The English text of this page is the legally binding version.
The platform's core content is corporate disclosure data extracted from sustainability/carbon reports that companies have voluntarily disclosed publicly — emissions figures, targets, methodology explanations, assurance documents. This data is already collected from public sources (KAP/TSRS, responsibilityreports.com, SRN CSRD, EPA GHGRP, EU ETS/EUTL, the SBTi list, etc.) and belongs to legal entities; it is not personal data under KVKK.
| Source | Content |
|---|---|
| KAP / TSRS | Sustainability disclosures of publicly listed companies in Türkiye |
| responsibilityreports.com | Archive of public corporate sustainability reports |
| SRN CSRD | Reports published under the EU CSRD |
| EPA GHGRP | US facility-level greenhouse gas reporting program (public data) |
| EU ETS / EUTL | EU Emissions Trading System transaction log (public data) |
| SBTi list | Science-based target commitment/approval records |
You do not need to create an account or share personal information to browse the site, view records, or use the API. Personal data reaches us only when you submit it yourself through a form, an account, or the reporting tool. This is the complete list; if a category is not here, we do not process it.
| Category | Where it is collected | Retention |
|---|---|---|
| Corporate email address | Profile-claim, badge and dispute forms; the support form; sign-in (magic link) | See "Retention Period" |
| Phone number | Profile-claim and badge forms — mandatory, for the callback that is part of the review | With the application record |
| Name, job title, company, stated purpose | Profile-claim and badge forms (max. 500 characters per field) | With the application record |
| Free-text message | Support form (max. 5,000 characters); dispute and claim forms (max. 500 characters) | With the record |
| Country code of the request | Derived from the network request (Cloudflare CF-IPCountry). The IP address itself is not stored. | With the record |
| Hashed IP address | Rate-limit key only — SHA-256 digest, never the plain address | 60 seconds, then deleted automatically |
| Source-document access records | When a signed-in user opens a company report from a record page: account id, day (UTC), record id, a SHA-256 digest of the document link, the document host and the time of access, plus daily counters per account, per email domain and site-wide — only to enforce the daily limits (3 distinct documents per account, 10 per email domain, and a site-wide cap for accounts younger than 7 days). Because the record id is stored, the record you opened can be seen in this log. | About 7 days: a daily job deletes them once they are 7 days old, so a record is kept for at most 8 days |
| Account profile | Only if you create an account: name, job title, organization, account type, consent timestamps, last-seen time | Until you ask for deletion |
| Invitation email addresses | When you invite a supplier or colleague to the reporting tool, you enter their email address | Until the invitation is answered or withdrawn |
| Content you enter into the reporting tool | Consumption/invoice figures, uploaded documents, and messages you send to the assistant | Until you ask for deletion |
Free email providers (gmail, hotmail, etc.) are not accepted for the profile-claim and badge processes or for opening source documents; only addresses on a corporate domain can be used there.
The data above is processed solely for the purposes of (i) verifying profile ownership, (ii) conducting the dispute process and responding to you, (iii) answering your support request, (iv) operating your account and the reporting tool you asked for, and (v) preventing abuse of the forms (rate limiting), and (vi) enforcing the daily limit on opening source documents. Legal basis: KVKK (Law on the Protection of Personal Data, Türkiye) Art. 5/2-c ("being directly related to the establishment or performance of a contract") and Art. 5/2-f ("the data controller's legitimate interest, provided that it does not harm the data subject's fundamental rights and freedoms").
We do not use your data for profiling or advertising, and we do not sell it to anyone.
Running the platform requires the service providers below. All three process data on servers located outside Türkiye, so using the relevant features involves a transfer abroad within the meaning of KVKK Art. 9.
| Provider | What it processes | When it is involved |
|---|---|---|
| Cloudflare | Hosting, CDN, and the storage that holds form records | Every visit; every form submission |
| Supabase | Sign-in (magic-link email) and the database holding accounts, reports and invitations | Only if you create an account |
| Google (Gemini API) | The text of the messages you send to the assistant and the content of the documents you upload for analysis | Only when you use the assistant or document analysis |
Please note: the assistant and document analysis features work by sending what you write or upload to Google's generative language API. Do not enter data there that you would not want to leave the platform.
| Record | Retention |
|---|---|
| Support-form records | 180 days, then deleted automatically |
| Rate-limit keys (hashed IP) | 60 seconds, then deleted automatically |
| Source-document access records | About 7 days: a daily job deletes them once they are 7 days old, so a record is kept for at most 8 days |
| Profile-claim, badge and dispute applications | No automatic expiry. They are kept for the integrity of the publicly available dispute history (dispute: 10-business-day SLA plus any resulting correction). You can request deletion at any time. |
| Account, reports, invitations | Retained while the account is open; deleted on request |
Since corporate disclosure data is not itself personal data, it may be retained indefinitely — records are append-only and are not deleted; corrections are added as a new version, and the old version remains visible as "superseded".
Carbonbench does not use tracking cookies. So that the site can remember your dark/light theme, only your browser's localStorage field is used — this data is never sent from your device to any server, does not identify a person, and is not considered personal data under KVKK. You can clear it anytime from your browser settings.
If you sign in, your session token is kept in the same localStorage area so that you stay logged in. Signing out removes it. It is not shared with third parties and no cookie is written for it.
The Carbonbench browser extension reads the current tab only when you click its icon. It reads the page address, title, first heading, site name and any text you have selected, and uses them on your device to find a matching company. This information is never sent to Carbonbench or anyone else, and it is not stored.
The extension contacts only carbonbench.org. It downloads the public list of company names (at most once a day) and, when a company matches and you view it, that company's public record. Like any web request, these requests reach our hosting provider (Cloudflare) with your IP address; a record request shows which public company record was opened, the same as opening it on carbonbench.org. We do not link these requests to a person and we do not use analytics, cookies or advertising identifiers in the extension.
The company index is cached in your browser's extension storage for 24 hours. Removing the extension deletes it.
For any data listed above that you submitted, under KVKK Art. 11 you have the rights to: learn whether your data is being processed, learn the purpose of processing, know the third parties to whom it has been transferred domestically/abroad, request correction if it has been processed incompletely/incorrectly, and request its erasure/destruction once the legal conditions are met.
Deletion channel: write to support@carbonbench.org with the subject line "KVKK request", stating the email address you used and — if you have one — the reference code of your application (e.g. CLAIM-…). We respond within 30 days at the latest, as required by KVKK Art. 13. If your account is deleted, the reports and invitations attached to it are deleted with it; published corporate records are not personal data and remain in place.
Data controller contact channel for applications on this page: support@carbonbench.org
Carbonbench processes corporate, publicly disclosed carbon-report data — not personal data. Personal data reaches us only when you submit it yourself: the corporate email, phone number, name/title and free-text you enter in the claim, badge, dispute and support forms; the country code of your request (the IP address itself is never stored — the rate limiter keeps only a 60-second SHA-256 digest); and, if you create an account, your profile, the reports you build, the addresses you invite, what you send to the assistant, and the record, a digest of the document link, the host and the time of each source document you open (deleted by a daily job once 7 days old, only to enforce the daily limits). Three processors are involved: Cloudflare (hosting and form storage), Supabase (sign-in and database) and Google's Gemini API, which receives the text and documents you send to the assistant — a transfer abroad under KVKK Art. 9. Support records are deleted after 180 days; claim/dispute applications have no automatic expiry and are deleted on request. No tracking cookies are used; preferences and, if you sign in, your session token stay in browser localStorage. Under KVKK Art. 11 you may request access, correction or deletion — email support@carbonbench.org with the subject "KVKK request"; we reply within 30 days.