Privacy Policy

This Privacy Policy describes how Flora Carbon AI ("we," "us," or "our"), a company based in India, collects, uses, stores, and protects personal information when you use our websites and applications (together, the "Services"):

• Carbon OS — os.floracarbon.ai
• FloraScope — scope.floracarbon.ai
• FloraCarbon calculator — calculator.floracarbon.ai
• FloraTrace — the mobile app on Google Play (ai.floracarbon.floratrace) and the web dashboard at trace.floracarbon.ai
• Carbon Intel — intel.floracarbon.ai
• Carbon Compass — compass.floracarbon.ai
• floracarbon.ai — our company website

These tools support forestry and carbon project work, from land screening to field data collection and reporting. By registering for or using the Services, you agree to the practices described in this policy. If you do not agree, please do not use them. Our Terms of Service and cookie notice apply alongside this policy.

We collect the following categories of personal and field data when you use our Services:

• Account information: your name and email address, provided when you register or sign in through our authentication service, and, if you use Sign in with Google, your profile picture and Google account ID (see section 5).
• Project and boundary data: project names, land boundaries (polygons or coordinates), documents and other information you upload or enter into Carbon OS, FloraScope, the calculator, Carbon Intel or Carbon Compass.
• Assistant conversations: questions you type into Carbon Intel or Carbon Compass and the answers produced.
• Location data: GPS coordinates collected only while you are actively using the App ("while in use") to geotag field observations, plots, and measurements. We do not collect background location.
• Tree measurements: diameter, height, species, and related forestry metrics you record in the field.
• Plot photos: images you capture or upload of plots, trees, or site conditions.
• Field data: plot identifiers, notes, timestamps, and other environmental or project-related information you enter during data collection.
• Device and usage data: basic technical information such as device type, operating system version, and crash logs to maintain and improve App stability.

We use collected information for the following purposes:

• To create and manage your account and authenticate your identity
• To enable field data collection, geotagging, and synchronization of measurements and photos
• To support carbon monitoring, forestry assessments, and project reporting
• To communicate with you about your account, support requests, or service updates
• To improve App performance, fix bugs, and develop new features
• To run satellite and land analysis on boundaries you provide, and to produce the screening, estimates and reports you ask for
• To secure the Services, prevent abuse and keep records needed for audit
• To comply with applicable laws and respond to lawful requests

We do not sell your personal information to third parties, and we do not use it for advertising.

FloraTrace requests access to your device's precise location only while you are using the App. Location is used to associate field observations, tree measurements, and plot photos with geographic coordinates.

You may deny location permission; however, geotagging features will not function correctly. You can change location permissions at any time through your Android device settings. We do not track your location when the App is closed or running in the background.

Sign-in to our Services is handled by Supabase, our authentication provider. You can sign in with your email address (we send a one-time sign-in code to your inbox) or with your Google account.

Sign in with Google

If you choose Sign in with Google, Google tells us your name, email address, profile picture and Google account ID. We use them only to create your Flora Carbon account, recognise you when you return, and keep the account secure. We do not ask for access to your Gmail, Google Drive, Calendar, contacts or any other Google data, and we do not read or store anything else from your Google account.

We do not use Google user data for advertising, do not sell it, do not transfer it to anyone except the service providers listed in section 8 that help us run the sign-in, and do not allow humans to read it except where needed for security, to comply with law, or with your consent.

Flora Carbon's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You can remove Flora Carbon's access at any time in your Google Account settings under "Third-party apps & services", and you can ask us to delete your account (section 10).

We send emails that you need in order to use the Services: sign-in codes, account notices, invitations to projects, and replies to support requests. They are sent through our email provider, Resend, which processes your email address and the message content solely to deliver them. We do not use these emails for advertising, and we send marketing emails only if you have agreed to receive them.

In FloraTrace you record plots, trees, measurements, photos and GPS positions. This data belongs to the project it was collected for. It is visible to you, to the other members of that project (according to the role the project owner gave them), and to Flora Carbon staff only where needed to provide support, keep the service running, or investigate misuse. It is not visible to other customers. Aggregated or project-scoped data may be shared with collaborators on a project you participate in, and with verifiers or standards bodies when a project owner chooses to submit it.

To make records tamper-evident, we may write a cryptographic fingerprint (hash) of a record to a public blockchain (Polygon). Only the hash is written: never the record itself, and never names, emails, photos, coordinates or other personal data. A hash cannot be turned back into the data it came from and reveals nothing without the original record.

Because a public blockchain is permanent, a hash that has been written cannot be deleted from the chain. When you delete your data from our systems, the record the hash points to is deleted, which leaves the hash meaningless.

When you give us a boundary, we use it to retrieve and analyse satellite imagery and land data (for example tree cover, land use and protected-area overlap) from sources such as Google Earth Engine and Microsoft Planetary Computer. Only the boundary and the analysis request are sent to these sources; they do not receive your name or account details.

Field data, project data, measurements, photos, and account information are stored on secure servers (Supabase databases and Microsoft Azure storage) with access controls limited to authorized personnel. We implement reasonable technical and organizational measures—including encryption in transit (HTTPS/TLS), access restrictions, and secure authentication—to protect your data against unauthorized access, alteration, disclosure, or destruction.

No method of transmission or storage is completely secure. While we strive to protect your information, we cannot guarantee absolute security.

We may share your information only in these circumstances:

• Service providers (processors): companies that process data on our behalf, under contractual obligations, only to provide the Services:
  • Supabase — authentication and databases
  • Microsoft Azure — hosting and file storage
  • Netlify — hosting of our websites
  • Resend — sending email
  • Google Earth Engine and Microsoft Planetary Computer — satellite data and analysis
  • Azure OpenAI — the AI assistant in Carbon Intel and Carbon Compass
  • Google — Sign in with Google, and Google Play for app distribution
• Project partners: aggregated or project-scoped field data shared with authorized collaborators on forestry or carbon projects you participate in
• Not sold: we never sell personal information or share it for advertising.
• Legal requirements: when required by law, court order, or government authority in India or other applicable jurisdictions
• Business transfers: in connection with a merger, acquisition, or sale of assets, with notice where required by law

If you are located in India, you have rights under the Digital Personal Data Protection Act, 2023 (DPDP Act), including:

• The right to access information about personal data we process about you
• The right to correction and erasure of inaccurate or outdated personal data
• The right to withdraw consent where processing is based on consent
• The right to nominate another individual to exercise your rights in the event of death or incapacity
• The right to grievance redressal through our contact channel below

To exercise any of these rights, contact us at contact@floracarbon.ai. We will respond within the timeframe required by applicable law.

We retain your personal and field data for as long as your account is active or as needed to fulfill the purposes described in this policy, including project reporting and legal obligations. When you request account deletion, we will delete or anonymize your personal data within a reasonable period, except where retention is required by law or legitimate business needs (e.g., audit records). Email sign-in codes expire within minutes and are not kept. Backups are overwritten on their normal cycle.

Deleting your account and data: you can request deletion at any time on our delete account page or by emailing contact@floracarbon.ai. Blockchain fingerprints (section 6B) are the one thing that cannot be erased, and they contain no personal data.

Our Services are not directed at children under 18 years of age. We do not knowingly collect personal information from minors. If you believe a child has provided us with personal data, please contact us and we will take steps to delete such information.

Our service providers may process or store your data on servers outside India (for example in the European Union, the United States or Singapore, depending on the provider and data centre in use). Where such transfers occur, we ensure appropriate safeguards are in place consistent with applicable data protection requirements.

Our Services may link to or integrate with third-party services (including Google, Google Play, mapping providers and cloud storage). This policy applies only to Flora Carbon AI and its Services. We encourage you to review the privacy policies of any third-party services you interact with through the App.

We may update this Privacy Policy from time to time. We will post the revised policy at this URL and update the "Last updated" date. For material changes, we may notify you through the App or via email. Continued use of the Services after changes take effect constitutes acceptance of the updated policy.

For questions, concerns, or requests regarding this Privacy Policy or your personal data, contact:

If you are not satisfied with our response, you may lodge a complaint with the Data Protection Board of India as provided under the DPDP Act.