Privacy Policy

1. Overview

MetricOra ("we," "us," "our," or "Company") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your data in compliance with the UK Data Protection Act 2018 (DPA 2018), UK GDPR, and Privacy and Electronic Communications Regulations (PECR).

2. Data We Collect

2.1 Information You Provide

• Account & Auth: Email address, password hash, name, two-factor authentication setup
• Organization Data: Company name, industry, HQ country, reporting currency, organizational structure
• Emissions Data: Activity records, quantities, units, dates, supplier names, facility locations
• Location Data: UK postcodes (pickups/deliveries), GPS coordinates for field submissions, facility addresses
• Evidence: Files you upload (utility bills, invoices, delivery notes, photographs)

2.2 Information Collected Automatically

• IP address, user agent, session timestamps
• Audit log entries: actions, resource IDs, timestamps
• Device tokens for push notifications (Flutter mobile app)

3. Legal Basis

We process your personal data under the following legal bases:

• Contract: Providing emissions tracking and reporting services
• Legal Obligation: Regulatory reporting, audit log retention, data subject request (DSAR) compliance
• Legitimate Interest: Security, fraud prevention, service improvement
• Consent: Marketing emails (PECR), optional analytics

4. Data Retention

5. Data Sharing & Sub-processors

We share your data with trusted partners to deliver the service:

• Supabase: Database hosting and private file storage for evidence and reports
• Resend: Transactional email delivery
• Firebase Cloud Messaging (FCM): Push notifications (Flutter mobile app)
• Vercel: Hosting and deployment platform
• postcodes.io: UK postcode geocoding (publicly available data)
• OSRM: Route distance calculations (open-source mapping service)
• OpenFreeMap (Hungary, delivered through Cloudflare): Street map tiles from OpenStreetMap data on the dashboard and Site map. Your browser asks them for tiles directly, so they see your IP address and the area of the map you view, never your site names or figures.
• Sentry: Error monitoring (EU region)
• Stripe: Subscription billing
• Groq (USA) and Mistral AI (EU): AI-assisted wording and suggestions, only for organisations whose admin turns AI assistance on. They receive figures and document text, not names or contact details, and do not train models on it.

All sub-processors are confirmed DPA-compliant. We do not sell or rent your personal data.

6. Encryption & Security

• In Transit: TLS 1.3+ for all data transmission
• At Rest: Database and storage encryption via Supabase; application-level AES-256-GCM encryption for sensitive PII (postcodes, GPS)
• Access Control: Role-based access control (RBAC); org-scoped queries enforced server-side
• Audit Trail: Tamper-evident audit log with SHA-256 hash chaining for integrity verification

7. Your Data Rights

Under UK GDPR and DPA 2018, you have the right to:

• Access (Art. 15): Request a copy of your personal data
• Rectification (Art. 16): Correct inaccurate data
• Erasure (Art. 17): Request deletion (subject to legal retention obligations)
• Portability (Art. 20): Receive data in a machine-readable format
• Object (Art. 21): Opt-out of processing where lawful
• Restrict Processing (Art. 18): Suspend processing during dispute

To exercise these rights, email privacy@metricora.co.uk. We respond within 30 days (may extend to 60–90 days for complex requests per Art. 12). No fee is charged unless your request is manifestly unfounded.

8. International Transfers

Your data is stored with Supabase. Where data is transferred outside the UK/EEA (e.g., to Vercel, Firebase or, when AI assistance is on, Groq in the US), we rely on Standard Contractual Clauses (SCCs) and Adequacy Decisions as permitted by UK GDPR Schedule 4.

9. Data Breach Notification

If a personal data breach occurs, we will notify affected individuals and the UK Information Commissioner's Office (ICO) without undue delay and no later than 72 hours after becoming aware of the breach, as required by Article 33 GDPR.

10. Contact & Complaints

• Data Protection Officer / Privacy Queries: privacy@metricora.co.uk
• Complaints to ICO: ico.org.uk

11. Changes to Policy

We may update this policy to reflect legal, regulatory, or operational changes. Material changes will be communicated via email or in-app notification at least 30 days before taking effect.