Privacy Policy

Effective date: 1 June 2026 · Last updated: June 2026 · MintCarb (Pvt., Ltd.), a product entity of WMAD Pvt., Ltd.

Summary (plain English)

✓ We collect your name, work email, and the emission data you enter.
✓ We use it only to provide MintCarb services and send you compliance alerts.
✓ We never sell your data or use it for advertising.
✓ We use one session cookie — no tracking, no analytics.
✓ Your data is isolated from other customers at the database level.
✓ Compliance records are kept for 7 years as required by Indian law.
✓ You can request deletion, correction, or export of your data at any time.

1. About this policy

This Privacy Policy explains how MintCarb (Pvt., Ltd.) — a wholly owned product entity of WMAD Pvt., Ltd. — collects, processes, stores, and shares personal data when you use the MintCarb Carbon Intelligence Platform (mintcarb.com and associated subdomains). It applies to registered users of the platform, visitors to the public website, and individuals whose data is submitted by their employer organisation. By creating a MintCarb account or using the platform, you agree to this policy.

2. Who we are

MintCarb is operated by MintCarb (Pvt., Ltd.), a product entity established under WMAD Pvt., Ltd. Registered in India. For data protection purposes under the Information Technology Act 2000, India's Digital Personal Data Protection Act 2023 (DPDPA), and Singapore's Personal Data Protection Act 2012 (PDPA), MintCarb (Pvt., Ltd.) is the Data Fiduciary (India) and Organisation (Singapore). Contact: privacy@mintcarb.com

3. What personal data we collect

We collect three categories of data. Account and identity data: your full name, work email address, job title, phone number (optional), and the name and industry of your organisation — provided by you during registration. Platform usage data: emission records and production data you enter for your facilities; compliance reports, CCTS filings, and BRSR outputs generated by you; settings, user preferences, and API access tokens. Technical data collected automatically: IP address, browser type and version, operating system, pages visited on MintCarb, session duration, and error logs. We do not collect payment card details — payments are processed by our payment processor and card data never reaches MintCarb servers.

4. How we use your data

We process your personal data for the following purposes, and only these purposes: (a) Providing the service — operating the platform, running GHG calculations, generating compliance reports, and sending transactional emails such as account setup, password reset, and compliance deadline reminders; (b) Security — detecting fraud, preventing unauthorised access, and maintaining audit logs; (c) Legal compliance — responding to lawful requests from regulators, tax authorities, and courts; (d) Product improvement — using anonymised, aggregated usage statistics to prioritise features and fix bugs. We never use your personal data for advertising profiling, behavioural targeting, or sale to third parties.

5. Legal basis for processing

Under India's DPDPA and Singapore's PDPA, we process your data on the following bases: Consent — given when you create an account and accept this policy; Performance of a contract — data required to provide the MintCarb service you have subscribed to; Legitimate interests — security monitoring, fraud prevention, and service improvement, where these interests do not override your rights; Legal obligation — responding to lawful orders from courts and regulators.

6. Data classification and isolation

MintCarb classifies all data into two tiers. T2 Confidential covers emission records, facility data, compliance filings, user PII, API keys, and billing information. T4 Public covers carbon retirement certificates and public carbon badges. Confidential data is encrypted at rest using AES-256 and in transit using TLS 1.3. All data is subject to PostgreSQL row-level security — your organisation's data is isolated at the database level from every other customer. It is architecturally impossible for one tenant to access another's emission records, even in the event of application-level bugs.

7. Third-party services we use

MintCarb works with a minimal set of third-party processors, each under contract with data processing obligations: Resend (transactional email delivery — they receive recipient email address and email content only); Groq (AI query processing for CarbonIQ — only the text of your specific query is sent, never raw emission data or PII); Hetzner (dedicated server infrastructure — data is hosted on a server dedicated exclusively to MintCarb, not shared with other WMAD products or any third party); Razorpay or Stripe (payment processing — card data never reaches MintCarb servers). We do not use Google Analytics, Facebook Pixel, Mixpanel, Amplitude, HubSpot, or any other data broker or advertising network.

8. Cookies

MintCarb uses two cookies: an httpOnly, Secure session cookie (mc_refresh) that stores your encrypted refresh token, and a CSRF protection token (mc_csrf). We do not use advertising or tracking cookies of any kind. There is no cookie consent banner because no non-essential cookies are set. For full details, see our Cookie Policy at mintcarb.com/cookies.

9. Data retention

Emission records and compliance reports: 7 years from the date of generation, aligned with India's Companies Act 2013 and GST record-keeping requirements. CCTS filings and BRSR reports may need to be retained even longer for regulatory audit purposes — see our Refund & Cancellation Policy for details. Account and identity data: retained until account closure, plus 90 days. Technical logs: 90 days rolling. You may request early deletion of your personal data (not emission or compliance records, which have mandatory retention periods) at any time.

10. International data transfers

MintCarb servers are located in Europe (Hetzner, Germany). If you are accessing MintCarb from India or Singapore, your data is transferred to and stored in Germany. This transfer is covered by standard contractual clauses and Hetzner's ISO 27001 certification. When you use CarbonIQ, your query text is transmitted to Groq (United States). No emission records, facility data, or personal identifiers are included in these AI queries.

11. Your rights

Under India's DPDPA and Singapore's PDPA, you have the right to: access a copy of the personal data we hold about you; correct inaccurate personal data; delete your account and personal data (subject to mandatory retention periods for compliance records); object to processing for legitimate interest purposes; withdraw consent for marketing communications at any time; receive your personal data in a portable, machine-readable format; file a complaint with the Data Protection Board of India (DPDPA) or Personal Data Protection Commission (Singapore PDPA). To exercise any of these rights, contact privacy@mintcarb.com. We will respond within 30 days.

12. Children's data

MintCarb is a B2B enterprise platform for industrial and commercial organisations. It is not intended for individuals under 18 years of age. We do not knowingly collect personal data from minors.

13. Changes to this policy

We may update this Privacy Policy to reflect changes in law, our practices, or the services we offer. We will notify registered users by email at least 14 days before material changes take effect. The effective date at the top of this page will always show when the policy was last updated. Continued use of MintCarb after the effective date constitutes acceptance.

14. Contact and Data Protection Officer

For privacy enquiries, to exercise your data rights, or to report a privacy concern: Data Protection Officer, MintCarb (Pvt., Ltd.) · Email: privacy@mintcarb.com · Phone: +91 70931 80303 · Registered address: D No: 24-10-423, Flat No: 201, Venkateswara Grand Apartments, 1/5 Line Ramannapet, Koritepadu, Guntur, Andhra Pradesh — 522007, India · Response time: within 30 working days.

This policy applies to MintCarb™ operated by MintCarb (Pvt., Ltd.), a product entity of WMAD Pvt., Ltd. MintCarb is a standalone product — it does not share infrastructure, data, or databases with any other WMAD product.