Privacy Policy

EcoSphere AS · Privacy Policy · Version 1.0 · June 2026

1. Data Controller

EcoSphere AS is the data controller for personal data collected through the EcoSphere platform. Contact: privacy@ecosphere.no

2. What Data We Collect

• Account data: name, email address, job title, company affiliation
• Usage data: log-in timestamps, feature usage, audit logs
• Uploaded documents: PDFs, invoices, photos, ESG reports (may contain personal data)
• Billing data: invoicing contact details (no payment card data stored)

3. Legal Basis for Processing

• Contract (Art. 6(1)(b)): Account management and service delivery
• Legitimate Interest (Art. 6(1)(f)): Security logging, fraud prevention
• Legal Obligation (Art. 6(1)(c)): Retention of financial records per Norwegian law

4. How We Use Your Data

Your data is used solely to provide and improve the EcoSphere platform. We do not sell, share or use your data for advertising. AI processing (Azure OpenAI) does not train on your data.

5. Sub-Processors

• Microsoft Azure — Cloud infrastructure (EU, Norway/West Europe)
• Azure OpenAI Service — AI document analysis (EU region)
• Climatiq — Emissions factor API (Germany)

All sub-processors are bound by GDPR-compliant Data Processing Agreements.

6. Data Retention

Account data is retained for the duration of your subscription plus 12 months. Uploaded documents are retained as configured. Financial records are retained per Norwegian accounting law (5–7 years). You may request deletion at any time.

7. Your Rights (GDPR Chapter III)

• Right to access your personal data
• Right to rectification of inaccurate data
• Right to erasure ("right to be forgotten")
• Right to data portability
• Right to object to processing
• Right to lodge a complaint with Datatilsynet (datatilsynet.no)

To exercise your rights, contact: privacy@ecosphere.no

8. Security

All data is encrypted at rest (AES-256) and in transit (TLS 1.2+). Access is controlled via role-based access control (RBAC). We maintain audit logs of all data access events.

9. AI Processing

The platform uses AI (Azure OpenAI Service, EU region) for document analysis, invoice categorisation and report generation. AI-generated outputs are always subject to human review before use in formal reports. You will be informed when AI processing is applied to your data.

10. Changes to This Policy

We will notify you by email of material changes to this Privacy Policy at least 30 days in advance. Continued use of the platform constitutes acceptance.