Privacy Policy

EcoSphere Intelligence Limited ("EcoSphere", "we", "us", "our") is a company registered in Ireland, with its registered office at Athlone, Co. Westmeath, Ireland.

We provide EcoSphere Intelligence, a multi-tenant software platform for environmental, social, and health impact assessment lifecycle work. We operate globally and serve customers and users in the European Union, the United Kingdom, the United States, and other jurisdictions. This policy explains how we handle personal data and your rights in relation to it.

Our two roles

• As a controller. For data about our account holders, prospects, website visitors, and the administration of the Platform — for example registration details, billing data, support correspondence, and security logs — we decide why and how the data is processed. This policy governs that processing.
• As a processor. When a customer (a "tenant") uploads project documents, evidence, stakeholder information, or other content into their workspace, we process that content on the customer's instructions to provide the Platform. For that content the customer is the controller and we are the processor, governed by the Data Processing Agreement (DPA) (see Section 12), not by this policy. If your data appears inside a customer's workspace, contact that customer to exercise your rights; we will support them as required by the DPA and applicable law.

We do not seek to build behavioural profiles from digital footprints, social media, or surveillance sources, and we do not sell personal data. We do not intentionally collect special-category data about our account holders. Customer-uploaded content may contain personal data — and occasionally special-category or stakeholder data — about third parties; that content is handled under the DPA and the customer's instructions.

Where we rely on legitimate interests, we have assessed that our interests are not overridden by your rights and freedoms; you may ask about that assessment or object (see Section 8). Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.

The Platform uses third-party large-language-model providers to power the in-product assistant and document-generation features. When you use these features, the relevant prompt and context may be transmitted to a model provider listed in Section 6 to return a response.

• No training on your data. We instruct our model providers, by contract, not to use your prompts, inputs, or outputs to train their models. We do not use customer-uploaded content to train models.
• Human oversight. Generated output is working material for review by a competent professional, not an automated decision producing legal or similarly significant effects about you. We do not make solely automated decisions about individuals within the meaning of EU and UK GDPR Article 22.
• Lineage. Generated outputs are linked to the retrieval records and run metadata that produced them, so their provenance can be traced.

We share personal data only as needed to run the Platform and the business:

• Sub-processors and service providers that host, store, secure, and operate the Platform on our behalf (Section 6), under written contracts that restrict their use of the data to providing their service to us.
• Your organisation. If you use the Platform through an employer or other organisation, that organisation's administrators can access your account, membership, and activity within their tenant.
• Professional advisers (legal, accounting, audit) under confidentiality.
• Corporate transactions. In a merger, acquisition, financing, or sale of assets, data may be disclosed to counterparties and their advisers under confidentiality, and transferred as part of the transaction.
• Legal and safety. Where required by law, regulation, legal process, or a valid government request, or to protect the rights, safety, and security of EcoSphere, our users, or the public.

We do not sell personal data and we do not share it for cross-context behavioural advertising.

We are an Irish company. We engage a small number of third parties to process personal data on our instructions so that we can provide the Platform — hosting, AI model providers, content delivery, error monitoring, and email delivery. Some of them are established outside the EEA, notably in the United States, so providing the Platform involves international transfers of personal data.

The current register names each sub-processor, what it does, the data it processes, and where it operates. It also records what is deliberately not on the list, and every revision we have made to it.

Read the sub-processor register

Transfer safeguards. Where we transfer personal data outside the EEA or the UK to a country without an adequacy decision, we rely on appropriate safeguards under EU and UK GDPR Chapter V — principally the European Commission's Standard Contractual Clauses for EEA data and the UK International Data Transfer Addendum for UK data, supplemented by technical and organisational measures. You may request a copy of the relevant safeguards using the contact details in Section 14.

We keep personal data only as long as necessary for the purposes in this policy:

• Account data — for the life of your account and a reasonable period after closure to handle wind-down, disputes, and legal obligations.
• Audit and security logs — retained for a defined security and compliance window, then deleted or anonymised.
• Billing records — retained for the period required by tax and company law (in Ireland, generally six years).
• Marketing data — until you opt out or after a period of inactivity.
• Assistant and support data — retained for quality, debugging, and safety review for a limited period, then deleted or anonymised.

Customer-uploaded content is retained and deleted under the customer's instructions and the DPA, including on termination.

Subject to the law that applies to you, you have rights over your personal data.

Under the EU and UK GDPR

• Access — obtain a copy of your personal data.
• Rectification — correct inaccurate or incomplete data.
• Erasure — have your data deleted in certain circumstances ("right to be forgotten").
• Restriction — limit how we process your data in certain circumstances.
• Portability — receive certain data in a structured, machine-readable format.
• Object — object to processing based on legitimate interests, and to direct marketing at any time.
• Withdraw consent — where processing relies on consent.
• Automated decisions — not be subject to solely automated decisions with legal or similarly significant effects (we do not make such decisions).
• Complain — lodge a complaint with a supervisory authority (Section 13).

To exercise any right, contact us using Section 14. We respond within one month (extendable by two further months for complex requests). We do not charge a fee unless a request is manifestly unfounded or excessive. We may need to verify your identity first.

The Platform relies on a small set of strictly necessary cookies and browser storage:

• Authentication — httpOnly session/JWT cookies that keep you signed in.
• Security — CSRF protection tokens.
• Preferences — tenant selection and interface state (for example sidebar state), stored in cookies or local browser storage.

We do not use advertising or third-party tracking cookies. If we introduce analytics or other non-essential cookies in future, we will update this policy and, where required, request your consent first.

Our company website, ecosphere-intelligence.com, sets no cookies of its own. Its demo-request and contact forms use Cloudflare Turnstile to check that a person rather than a bot is submitting them, and Cloudflare, which serves the website, may set strictly necessary security cookies to do so.

You can also ask us to email you when our sub-processor register changes, using the form on the register page. We first send a confirmation link to the address you give. Until the link is used, the request stays unconfirmed and we send nothing else, and if it is not used within 7 days we delete the request. For each subscription we keep the email address, when it was requested and confirmed, the page the form was on and the version of this policy published at the time, so that we can send these emails and show that you asked for them. We use the address for nothing else. Our legal basis is your consent (Art 6(1)(a)). We keep a confirmed subscription until you unsubscribe. Each update email has a link to unsubscribe, and unsubscribing deletes your address and our record of the emails we sent to it. To stop the form being misused, we keep a hashed form of the IP address it was sent from for up to two hours. The form uses Cloudflare Turnstile in the same way as the demo-request form, and Cloudflare stores subscriptions in the European Union and sends the emails.

We apply technical and organisational measures appropriate to the risk, including:

• Tenant isolation enforced at the application layer and reinforced by database row-level security, so one customer's data is not accessible to another.
• Encryption of data in transit (TLS) and of sensitive stored secrets.
• Access controls, least-privilege roles, and authentication including single sign-on.
• Audit logging of authentication and security-relevant actions.
• Secure development practices, dependency scanning, and routine review.

No system is perfectly secure. If we become aware of a personal-data breach likely to result in a risk to your rights, we will notify the relevant supervisory authority and affected individuals as required by law.

The Platform is a business tool not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us personal data, contact us and we will delete it.

Where we process customer-uploaded content as a processor, that processing is governed by the Data Processing Agreement between us and the customer, which includes the EU and UK GDPR Article 28 terms and the Standard Contractual Clauses for international transfers. The DPA, not this policy, sets out our obligations for that content — including security, sub-processing, breach notification, assistance with data-subject requests, and deletion on termination. Customers can obtain the DPA by contacting us.

Our lead supervisory authority is the Irish Data Protection Commission (DPC):

• Website: www.dataprotection.ie
• Address: 21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland

If you are in the EEA, you may also complain to the supervisory authority in your country of residence or work. If you are in the United Kingdom, you may complain to the Information Commissioner's Office (ICO), www.ico.org.uk.

• Privacy enquiries and data-subject requests: privacy@ecosphere-intelligence.com
• General and support enquiries: support@ecosphere-intelligence.com
• Security and vulnerability reports: security@ecosphere-intelligence.com
• Postal: EcoSphere Intelligence Limited, Athlone, Co. Westmeath, Ireland
• Data protection contact: we have not appointed a statutory Data Protection Officer; privacy matters and data-subject requests are handled by our privacy team at privacy@ecosphere-intelligence.com.
• UK representative (UK GDPR Article 27): if you are in the UK and have a data-protection query, contact privacy@ecosphere-intelligence.com.

15.1 United Kingdom

For individuals in the UK, the UK GDPR and the Data Protection Act 2018 (UK) apply in place of the EU GDPR. The UK GDPR is a separate instrument retained in UK law; its rights mirror those in Section 8, and its supervisory authority is the ICO rather than the Irish DPC. International transfers of UK data rely on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses.

15.2 California (CCPA/CPRA)

If you are a California resident, you have rights to know, access and port, delete, and correct your personal information, to opt out of "sale" or "sharing" (we do not sell or share personal information as those terms are defined, and we do not use sensitive personal information for purposes requiring an opt-out), and to non-discrimination for exercising your rights. To exercise these rights, contact us (Section 14); you may use an authorised agent. We will verify your request before responding.

15.3 Other US states

Residents of US states with comprehensive privacy laws (including Virginia, Colorado, Connecticut, Utah, and others) have rights to access, correct, delete, and obtain a copy of their personal data, and to opt out of targeted advertising, sale, and certain profiling. We honour these rights consistent with the principles above.

15.4 Other jurisdictions

Where local law (for example Canada's PIPEDA, Australia's Privacy Act, or others) grants you rights over your personal data, we will honour them as required. Contact us with any request.

We may update this policy to reflect changes to the Platform, our practices, or the law. We will post the updated policy with a new effective date and, for material changes, take reasonable steps to notify you (for example by email or in-product notice). Continued use of the Platform after the effective date constitutes acceptance of the updated policy where permitted by law.