Privacy Policy

1. Introduction

Climate Data Inc., doing business as Terralyn ("Terralyn," "we," "us," or "our"), is a sustainability consulting firm. We prepare sustainability reports, disclosures, and related analysis for our clients as a service, and we run the sustainability analyst platform our team uses to do that work. Clients access the platform as their client portal. This Privacy Policy explains what personal information we collect, how we use and share it, and the rights you have. In this Privacy Policy, "Service" means the Terralyn platform, including terralyn.ai and the Terralyn application; "Services" means the professional services we perform for a client under a services agreement or statement of work; and "Deliverables" means the reports, disclosures, and other work product we prepare for a client under the Services. "Customer Data" has the meaning given in Section 2; "Outputs" has the meaning given in Section 8 of the Terms and Conditions. Where a capitalized term is used but not defined in this Privacy Policy, it has the meaning given in our Terms and Conditions.

This policy applies to terralyn.ai, the Terralyn application, and the personal data we handle while performing the Services. It does not apply to third-party services linked from or integrated with the Service; those services are governed by their own privacy practices.

2. Our Role: Controller and Processor

Terralyn handles personal data in two distinct roles, and different rules apply to each.

Terralyn as controller
We are the controller of personal data we collect for our own purposes: your account information, billing data, website form submissions, website and product usage data, support communications, and marketing contacts. Sections 3, 5, and 6 describe this data. This Privacy Policy governs it.

Terralyn as processor
Content that you or your organization upload to the Service, or that you provide to Terralyn and Terralyn uploads to or generates in the Service on your organization's behalf while performing the Services (Vault documents, prompts and chat inputs, attachments, Memory, Outputs, and Deliverables, together "Customer Data"), may contain personal data about other people, such as your organization's employees, suppliers, or contacts. For personal data inside Customer Data, our customer (typically your employer) is the controller and Terralyn is a processor. We process it only to provide the Service and perform the Services, under the customer's instructions and our Data Processing Addendum.

If your personal data appears in Customer Data uploaded by or for a Terralyn customer and you want to exercise privacy rights over it, contact that customer directly; they control that data. If you contact us instead, we will notify the customer and assist them in responding.

3. Information We Collect as Controller

3.1 Information you provide

• Account information: name, email, hashed password, organization, job title, phone (optional).
• Billing information: invoicing contact details and payment records for your organization's engagement. Where we accept card payment, it is processed by Stripe and we store a customer ID, payment status, and last four card digits. We do not store full card numbers.
• Website forms: when you book a working session or download a guide on terralyn.ai, we ask for your first name, last name, work email, company, country, and how you heard about us, plus anything you write in a message field. Section 3.4 is the notice at collection for these forms.
• Support and feedback communications.

3.2 Information collected automatically

• Usage data: pages viewed, features used, prompt metadata (length, timing, model selection, not content), actions taken, error logs.
• Device and connection: IP address, browser, operating system, device identifiers.
• Cookies and similar technologies: see Section 12 and our Cookie Policy.
• Email engagement data: whether and when you open a marketing email we send and which links you click, where tracking applies. See Section 12 and our Cookie Policy, Section 9.

3.3 Information from third parties

• OAuth and integration partners share data you authorize (see Sections 7.3 and 8).
• Emission factor and regulatory reference data licensed from providers. We do not share your account information with them.
• Publicly available professional information when you engage with our sales or marketing outreach.

3.4 Notice at collection for our website forms

This section is the notice at collection for the working-session booking form and the guide download form on terralyn.ai.

• What we collect: identifiers and contact details (first name, last name, work email, company, country, how you heard about us) and anything you write in a message field. Both forms ask for the same details. We do not collect sensitive personal information through these forms.
• Why: to send you the guide you requested; to reply to you and schedule and run your working session; to keep a record of the enquiry in our CRM; to understand which channels bring us enquiries; and, if you tick the marketing box, to send you the Terralyn updates described in Section 17 and to measure opens and clicks on those emails as described in Section 12.
• Sold or shared: we do not sell the information you enter in these forms, and we do not share it for cross-context behavioral advertising. Separately, if you have accepted marketing cookies, our advertising tags may share identifiers as described in Section 7.1.
• How long: enquiry records for 36 months after our last contact with you, unless your organization becomes a client or you ask us to delete them sooner; marketing contacts as set out in Section 11.
• Your rights: see Section 13, including how to opt out of sale or sharing.

4. Customer Data We Process on Your Organization's Behalf

As described in Section 2, we process the following as a processor for our customer:

• Vault content: documents, spreadsheets, PDFs, utility bills, supplier responses, bills of materials, datasets, and other files you upload or provide to us for the Services.
• Prompts and chat inputs: text, attachments, and context submitted to the AI interface.
• Outputs: reports, models, spreadsheets, and other content generated by the Service from your inputs.
• Memory and preferences: preferences and prior context that personalize responses for your account.
• Deliverables: reports, disclosures, and other work product we prepare for your organization under the Services, and the provenance package that records how they were produced.

Sensitive personal information
Terralyn does not collect sensitive personal information for its own purposes. Where a customer's sustainability reporting requires sensitive data in Customer Data (for example, workforce metrics under certain ESG frameworks), the customer decides to include it, remains the controller for it, and Terralyn processes it strictly as a processor under the Data Processing Addendum. We never use sensitive personal information for our own purposes.

5. How We Use Information

• Provide the Service: authenticate, process prompts and files, generate Outputs, store Vault and Memory, deliver integrations.
• Perform the Services: prepare Deliverables for our clients using the Service, including collecting client files, structuring data, drafting, review, and delivery through the client portal.
• Billing and account management.
• Customer support and communications.
• Security: detect abuse, prevent fraud, maintain platform integrity.
• Improve the Service: diagnose errors, measure feature performance, develop new capabilities. We do not train AI models on Customer Data (see Section 9).
• De-identified and aggregated data: we may create and use de-identified, aggregated statistics (for example, feature adoption rates or total reports generated) for product improvement and reporting. We commit not to attempt to re-identify de-identified data, and this never involves training AI models on the content of Customer Data.
• Marketing, with consent or where permitted: updates on our sustainability reporting and advisory services, guides, benchmarks, webinars, academy content, and platform news, including measuring whether marketing emails are opened and which links are clicked where tracking applies (see Section 12).
• Direct outreach: if you engage with our content on LinkedIn or visit our website, we may contact you via email or LinkedIn direct message about Terralyn services and resources. You can opt out at any time.
• Legal and compliance: comply with law, respond to lawful requests, enforce our Terms.

6. Legal Basis (GDPR and UK GDPR)

For users in the EU, EEA, UK, and Switzerland we process personal data under:

• Contract: to provide the Service you request and to perform the Services your organization has engaged us for.
• Legitimate interest: service improvement, security, fraud prevention, B2B direct marketing, and measuring opens and clicks on our marketing emails where consent is not required, in each case subject to an easy opt-out mechanism.
• Consent: non-essential cookies, email open and click tracking where consent is required, marketing emails to people who tick the marketing box on our website forms, marketing to new contacts, optional features.
• Legal obligation: tax, fraud, and regulatory requirements.

You can withdraw consent at any time. Withdrawing consent does not affect processing performed before withdrawal.

7. Sharing and Disclosure

7.1 Advertising

We do not disclose personal data to data brokers. On our public website we use advertising tags from Google (Google Ads) and LinkedIn. These tags set cookies and are used for advertising only if you accept marketing cookies; their advertising uses include measuring our campaigns and showing Terralyn ads to relevant audiences. We may also share personal data, such as your email address, with these providers to show Terralyn ads on other sites, with your consent where the law requires it. You can review how each provider handles the data it receives in the Google and LinkedIn privacy policies. Under California and several other US state privacy laws, this use can qualify as "sharing" (or a "sale") of personal information for cross-context behavioral advertising. You can withdraw consent or opt out at any time through the Cookie Settings link on our website. See Section 13.3 for your rights under California and other US state privacy laws.

7.2 Service providers

We share data with vendors who operate the Service on our behalf under data processing agreements that restrict use to providing services to us.

The named list of sub-processors that process Customer Data, with their locations and transfer mechanisms, is published in Annex A of our Data Processing Addendum. Vendors that process personal data for which Terralyn is the controller, such as payment processing, marketing communications, website analytics, and cookie consent management, are not sub-processors of Customer Data and are not listed there.

7.3 Integrations you enable

If you connect Google Workspace, Microsoft 365, Slack, or other integrations, data flows as you authorize those integrations. Google user data is subject to the additional limits in Section 8.

7.4 Legal disclosures

We may disclose data when required by law, to protect rights and safety, to enforce our Terms, or to cooperate with lawful requests from authorities.

7.5 Business transfers

In a merger, acquisition, financing, or sale of assets, data may be transferred. We will provide notice and, where required, an opportunity to object.

8. Google User Data and Limited Use

The Service offers Sign in with Google and a Google Drive integration (including Docs, Sheets, and Slides).

What we access
If you sign in with Google, we receive your name, email address, and basic profile information to sign you in to the account we have set up for you. The Google connection is used to sign in only; it does not create new accounts. If you connect Google Drive, we access the files you select or authorize so you can import them into your Vault and use them in the Service.

How we use it
Google user data is used only to provide and improve user-facing features of the Service: authentication, and importing and processing the Drive files you choose. We do not use Google user data for advertising of any kind. Your account email address, whether you provide it directly or it is collected through Sign in with Google, is maintained as part of your Terralyn account and may be used for marketing and advertising as described in this Privacy Policy, including Section 7.1, with opt-out available at any time. We do not allow humans to read this data unless we have your affirmative agreement for specific files, it is necessary for security purposes such as investigating abuse, it is required to comply with applicable law, or the data has been aggregated and anonymized for internal operations. We do not transfer Google user data to others except as necessary to provide these features, to comply with applicable law, or as part of a merger, acquisition, or sale of assets.

Limited Use statement
Terralyn's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

9. AI Processing, Training, and Automated Decision-Making

AI system notice
The Service is an AI system under the EU AI Act, the Texas Responsible Artificial Intelligence Governance Act, Colorado's Automated Decision-Making Technology Act from January 1, 2027, and equivalent laws. When you interact with Terralyn, you are interacting with AI.

How AI is used
Your prompts, files, and selected context are sent to AI model providers to generate Outputs. Processing occurs primarily in the United States on encrypted infrastructure; sub-processor locations are listed in Annex A of our Data Processing Addendum.

No training on your data
Terralyn does not train AI models on Customer Data. Our AI providers do not use Customer Data for model training. Provider retention of prompts and files is limited to what is needed to operate and secure their services, and is described in Annex A of our Data Processing Addendum.

Memory
Memory stores preferences and prior context to personalize responses for your account. You can view, edit, export, and delete Memory in account settings.

Human oversight
Outputs are draft and decision-support. You control how and whether to rely on them. Where Terralyn prepares a Deliverable for your organization under the Services, a qualified member of the Terralyn team reviews and approves it before delivery. Your organization holds editorial responsibility for anything it publishes, files, or submits, and your services agreement records this.

Automated decision-making
We do not use Customer Data to make automated decisions about you that produce legal or similarly significant effects. The Service is not designed or authorized to be used as the sole basis for consequential decisions about natural persons (for example, in employment, housing, credit, insurance, education, or government benefits). Use of the Service for such purposes is prohibited under our Terms.

Labeling
Where required by law (including EU AI Act Article 50), Outputs are identifiable as AI-generated. You are responsible for downstream disclosure obligations if you distribute Outputs further.

10. Data Security

We use administrative, technical, and organizational controls including:

• Encryption: TLS 1.2+ in transit, AES-256 at rest.
• Access controls: role-based access, SSO support, multi-factor authentication for administrative access.
• Tenant isolation: logical separation of Customer Data.
• Security monitoring and incident response.
• Vulnerability management and periodic third-party assessments.

No system is fully secure. We will notify affected users and regulators of a security incident as required by applicable law.

11. Data Retention

Where your organization has engaged us for the Services, the three Services rows above govern the files, Deliverables, and provenance package for that engagement, in place of the general account rows. Backup copies follow our standard rotation, generally not exceeding 180 days after primary deletion. Customer Data retention is additionally governed by the customer's instructions under the Data Processing Addendum and, for the Services, the services agreement.

12. Cookies and Tracking

We use:

• Essential cookies (always on): authentication, session management, security.
• Analytics cookies on our public website only (consent-based outside the US): website usage analytics.
• Marketing cookies on our public website only (consent-based outside the US): targeted advertising and campaign measurement via Google Ads and LinkedIn.
• Tracking pixels and tracked links in marketing emails: off for recipients in France and Italy, and where we cannot confirm your location, unless you have turned tracking on; you can switch tracking on or off at any time through the "Tracking preferences" link in our emails.

Manage preferences through the cookie banner on first visit or the Cookie Settings link in the footer. See our Cookie Policy for specifics, including cookie names, providers, durations, and email tracking.

13. Your Rights

13.1 All users

• Access, correct, export, and delete your personal data.
• Opt out of marketing communications.

13.2 GDPR and UK GDPR rights

• Access, rectification, erasure, restriction, portability.
• Object to processing based on legitimate interest, including direct marketing.
• Withdraw consent.
• Lodge a complaint with your supervisory authority.

13.3 CCPA and CPRA (California)

• Right to know, delete, correct, and opt out of the "sale" or "sharing" of personal information.
• Right to limit use of sensitive personal information. Terralyn does not collect or use sensitive personal information for its own purposes (see Section 4).
• Right to non-discrimination.

You can opt out of the "sale" or "sharing" of your personal information at any time through the Cookie Settings link in our website footer, a Global Privacy Control signal, or by emailing privacy@terralyn.ai.

Global Privacy Control (GPC)
We treat a Global Privacy Control browser signal as a valid request to opt out of the "sale" and "sharing" of personal information and of processing for cross-context behavioral advertising or targeted advertising, to the extent required under California, Colorado, Connecticut, Texas, and other US state privacy laws. The opt-out applies to the browser and device from which the signal is received; signed-in users may also set account-level preferences via privacy@terralyn.ai.

CCPA categories of personal information collected in the preceding 12 months (in our role as controller):

Of these categories, identifiers and internet or network activity may be "shared" with our advertising partners as described in Section 7.

13.4 Other US states

Residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Delaware, New Hampshire, New Jersey, Minnesota, Maryland, Indiana, Iowa, Kentucky, Nebraska, Tennessee, Montana, Rhode Island, and other states with comprehensive privacy laws have rights to access, correct, delete, port, opt out of targeted advertising and sale, and appeal denied requests. Exercise rights via privacy@terralyn.ai.

13.5 Exercising rights

Email privacy@terralyn.ai or use in-product controls where available. We verify requests to protect your data. We respond within 45 days under California and most other US state privacy laws (extendable once by a further 45 days where reasonably necessary, with notice to you), and within one month under GDPR and UK GDPR (extendable by two further months for complex or numerous requests, with notice to you). Authorized agents may submit on your behalf with verifiable authorization. If you are in the UK and want to complain about how we handle your personal data, email privacy@terralyn.ai; we acknowledge complaints within 30 days and respond without undue delay.

If your personal data is contained in Customer Data controlled by a Terralyn customer, we will refer your request to that customer and assist them (see Section 2).

13.6 Canada (PIPEDA and Quebec Law 25)

Canadian residents have rights of access, correction, and withdrawal of consent under PIPEDA. Quebec residents additionally have rights of data portability, the right to be informed of and object to automated decision-making, and the right to request de-indexation where applicable, under the Act respecting the protection of personal information in the private sector ("Law 25"). Exercise rights via privacy@terralyn.ai. You may also complain to the Office of the Privacy Commissioner of Canada or, for Quebec residents, the Commission d'accès à l'information du Québec.

14. International Transfers

Terralyn is based in the United States, and personal data is processed primarily in the United States. For transfers from the EU, EEA, UK, and Switzerland, we rely on the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, the Swiss Federal Data Protection and Information Commissioner's SCC recognition, and any other lawful transfer mechanism available to us from time to time. We apply supplementary technical and organizational measures, including encryption in transit and at rest, access controls, and contractual restrictions on sub-processor access, as appropriate to the transfer.

15. Children

The Service is for business use by individuals 18 and older. We do not knowingly collect personal data from children under 16 (EU) or 13 (US). If you believe a child has provided data, contact privacy@terralyn.ai and we will delete it.

16. Third-Party Links

The Service may contain links to third-party sites. Their privacy practices are their own.

17. Marketing and Direct Outreach

Email
We send marketing emails to people who tick the marketing box on our website forms, to clients and existing business contacts under legitimate interest where the law allows it, and otherwise with consent. They cover our sustainability reporting and advisory services, guides, benchmarks, webinars, academy content, and platform news. Every marketing email includes an unsubscribe link, and you can unsubscribe at any time. Unsubscribe requests are honored within the timeframe required by applicable law. Marketing emails may contain a tracking pixel and tracked links, used as described in Section 12 and our Cookie Policy.

Canada (CASL)
Commercial electronic messages to Canadian recipients are sent only with express or implied consent under Canada's Anti-Spam Legislation. Each message identifies Terralyn, discloses a valid postal address, and provides a working unsubscribe mechanism that we honor within 10 business days.

LinkedIn direct messages
For prospects who have engaged with our content (for example, by commenting on a LinkedIn post or visiting our site), we may send direct messages on LinkedIn related to Terralyn offerings. Each message identifies Terralyn, states its commercial purpose, and provides an opt-out ("reply stop," or email privacy@terralyn.ai). For recipients in the EU, EEA, or UK, we rely on legitimate interest with a documented LIA, limit frequency, and cease contact immediately on objection.

Transactional communications
Account, security, and billing messages are not opt-outable while your account is active.

Do-not-contact list
On request we will add you to a suppression list that prevents future outreach even if your data is re-acquired from a public source.

18. California "Shine the Light"

California residents may request information about disclosure of personal information to third parties for those third parties' direct marketing purposes. We do not disclose personal information to third parties for their direct marketing.

19. Changes to This Policy

We will post updates with a new "Last Updated" date. Material changes will be notified by email and in-product banner at least 30 days before they take effect, except where a shorter notice is required by law. We will not apply changes retroactively to data collected under a prior policy in a way that is materially different from the policy in effect at collection, without your consent.

20. Supervisory Authorities

EU, EEA, UK, and Swiss users may contact their local data protection authority. US state residents may contact their state attorney general. California residents may contact the California Privacy Protection Agency.

21. Contact

Climate Data Inc. (DBA Terralyn)

• Address: 3001 Bishop Dr., Suite 300, San Ramon, CA 94583 US
• Privacy and Data Protection: privacy@terralyn.ai
• Legal: legal@terralyn.ai
• Security reports: security@terralyn.ai
• Website: https://terralyn.ai/privacy-policy

22. Summary (non-binding)

• Your Customer Data is yours. We process it only to operate the Service for you, as a processor under your organization's instructions and our Data Processing Addendum.
• We do not train AI models on your data, and our AI providers do not train on it.
• We do not sell your data to data brokers. We use Google and LinkedIn advertising tags to promote Terralyn, and you can opt out anytime through Cookie Preferences.
• You can access, export, and delete your data at any time.
• Client accounts are set up by Terralyn as part of an engagement; there is no public signup.
• When we prepare a report for you, a Terralyn team member reviews it before delivery.
• We are transparent about AI use, human oversight, automated decision-making, and your rights.