1. Who is responsible for your data (controller)
Front Solutions AS, organisation number 933 375 250, Agnes torg 18, 3290 Stavern, Norway, is the data controller for personal data processed through the Front Carbon App (app.frontcarbon.com) and the frontcarbon.com website. Privacy contact: post@frontcarbon.com.
This policy explains what personal data we process, why, on what legal basis, how long we keep it, who we share it with, and your rights under the EU/EEA General Data Protection Regulation (GDPR) and the Norwegian Personal Data Act (personopplysningsloven).
2. What this policy covers
This policy covers the Front Carbon App — our invitation-only CCS logistics platform for consultants and invited clients — and the public frontcarbon.com website, including the assessment, contact, and partner forms.
Front Carbon CCS Map (map.frontcarbon.com) has its own Privacy Policy. How we protect and isolate customer business data on the platform is described in our Data Handling and Security Policy.
3. What personal data we process
- 3.1 Account data— the App is invitation-only. For each account we store the email address, full name, role, and organisation membership; passwords are stored only as secure hashes, and optional multi-factor authentication data where you enable it. Invitations store the invitee’s email address and status.
- 3.2 Customer project data — business data you or your organisation submit to the platform (facility information, commercial figures, calculation inputs and results). This is primarily business data, but may contain personal data such as contact names. Its handling, isolation, and security are governed by the Data Handling and Security Policy.
- 3.3 Assessment form — if you submit the public assessment form we process your name, company, job title, email, phone, industry, country/region, facility information (including locations), commercial preferences, your consent choices (privacy agreement and optional marketing opt-in), and your IP address (recorded for abuse prevention).
- 3.4 Contact and partner forms — name, company, email, and your message.
- 3.5 Security and usage logs — sign-in events (including IP address and browser information, used for rate limiting and abuse prevention), and audit and activity logs of actions on the platform.
- 3.6 Communications — messages you send us, including support and project correspondence.
We do not intentionally collect special categories of personal data, and you should not submit them.
4. Why we process it and the legal basis
| Purpose | Legal basis (GDPR Art. 6) |
|---|
| Provide the platform; manage accounts and invitations | Performance of a contract – Art. 6(1)(b) |
| Respond to assessment, contact, and partner enquiries | Steps prior to a contract – Art. 6(1)(b) / legitimate interests – Art. 6(1)(f) |
| Security, rate limiting, abuse detection, audit logging | Legitimate interests – Art. 6(1)(f) |
| AI-assisted analysis of your own project results | Performance of a contract – Art. 6(1)(b) |
| Marketing communications (assessment form) | Consent – Art. 6(1)(a), only where you opted in; withdraw at any time |
| Comply with legal and accounting obligations | Legal obligation – Art. 6(1)(c) |
We do not make decisions producing legal or similarly significant effects about you that are based solely on automated processing.
5. Cookies and similar technologies
The App sets only the authentication cookie that keeps you signed in (HttpOnly, 7 days, refreshed while you use the App) — strictly necessary, no consent required. The website and App use Vercel Analytics and Speed Insights for aggregate statistics; these are cookieless and do not track you across sites. We use no advertising cookies and no third-party tracking cookies. If we introduce non-essential tracking in the future, we will ask for consent first.
6. Who we share data with (processors and recipients)
We share personal data only as needed to run the App and website, with providers acting as our processors under data-processing agreements (DPAs):
- Supabase — authentication, database, and file-storage hosting.
- Vercel — application hosting, cookieless analytics.
- Resend — transactional email delivery (invitations, notifications).
- Anthropic — AI analysis of your own calculation results on the platform; Anthropic does not use this data to train its models.
- Mapbox — map display and geocoding of facility addresses.
- Sentry — error monitoring, hosted in the EU (Germany), with IP addresses and request PII minimized.
Billing and accounting data is additionally processed in Tripletex, our accounting system, to meet Norwegian bookkeeping obligations. Some providers may process data outside Norway/the EEA (for example in the United States). Where they do, transfers are safeguarded by appropriate mechanisms, such as the EU Standard Contractual Clauses and, where the provider is certified, the EU–US Data Privacy Framework. We do not sell your personal data. We may disclose data where required by law or to establish, exercise, or defend legal claims.
7. How long we keep it
- Account and project data — for the duration of the customer engagement plus 12 months, per the Data Handling and Security Policy; deletion on written request within 30 days.
- Assessment form data — 12 months; if no engagement follows, it is deleted by an automated retention routine. You may request deletion at any time.
- Security, audit, and activity logs — 12 months, then deleted by the automated retention routine.
- Billing and accounting records — five (5) years after the end of the relevant financial year, as required by the Norwegian Bookkeeping Act (bokføringsloven).
8. Your rights
Under the GDPR you have the right to: access your data; rectify inaccurate data; erase data (“right to be forgotten”); restrict or object to processing; data portability; and, where processing is based on consent (such as marketing opt-in), to withdraw consent at any time. Exercise these rights by contacting post@frontcarbon.com. We respond without undue delay and within one month, which we may extend by up to two further months for complex or numerous requests, in which case we will tell you.
You also have the right to lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet), or with the supervisory authority in your EEA country of residence or work.
9. Security
We protect personal data with encryption in transit and at rest, hashed passwords, optional multi-factor authentication, role-based access, and database-enforced row-level security — described in detail in the Data Handling and Security Policy. If a personal-data breach is likely to result in a risk to your rights and freedoms, we will notify Datatilsynet within 72 hours where required, and inform affected users without undue delay where the breach is likely to result in a high risk to them, in line with GDPR Articles 33 and 34.
10. Children
The App and website are business services intended for use by adults acting professionally. We do not knowingly collect personal data from anyone under 18.
11. Changes to this policy
We may update this policy. We will post the updated version with a new “last updated” date and, for material changes, provide reasonable notice.
12. Contact
Front Solutions AS, Agnes torg 18, 3290 Stavern, Norway · post@frontcarbon.com · organisation number 933 375 250.