Privacy Policy

Last updated: July 2026

This Privacy Policy describes how Verdant Inc. ("Verdant," "we," "our") collects, uses, and shares information when you access our website at verdalytiq.com or use the Verdant reporting platform (together, the "Service"). Read this alongside our Terms of Service and our Cookies Policy.

Information we collect

Account information. When you create an account, we collect your name, work email address, and your organization name. If you join through a team invitation, we also receive the workspace identifier associated with that invitation.

Usage data. We collect records of actions inside the platform: data files ingested, reports drafted, figures reviewed, and features accessed. We use this to operate and improve the Service, not to profile users for advertising.

Customer content. The operational data (energy bills, fleet fuel records, business travel data, and supplier spend), documents, and notes you upload to Verdant are your content. We store them to provide the Service and for no other purpose. Your workspace content is isolated per organization.

Device and network data. We log IP addresses, browser type, and operating system for security, abuse prevention, and debugging. This data is not sold or used for advertising.

Payment data. Billing is handled by our payment processor. We do not store full card numbers or bank account details on our own servers. Your payment details are handled entirely within the payment processor's environment.

How we use it

• To authenticate you and keep your session secure.
• To process the operational data you submit, apply the relevant emission factors and GHG methodology, and draft your carbon and ESG report in your workspace.
• To send transactional emails: account confirmations, password resets, billing receipts, and alerts you configure.
• To monitor for abuse, unauthorized access, and service errors, and to maintain the security of the platform.
• To improve report quality and the platform, using aggregated and de-identified usage patterns. We never use individual content for this purpose.
• To respond to your support requests and to comply with our legal obligations.

What we do not do

We do not train models on customer content. Your operational data uploads, notes, draft reports, and GHG inventories are never used as training data for any machine-learning model, by Verdant or by any subprocessor. When your data is sent to a third-party LLM provider to draft a report section, it is processed transiently under a data processing agreement that explicitly prohibits the provider from using that content to train or improve its models. This is a firm commitment, not a default setting.

We do not sell personal data. We do not sell, rent, or trade your personal information to data brokers, advertisers, or any third party for commercial purposes. We operate a subscription business.

We do not use your data for advertising targeting. We have no advertising revenue and no incentive to profile users for ad networks. We do not share data with advertising platforms.

Data storage and security

Your data is stored on infrastructure hosted in the United States. We apply encryption in transit (TLS 1.2 or higher) and at rest (AES-256). Access to production data is restricted to authorized personnel on a need-to-know basis and is logged. For a full description of our technical and organizational security controls, see our Security page.

Retention and deletion

We retain your account data and workspace content for as long as your account is active. If you close your account, we delete your personal data and content within 30 calendar days of the closure request, except where we are required to retain records for tax, legal, or fraud-prevention purposes.

To request deletion of your data without closing your account, contact us at privacy@verdalytiq.com. We will respond within 5 business days to confirm the request and within 30 calendar days to complete it.

Your rights

Depending on your jurisdiction, you may have the right to access, correct, export, or delete your personal data. To exercise any of these rights, contact us at privacy@verdalytiq.com. We respond within 30 calendar days. We do not charge a fee for handling rights requests in good faith.

• Access. Request a copy of the personal data we hold about you, including account information and usage records.
• Correction. Ask us to correct inaccurate or incomplete personal data.
• Export. Request a machine-readable export of your workspace content, including operational data files, draft reports, and GHG inventory figures.
• Deletion. Ask us to delete your personal data, subject to retention obligations imposed by law.
• Objection. Object to certain uses of your data. Where we rely on legitimate interests as a legal basis, you may object and we will assess whether our interests override yours in the circumstances.

Users in the European Economic Area have rights under the General Data Protection Regulation (GDPR). Users in California have rights under the California Consumer Privacy Act (CCPA). We honor those rights regardless of where a request originates.

Cookies

We use cookies for session management and authentication only. These are strictly necessary for the Service to function and do not require your consent under applicable cookies frameworks. We do not use cookies for analytics, advertising, or cross-site tracking. For the full list of cookies we set, their purposes, and their durations, see our Cookies Policy.

Subprocessors

We use a limited set of third-party services to operate the platform. Each subprocessor is bound by a data processing agreement that restricts them to handling your data only as we direct and in compliance with applicable privacy law.

Categories of subprocessors we use include: cloud infrastructure and storage, payment processing, transactional email delivery, application error monitoring, and LLM model providers that are used to draft carbon and ESG report sections from the operational data you supply. Verdant is model-agnostic and routes report drafting across one or more LLM providers depending on your workspace configuration. In every case, the applicable data processing agreement prohibits the provider from using your content to train or improve its models.

We do not share your content with any subprocessor except as strictly necessary to deliver the feature you are using. A current list of subprocessors is available on request at privacy@verdalytiq.com.

International users

Verdant is operated from the United States and our infrastructure is located in the United States. If you access the Service from outside the United States, your information will be transferred to and processed in the United States. For transfers from the European Economic Area or the United Kingdom, we rely on standard contractual clauses as the legal transfer mechanism.

Users in the European Economic Area and United Kingdom have rights under the GDPR and the UK GDPR respectively. Users in California have rights under the CCPA. We honor those rights regardless of where a request originates.

Children

The Service is intended for sustainability, operations, and finance professionals at mid-market companies and is not directed at anyone under 18 years of age. We do not knowingly collect personal data from minors. If we become aware that we have done so, we will delete it promptly.

Changes to this policy

If we make material changes to this Privacy Policy, we will notify account holders by email at least 14 days before the changes take effect. The "Last updated" date at the top of this page reflects the most recent revision.

Contact

For privacy questions, data requests, or to report a concern, contact us at privacy@verdalytiq.com or by post at:

Verdant Inc.
Attn: Privacy
1908 Pearl Street, Suite 210
Boulder, CO 80302
United States