Privacy Policy

Last updated: 14 October 2026

This Privacy Policy explains how CounterCarbon Ltd ("we", "us", "our"), company number 17061500, registered in England and Wales, collects, uses, and protects personal data when you use SupplyFi ("the Service").

We are committed to compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We are registered with the Information Commissioner's Office (ICO). ICO registration number: [ZA…]

1. Our roles: controller and processor

SupplyFi plays two different roles, depending on the data:

  • We are the controller for account data: the names, email addresses, billing details and usage information of the people who use SupplyFi. This policy mainly covers that data.
  • We are a processor for the data our customers put into the platform: their products, and the contact and product data of their suppliers and customers. The customer decides why and how that data is used; we process it only on their instructions, under our Data Processing Addendum. If you are a supplier or customer of a SupplyFi customer and have a question about your data, please contact that customer first.

2. What data we collect

We collect the following categories of personal data as controller:

  • Account data: name, email address, job title, and organisation name provided at registration.
  • Authentication data: login credentials managed by Clerk (our authentication provider). We do not store passwords directly.
  • Usage data: pages visited, features used, timestamps, IP addresses, and browser information collected automatically. This includes a log of AI usage (see section 5).
  • Billing data: payment and subscription information processed by Stripe. We do not store full card details.
  • Communications data: emails and messages you send to us.

As processor we also handle the data you submit to the platform (for example product information, dimensions, compliance details, and supplier and customer contact details). That data is covered by section 1 and our Data Processing Addendum.

3. How we use your data

We process your personal data (as controller) on the following legal bases:

  • Contract performance: to provide the Service you have subscribed to, including account management, platform access, and support.
  • Legitimate interests: to improve the Service, prevent fraud and abuse, ensure security, and send product updates relevant to your use of SupplyFi.
  • Legal obligation: to comply with applicable law, including tax and financial reporting obligations.
  • Consent: to send marketing communications where you have opted in.

4. Free accounts and marketing

Free accounts may be suspended or closed, and may display advertising or be supported through marketing (see section 4.3 of our Terms). For your personal data, that means:

  • We send marketing emails only with your consent, or where the "soft opt-in" rules allow it (for example, similar products to existing customers). Every marketing email includes an unsubscribe link.
  • We do not sell personal data.
  • If we show advertising, our plan is to do so without sharing your personal data with ad networks unless you have given consent.

5. AI features (Fi and AI drafts)

  • Fi never sees your customer or supplier details, just the data they submit.
  • Contact-like columns in spreadsheets are withheld before anything reaches an AI model.
  • We use providers and settings that do not use your data to train their models. Our terms with our AI providers do not permit them to train on customer data.
  • AI usage is logged (who used it, when, and how much) for billing and abuse prevention.
  • If you bring your own AI key, your requests go to the provider you choose, under your own agreement with them.

6. Data sharing and sub-processors

We share data only with trusted third-party services necessary to operate the platform:

  • Clerk — authentication and session management
  • Supabase — database hosting (production database in Frankfurt, Germany, eu-central-1)
  • Vercel — application hosting and deployment (application functions run in Frankfurt, fra1)
  • Vercel Blob — file storage (EU, Dublin)
  • Vercel AI Gateway — routes requests for Fi and AI drafts to AI model providers, currently Anthropic
  • Your chosen AI provider (Anthropic, OpenAI or Google) — only if you bring your own AI key, under your own agreement with that provider
  • Stripe — payment processing and billing
  • Resend — transactional email delivery
  • Inngest — background job processing

All sub-processors are required to process data in accordance with UK GDPR. We do not sell your personal data to any third party. The same list applies to our Data Processing Addendum.

7. Data storage and transfers

Our production database is hosted in Frankfurt, Germany, our application functions run in Frankfurt, and file storage is in Dublin. Some providers, including Clerk, Stripe and the AI providers, may process data in the United States. Where personal data is transferred outside the UK, we rely on appropriate safeguards: the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, or the UK Extension to the EU–US Data Privacy Framework where the provider participates in it.

8. Data retention and deletion

We keep your personal data for as long as your account is active or as needed to provide the Service. When an account is deleted, we purge live systems within 7 days of the deletion request being confirmed. Backups roll off on their normal schedule. The options for customer data when you cancel are set out in section 6.1 of our Terms.

We keep some records for longer where the law requires it, for example invoices and related billing records for tax purposes (typically 6 years under UK law).

9. Public Digital Product Passports

Digital Product Passport pages are public by design. They show product data that the customer chose to publish. They are not intended to show personal data.

10. Your rights

Under UK GDPR, you have the following rights:

  • Access: request a copy of the personal data we hold about you.
  • Rectification: request correction of inaccurate data.
  • Erasure: request deletion of your data ("right to be forgotten"), subject to legal obligations.
  • Restriction: request we restrict processing of your data in certain circumstances.
  • Portability: receive your data in a structured, machine-readable format.
  • Objection: object to processing based on legitimate interests or for direct marketing.
  • Withdraw consent: where processing is based on consent, withdraw it at any time.

To exercise any of these rights, email hello@supplyfi.co.uk. We will reply within one month. If your request is about data a SupplyFi customer put into the platform, we may pass it to that customer, who decides how to respond.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

11. Cookies

We use only the cookies and similar storage needed to run the Service, and no analytics or advertising cookies. See our Cookie Policy for the full list.

12. Security

We implement appropriate technical and organisational measures to protect your personal data, including encryption in transit (TLS), encryption at rest, access controls, and regular security reviews. No method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

13. Children

The Service is intended for business use only and is not directed at individuals under the age of 18. We do not knowingly collect personal data from children.

14. Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or via a notice in the platform at least 14 days before they take effect.

15. Contact

CounterCarbon Ltd
Company No. 17061500
Registered in England and Wales
ICO registration number: [ZA…]
Email: hello@supplyfi.co.uk or hello@supplyfi.co.uk