbon Labs," "we," "us," or "our"), located in Calgary, Alberta, Canada, collects, uses, discloses, retains, and protects personal information in connection with CrbonFree, our centralized AI usage monitoring and environmental impact platform (the "Service").

This Privacy Policy applies to:
   - the CrbonFree web application and dashboard at https://dashboard.crbonfree.com and our related websites;
   - the CrbonFree Microsoft 365 app, which includes a personal tab available in supported Microsoft 365 clients (such as Microsoft Teams and Outlook) and the "CrbonFree" declarative agent for Microsoft 365 Copilot;
   - the CrbonFree remote Model Context Protocol ("MCP") server at https://api.crbonfree.com/mcp;
   - the CrbonFree browser extension;
   - the crbon command-line tool's usage sync to CrbonFree; and
   - CrbonFree APIs, SDKs, and the third-party integrations ("Connections") described below.

Your use of the Service is governed by our Terms & Conditions at https://dashboard.crbonfree.com/terms, which are a separate document. This Privacy Policy does not modify those Terms.

1. WHO IS RESPONSIBLE FOR YOUR INFORMATION
Crbon Labs is responsible for personal information we collect to operate CrbonFree accounts, billing, security, and support.

Many CrbonFree customers are organizations. When an organization connects its own systems to CrbonFree (for example, a Microsoft 365 tenant, cloud AI platform, or AI provider account), the usage records we import may relate to that organization's employees or other users. In that case, we process those records on behalf of, and according to the instructions of, the organization that created the Connection, and that organization is responsible for having the authority and any notices or consents required to share the data with us. If you are an employee or user of such an organization, you may also contact your organization's administrator with questions about its use of CrbonFree.

2. INFORMATION WE COLLECT

a) Account and Organization Information
We use Clerk to provide sign-in and account management. When you create or use an account, we receive and store your name, email address, Clerk user identifier, account type, and, if provided, company name. We also store the CrbonFree organizations you belong to, your role in each organization (for example, administrator or member), and related membership identifiers. CrbonFree does not collect or store your password; passwords, if used, are handled by Clerk.

If you choose a third-party sign-in option, such as Sign in with Microsoft, the identity provider shares basic profile information with Clerk, such as your name, email address, and account identifier. Signing in to CrbonFree with a Microsoft account does not give CrbonFree access to your organization's Microsoft 365 data. Access to Microsoft 365 Copilot usage data requires a separate organization connection authorized by a Microsoft tenant administrator, as described in Section 5.

b) Connection Credentials and Configuration
When an organization administrator creates a Connection, we store the information needed to operate it, such as:
   - API keys or administrative credentials issued by AI providers, which are stored encrypted;
   - OAuth access and refresh tokens, where the integration uses them, which are stored encrypted;
   - the email address and account identifier of the account used to authorize an OAuth Connection;
   - provider configuration, such as cloud project or account identifiers, Amazon Web Services role and log-bucket configuration, or a Microsoft 365 tenant identifier; and
   - connection status, synchronization progress, and diagnostic information.

c) AI Usage Data
"Usage Data" means metadata about AI usage, such as provider, model identifier, token counts where available, request or prompt counts, timestamps, project and workload identifiers, and, for some sources, identifiers of the users, sessions, or applications associated with that usage. Section 3 describes the Usage Data collected from each type of source. Where a source does not report token counts, CrbonFree uses modeled estimates.

d) Derived Estimates and Reports
We generate and store estimates and records derived from Usage Data, including estimated costs, energy consumption, carbon emissions (CO2e), and water consumption, together with the methodology and factor versions used, carbon statements, receipts, audit packs, and trust badges or certificates where your plan includes them.

e) Billing Information
Payments for paid plans are processed by Stripe through Stripe's secure payment interface embedded in the CrbonFree web application. Card and payment details are entered into and processed by Stripe; CrbonFree does not receive or store full payment card numbers. We store Stripe customer, subscription, payment-method, and invoice references, your plan, billing period, and invoice and usage amounts. If your organization purchases through a cloud marketplace that CrbonFree supports for billing, we receive the subscription and account information that marketplace provides to link the purchase to your organization.

f) Technical, Security, and Log Information
When you use the Service, we and our infrastructure providers automatically receive technical information such as IP address, browser and device information, request metadata, and error logs. We record security-relevant account activity, such as connection, membership, and account changes, in audit logs that may include the acting user and IP address. See Section 10 for website analytics.

g) Communications
If you contact us, submit a bug report or recalculation request, or otherwise communicate with us, we keep the content of that communication and your contact details.

3. INFORMATION FROM CONNECTIONS AND PRODUCTS
CrbonFree aggregates Usage Data from multiple sources into one place. The sources available to you depend on the Connections your organization creates and the products you use.

a) AI Provider API-Key Connections
For server-side Connections that use an API key or administrative credential (for example, OpenAI, Anthropic, OpenRouter, Vercel AI Gateway, and Cloudflare AI Gateway, as available), CrbonFree calls the provider's usage or reporting interfaces to retrieve Usage Data such as token counts, model identifiers, request volumes, costs where reported, and timestamps. These Connections are used solely to retrieve usage and cost information; CrbonFree's server-side API-key integrations do not request or store prompts, outputs, or training data.

b) Amazon Bedrock
For Amazon Bedrock, CrbonFree reads Amazon CloudWatch usage metrics and, where the organization deploys the CrbonFree-provided AWS CloudFormation stack, Bedrock model invocation logs. The stack grants CrbonFree a cross-account role and configures Bedrock model invocation logging into a bucket in the customer's AWS account with text, image, and embedding data delivery disabled. CrbonFree extracts model identifiers, token counts, and timestamps from these sources. If a customer separately changes its logging configuration to include content, CrbonFree's ingestion still reads only usage fields and does not store prompt or response content.

c) Google Cloud (Gemini Enterprise Agent Platform)
The Google Cloud Connection is described in Section 9, which includes our Google API Services User Data Policy and Limited Use disclosures.

d) Microsoft Azure AI Foundry
For the Microsoft Azure AI Foundry Connection, a user authorizes CrbonFree through Microsoft's sign-in and consent screen. CrbonFree receives OAuth tokens and the authorizing account's identifier and email address, and uses them to read Azure usage metrics, such as token counts, model or deployment identifiers, and timestamps, for the resources that account can access. OAuth tokens are stored encrypted.

e) Microsoft 365 Copilot (Organization)
The Microsoft 365 Copilot organization Connection is described in Section 5.

f) Local Coding Agents (crbon command-line tool)
If you install the crbon command-line tool and sync it to CrbonFree, it uploads structured usage records for supported local coding agents, including agent, session and slice identifiers, model, provider, token counts (reported or estimated), request counts, and timestamps. These records are attributed to your CrbonFree user account within the selected organization. The usage-import interface used for emissions reporting accepts only these usage fields and does not accept prompt or response text.

g) Browser Extension
The CrbonFree browser extension is described in Section 8.

4. HOW WE USE INFORMATION
We use personal information to:
   - provide, operate, and maintain the Service, including authentication, organizations, roles, and Connections;
   - import, aggregate, and display AI Usage Data and calculate estimated costs, energy, carbon emissions, and water consumption;
   - generate statements, receipts, audit packs, and trust badges or certificates where your plan includes them;
   - process payments, manage subscriptions, and send transactional emails, such as plan, renewal, and cancellation notices;
   - secure the Service, prevent fraud and abuse, troubleshoot, and maintain audit logs;
   - respond to support requests and communications;
   - measure product adoption using limited, organization-level product milestones (see Section 10);
   - create aggregated and anonymized statistics as described in Section 11; and
   - comply with legal obligations and enforce our Terms.

We do not sell personal information, and we do not use personal information or customer Usage Data to serve targeted advertising. We do not use customer Usage Data to train artificial intelligence models.

5. MICROSOFT 365 APP AND MICROSOFT 365 COPILOT DATA
This section describes the CrbonFree Microsoft 365 app and the optional Microsoft 365 Copilot (Organization) Connection.

a) The CrbonFree Microsoft 365 App
The CrbonFree Microsoft 365 app is published by Crbon Labs. It contains:
   - a personal tab, available in supported Microsoft 365 clients such as Teams and Outlook, that displays CrbonFree web content. Depending on the client, signing in and the CrbonFree dashboard may open in your web browser rather than inside the tab; and
   - the "CrbonFree" declarative agent for Microsoft 365 Copilot, described in Section 6.

The personal tab uses Microsoft's client library only to load correctly inside Microsoft 365 clients. It does not use Microsoft 365 single sign-on and does not request your Microsoft 365 profile, mailbox, files, chats, or tenant data. You sign in to CrbonFree through CrbonFree's own sign-in (Clerk), as described in Section 2(a).

Installing the CrbonFree Microsoft 365 app does not create a paid subscription and does not give CrbonFree access to your organization's Microsoft 365 data.

b) Signing In Versus Connecting a Microsoft 365 Organization
Signing in to CrbonFree, including with a Microsoft account, only identifies you to CrbonFree. Importing Microsoft 365 Copilot usage is a separate, optional step in which a CrbonFree organization administrator starts a Microsoft 365 Copilot (Organization) Connection and a Microsoft tenant administrator grants permission.

c) Tenant Administrator Authorization
To create the Connection, a Microsoft account holding an administrator role that can grant tenant-wide consent (Global Administrator, Privileged Role Administrator, Cloud Application Administrator, or Application Administrator) signs in through Microsoft and approves the Office 365 Management APIs application permission "ActivityFeed.Read" ("Read activity data for your organization") for the whole tenant. CrbonFree verifies the administrator role reported by Microsoft and rejects the Connection otherwise. A Microsoft 365 tenant can be connected to only one CrbonFree organization at a time.

From this sign-in, CrbonFree stores the Microsoft tenant identifier, the date of consent, the granted permission, and the consenting administrator's Microsoft object identifier and email address. CrbonFree does not store Microsoft access or refresh tokens for this Connection. Each time it imports data, CrbonFree obtains a short-lived application access token for your tenant from Microsoft using CrbonFree's own application credentials, and does not persist that token.

d) What CrbonFree Retrieves from Microsoft
CrbonFree uses the Office 365 Management Activity API to read audit content of the "Audit.General" content type for your tenant. If that content subscription is not active, CrbonFree starts it for your tenant, and restarts it if it is later disabled while the Connection is active. On connection, CrbonFree imports up to the most recent 14 days that Microsoft makes available, then imports new activity daily.

Audit content received from Microsoft can include records for many types of activity in your tenant. CrbonFree processes these records in memory during import, keeps only records of the "CopilotInteraction" type that contain at least one prompt, and discards all other records without storing them.

e) What CrbonFree Stores for Each Copilot Interaction
For each retained Copilot interaction record, CrbonFree stores:
   - the Microsoft tenant identifier and Microsoft's audit record identifier;
   - the Microsoft user identifier and user principal name (typically the user's work email address), as reported by Microsoft;
   - the interaction timestamp;
   - the Microsoft 365 app or surface where Copilot was used (for example, Teams, Outlook, Word, or Copilot Chat) and conversation or thread identifiers;
   - message identifiers and the number of prompts in the interaction;
   - the model name, where Microsoft discloses it;
   - whether Copilot accessed resources during the interaction, recorded only by resource type and action; and
   - modeled estimates derived from the record, including estimated tokens, energy, carbon emissions, and water consumption, with the methodology and factor version used.

CrbonFree also stores a copy of the audit record as received from Microsoft, with the following removed or reduced before storage: the client IP address is removed, and the details of resources Copilot accessed (such as resource names, identifiers, and locations) are reduced to resource type and action. Other fields that Microsoft includes in the record are retained in that copy and may include, for example, identifiers of the context in which Copilot was invoked, plugin or agent identifiers, licensing information, and other metadata Microsoft provides.

Microsoft's CopilotInteraction audit records describe interactions and do not contain the text of prompts or responses. CrbonFree does not request, and its ingestion does not store, prompt or response text for Microsoft 365 Copilot.

Microsoft 365 Copilot records do not include token counts. CrbonFree estimates token usage, energy, carbon emissions, and water consumption from the number of prompts and the type of interaction using modeled factors. These figures are estimates, not measurements.

f) Who Can See Microsoft 365 Copilot Data in CrbonFree
Microsoft users in the connected tenant are not automatically CrbonFree users and are not linked to CrbonFree accounts. Within the CrbonFree organization that owns the Connection:
   - administrators can view organization-wide Copilot usage, a per-person list identified by Microsoft email address, and individual interaction rows with their estimates; and
   - members can view Copilot usage attributed to the email address of their own CrbonFree account.
Organization-level totals that include Copilot usage may also appear in organization-wide usage summaries available to members, including through the Copilot agent described in Section 6.

g) Disconnecting and Revoking Access
A CrbonFree organization administrator can disconnect the Microsoft 365 Connection from the CrbonFree dashboard. Disconnecting stops new imports and clears the stored consenting-administrator identifier and email address. Disconnecting does not remove CrbonFree's consent from your Microsoft tenant and does not stop the Audit.General subscription that CrbonFree may have started. To revoke CrbonFree's access completely, a Microsoft tenant administrator should remove or disable the CrbonFree application under Enterprise applications in Microsoft Entra ID.

Copilot usage records already imported are retained after disconnection so that previously generated reports and estimates remain available, unless deletion is requested as described in Section 13.

6. MICROSOFT 365 COPILOT AGENT AND MCP SERVER
The "CrbonFree" declarative agent lets you ask Microsoft 365 Copilot questions about your CrbonFree data. Microsoft 365 Copilot provides the language model and conversation; CrbonFree provides data through its remote MCP server at https://api.crbonfree.com/mcp.

a) Authentication and Authorization
The first time the agent needs your CrbonFree data, you are asked to sign in to CrbonFree through an OAuth 2.1 authorization flow operated by our authentication provider, Clerk. Microsoft stores the resulting access token and sends it with each request to the CrbonFree MCP server. CrbonFree verifies the token on every request and identifies you as your CrbonFree user. The token does not grant access to your Microsoft 365 data.

b) Organization-Scoped Access
Each data request names a CrbonFree organization, and CrbonFree returns data only if you are a member of that organization. Organization members can retrieve that organization's data through the agent, regardless of their administrator or member role. Some information, such as trust badges and certificates, is available only on paid plans.

c) Information Returned to Copilot
Depending on your question, the CrbonFree MCP server may return: the organizations you belong to and your role; organization or project usage summaries, including token counts, estimated costs, emissions, energy, and water; projects; Connections, including provider, status, and the email address of the account used to authorize a Connection; billing periods, carbon statements, and carbon offset receipts; plan and pricing information; Connection setup guidance; and a short-lived link to your trust badge and certificate panel. The MCP server does not return per-person Microsoft 365 Copilot interaction records.

d) Read-Only Tools
The CrbonFree MCP tools are read-only. They do not create, change, or delete CrbonFree data, Connections, or subscriptions, and they cannot make purchases. Changes, Connections, and billing are performed in the CrbonFree web application.

e) Processing by Microsoft
When you use the agent, Microsoft processes your prompts, the information CrbonFree returns to Copilot, and Copilot's responses as part of the Microsoft 365 Copilot service, under your organization's agreements with Microsoft and Microsoft's privacy terms. Crbon Labs does not control Microsoft's processing. CrbonFree receives the tool requests Copilot makes on your behalf, such as the organization, project, and date range requested, but does not receive the full Copilot conversation.

7. ORGANIZATIONS, ROLES, AND ACCESS
CrbonFree data is organized by organization. You may belong to more than one organization, and you can access an organization's data only according to your role in it. Organization administrators can manage members, Connections, API keys, projects, billing, and organization-wide views. Members can view organization data made available to members and their own personal usage views. Organization administrators may be able to see information about members' usage attributed to them within that organization.

8. CRBONFREE BROWSER EXTENSION
This section applies when you install and use the CrbonFree browser extension on supported AI chat services, currently ChatGPT, Claude, and Gemini.

a) Data the Extension Processes
To provide its in-page AI-usage and environmental-estimate features, the extension processes the rendered text of the current chat and, where supported, the text of attachments available within that chat. This processing occurs locally in your browser to calculate token estimates. The extension does not store raw chat text or attachment text in Chrome extension storage and does not send raw prompt, response, or attachment text to Crbon Labs.

The extension stores locally the minimum metadata needed to display and maintain usage estimates, including the supported provider, provider conversation and message identifiers, message role, model identifier, token counts, timestamps, estimated usage and emissions data, extension settings, and—when you sign in—the selected organization, project, and CrbonFree account identifier. The extension processes only the supported AI-chat pages needed for this functionality; it does not access general browser history, unrelated websites, mouse movement, scrolling, clicks, or keystrokes.

b) Authentication and Technical Data
The extension uses Clerk to synchronize your CrbonFree web-app session. Clerk session cookies and short-lived authentication tokens are used only to determine sign-in state and authenticate requests. The extension does not collect your CrbonFree password. When the extension communicates with Crbon Labs or Clerk over HTTPS, our services and infrastructure providers may receive technical information such as IP address, browser/device information, and request logs for security, fraud prevention, reliability, and service operation, as described in Section 10.

c) Usage Reporting and Service Providers
If you are signed in and select an organization or project as the destination for browser-extension usage, the extension sends usage metadata to Crbon Labs to save that usage under your selected organization and project. This metadata may include provider and conversation/message identifiers, model identifiers, token counts, message roles, timestamps, and the selected organization/project identifiers. It does not include raw chat or attachment text.

Crbon Labs uses Clerk to provide authentication and session synchronization. Crbon Labs and its service providers process browser-extension data only as necessary to provide, secure, maintain, and support CrbonFree, including the service providers listed in Section 12. Crbon Labs does not sell browser-extension data or use it for advertising, behavioral profiling, creditworthiness, or lending.

d) Limited Use
Crbon Labs uses browser-extension data only to provide and improve the user-facing AI-usage tracking, reporting, and environmental-estimation features described in this Policy. We transfer such data only when necessary to provide, maintain, secure, or support those features, to comply with applicable law, or as part of a merger, acquisition, or sale of assets. We do not use or transfer this data to serve personalized, retargeted, or interest-based advertising. We do not permit people to read raw chat or attachment content because the extension does not transmit that content to Crbon Labs; any exception would require your consent or another legally permitted basis.

e) Your Choices
You can stop local browser-extension processing by disabling or removing the extension and can remove locally stored extension data through your browser's extension data controls. Signing out stops authenticated browser-extension usage reporting to your CrbonFree organization or project. For requests concerning data held by Crbon Labs, contact hello@crbonfree.com.

9. GOOGLE USER DATA DISCLOSURES
This section describes how Crbon Labs handles Google user data when you use the "Connect Google Cloud" feature to connect Gemini Enterprise Agent Platform (formerly Vertex AI), including Gemini models, to CrbonFree for usage tracking. These disclosures apply when you choose to connect your Google Cloud account to CrbonFree. Users first sign in to CrbonFree and then connect their Google Cloud account through Google's authorization screen.

a) Google User Data We Access
When you authorize CrbonFree through Google's authorization screen, we may access:
   - Your Google account email address and stable Google account identifier returned by Google's authorization server.
   - Information about Google Cloud projects your connected Google account is authorized to access, including project IDs and project names.
   - Google Cloud Monitoring metrics related to Gemini Enterprise Agent Platform usage across accessible projects, including token counts, model identifiers, request volumes, and timestamps.
   - OAuth access and refresh tokens issued by Google, which allow CrbonFree to make subsequent read-only Google API requests on your behalf.

CrbonFree does not collect your Google password.

b) How We Use Google User Data
CrbonFree uses Google user data only to provide and operate the Google Cloud connection:
   - Google account email and identifier are used to identify the connected Google account, associate the connection with the correct CrbonFree account, display connection information, and support connection diagnostics.
   - Google Cloud project information is used to automatically discover the Google Cloud projects the connected account is authorized to access and determine where available Gemini Enterprise Agent Platform usage metrics can be retrieved. CrbonFree does not require you to select a single project; available projects are discovered and processed using read-only access.
   - Cloud Monitoring metrics are used to calculate and display Gemini Enterprise Agent Platform usage, token consumption, estimated costs, estimated energy consumption, and estimated carbon emissions.
   - OAuth access and refresh tokens are used only to authenticate read-only requests to supported Google Cloud APIs.

CrbonFree does not use Google user data to run model inference, train artificial intelligence models, modify Google Cloud projects, modify monitoring settings, or serve advertising.

c) Sharing, Transfer, and Disclosure of Google User Data
CrbonFree does not sell, rent, or share Google user data for advertising or marketing purposes.

Google user data may be processed by service providers acting on behalf of Crbon Labs only as necessary to operate, secure, and maintain CrbonFree. These providers include:
   - Vercel, which hosts and delivers the CrbonFree frontend application.
   - Railway, which hosts the CrbonFree backend services and operational logs.
   - Amazon Web Services, including Amazon RDS, which provides managed database infrastructure used to store application and connection data.
   - Cloudflare, which provides domain-name and DNS services and, where enabled, network delivery, proxy, and security services.

These providers process data only as necessary to provide infrastructure and operational services to CrbonFree and are subject to applicable confidentiality, privacy, and security obligations.

Crbon Labs may also disclose Google user data when required by applicable law, court order, subpoena, warrant, or other valid legal process. Where permitted, disclosure will be limited to the information reasonably necessary to comply with the request.

Crbon Labs does not otherwise disclose or transfer Google user data to unrelated third parties.

d) Protection of Google User Data
Crbon Labs uses technical and organizational safeguards designed to protect Google user data, including:
   - HTTPS/TLS encryption for data transmitted between users, CrbonFree, and Google.
   - Access-controlled database and hosting infrastructure with encryption at rest enabled.
   - Restricted access to OAuth credentials and Google user data for authorized backend services and personnel who require access to operate or support the service.
   - Access controls and secure credential-management practices.
   - Read-only and minimum-privilege Google authorization scopes.
   - Protection against unauthorized authorization requests through a state parameter and CSRF protections in the Google connection flow.
   - Operational logging practices designed to avoid recording raw OAuth access tokens, refresh tokens, authorization codes, or ID tokens.

CrbonFree does not collect or store Google passwords.

e) Retention and Deletion of Google User Data
CrbonFree retains Google user data only for as long as reasonably necessary to maintain the Google Cloud connection and provide the related usage, reporting, energy-estimation, and carbon-estimation features.
   - Users may disconnect their Google Cloud account through Settings - Connections.
   - Disconnecting disables CrbonFree's use of the stored OAuth credentials and stops CrbonFree from collecting new Google Cloud data for that connection. Users may separately revoke CrbonFree's authorization through their Google Account permissions page at https://myaccount.google.com/permissions.
   - Stored OAuth access and refresh tokens, Google account identifiers, and associated Google Cloud project information will be deleted or anonymized within thirty (30) days after disconnection or a verified deletion request, unless retention is required by applicable law. OAuth credentials are deleted rather than anonymized.
   - Historical imported usage records associated with a disconnected connection may be retained so previously generated reports and estimates remain available. Following a verified deletion request, identifiable historical usage records will be deleted or anonymized within thirty (30) days, unless retention is required by applicable law.
   - Users may request deletion of Google user data by contacting hello@crbonfree.com.
   - Residual copies may temporarily remain in secured backups until those backups expire under the applicable backup-retention schedule.
   - Aggregated or de-identified statistics may be retained only when they cannot reasonably identify a user, Google account, or Google Cloud project and are used to provide or improve CrbonFree's user-facing usage and environmental-estimation features.

CrbonFree's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

10. WEBSITE ANALYTICS, PRODUCT ANALYTICS, AND COOKIES
When you access our websites and applications, we and our infrastructure, hosting, and content-delivery providers (including Cloudflare) may automatically collect limited technical and usage information - such as pages visited, links clicked, referring website, approximate location, device type, browser type, and IP address - for analytics, security, fraud prevention, and service-improvement purposes. We use privacy-preserving, cookieless analytics and do not use this information to personally identify you or to serve targeted advertising. You may further limit collection through your browser settings. Where required by applicable law (including the GDPR and CCPA), you may exercise your rights, including opting out of certain processing, by contacting us at support@crbonlabs.com.

Our backend also sends a small set of product milestone events (such as an organization signing up, connecting a provider, first detecting usage, starting a paid subscription, or creating a receipt) to PostHog. These events are keyed to the internal CrbonFree organization identifier and do not include names, email addresses, or Usage Data.

Our authentication provider (Clerk) and payment provider (Stripe) use cookies and similar technologies that are necessary to keep you signed in, secure your session, and process payments and prevent fraud.

11. AGGREGATED AND ANONYMIZED DATA
Crbon Labs may collect, use, and publish aggregated and anonymized benchmark data derived from Usage Data for research, reporting, and product improvement, provided such data cannot reasonably identify any User, individual, or customer organization.

12. HOW WE SHARE INFORMATION
We disclose personal information only as described in this Privacy Policy:
   - Within your organization: information is visible to other members of your CrbonFree organization according to their roles, as described in Sections 5(f) and 7.
   - Service providers: we use service providers that process information on our behalf to operate the Service, including Vercel (frontend hosting), Railway (backend services and operational logs), Amazon Web Services, including Amazon RDS (database infrastructure), Cloudflare (DNS, network delivery, and security), Clerk (authentication and account management), Stripe (payment processing and billing), Resend (transactional email delivery), and PostHog (limited product analytics, as described in Section 10). These providers may process information only as necessary to provide their services to us.
   - Third parties you connect: when you or your organization create a Connection, we exchange information with that provider (for example, Microsoft, Google, Amazon Web Services, or an AI provider) as needed to authenticate and retrieve Usage Data.
   - Microsoft 365 Copilot: when you use the CrbonFree agent, information CrbonFree returns is processed by Microsoft as described in Section 6(e).
   - Legal and safety: we may disclose information when required by law, court order, subpoena, warrant, or other valid legal process, or when reasonably necessary to protect the rights, property, or safety of Crbon Labs, our users, or others.
   - Business transfers: information may be transferred as part of a merger, acquisition, financing, or sale of assets, subject to this Privacy Policy.

We do not sell personal information or share it for cross-context behavioral advertising.

13. RETENTION AND DELETION
We retain personal information for as long as needed to provide the Service and for the purposes described in this Privacy Policy, unless a longer period is required or permitted by law.
   - Account and organization information is retained while your account or organization is active. When an account or organization is deleted, we mark it deleted, stop using it to provide the Service, and delete the corresponding identity from Clerk. Records may be retained afterward where required for legal, accounting, security, or dispute-resolution purposes.
   - When a Connection is disconnected, CrbonFree stops importing new data and clears stored API keys and OAuth tokens for that Connection. Usage Data and estimates already imported are retained so that previously generated reports, statements, and receipts remain available, unless deletion is requested.
   - Billing and invoice records are retained as required for accounting and tax purposes.
   - You or your organization administrator may request deletion of identifiable Usage Data, including Microsoft 365 Copilot records, by contacting us as described in Section 18. We will verify the request and the requester's authority over the relevant organization or Connection before acting on it.
   - Residual copies may temporarily remain in secured backups until those backups expire under the applicable backup-retention schedule.
   - Specific retention commitments for Google user data are stated in Section 9(e).

14. SECURITY
We use technical and organizational safeguards designed to protect personal information, including HTTPS/TLS encryption in transit, encryption of stored API keys and OAuth tokens, access-controlled database and hosting infrastructure, role-based access within organizations, and restricted access for authorized personnel and backend services. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

15. YOUR CHOICES AND RIGHTS
Depending on where you live, you may have rights to access, correct, delete, or obtain a copy of your personal information, to object to or restrict certain processing, to withdraw consent, and to complain to a data protection authority. You can update your profile through your account, disconnect Connections, and remove the browser extension at any time. To exercise your rights, contact us as described in Section 18. If your information was provided to CrbonFree by an organization (for example, Microsoft 365 Copilot usage records), we may refer your request to that organization and will assist it in responding. We will not discriminate against you for exercising your rights.

We process personal information in accordance with applicable privacy laws, which may include Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), the EU and UK General Data Protection Regulation (GDPR), and applicable U.S. state privacy laws such as the California Consumer Privacy Act (CCPA).

16. INTERNATIONAL TRANSFERS
Crbon Labs is based in Canada, and our service providers may process information in Canada, the United States, and other countries. Those countries may have data protection laws that differ from the laws where you live. Where required, we use appropriate safeguards for international transfers.

17. CHILDREN AND CHANGES TO THIS POLICY
CrbonFree is a business service and is not directed to children. We do not knowingly collect personal information from children.

We may update this Privacy Policy from time to time. We will post the updated version on this page and change the "Last Updated" date, and we will provide additional notice of material changes where required by law.

18. CONTACT US
For privacy questions, requests to access or delete personal information, or to exercise your rights, contact:

Crbon Labs Inc.
Calgary, Alberta, Canada
support@crbonlabs.com
hello@crbonfree.com