Privacy Policy

Last updated: 17 July 2026

Uncovered Carbon is operated from New Zealand and handles personal information in accordance with the Privacy Act 2020.

What we collect

• Account information: your email address and a salted hash of your password (we cannot see your password).
• API usage metadata: for each API request, the key used, endpoint, timestamp, response status and timing — collected for metering, billing and abuse prevention. Request and response bodies are not stored.
• Emails we send: verification, password-reset and operational emails, delivered via our email provider.

We do not collect payment card details ourselves; when paid billing launches it will be processed by Stripe, which handles card data under its own terms.

What we don’t do

We don’t sell personal information. We don’t use it for advertising. We don’t collect more than the service needs to run.

Who processes it

Infrastructure and data storage: Cloudflare (global edge network; data stored in Cloudflare’s D1/R2 services). Transactional email: Resend. Payments (when live): Stripe.

Retention

Account information is kept while your account exists. API usage metadata is kept for billing history and is periodically aggregated and pruned. If you close your account, we delete account records within a reasonable period, except records we must keep for tax or legal purposes.

Your rights

Under the Privacy Act 2020 you may request access to, or correction of, the personal information we hold about you — email sales@uncoveredcarbon.com. You may also complain to the Office of the Privacy Commissioner (privacy.org.nz).

Changes

We’ll post updates here and note material changes by email to account holders.