Privacy

What we collect and why

Last updated 5 October 2026. Cognivara Knowledge and Impact Private Limited ("ClimateFluent", "we") is the data controller.

1. What we collect

• Application: name, email, phone, LinkedIn URL, company, designation, and your answer to the one application question, plus anything you add in the optional fields.
• Enrolment: the above plus your submissions, feedback, attendance and certificate record while you are a participant.
• Site usage: which pages are viewed, when, from which country and city (from Cloudflare, not your IP address), the page that linked to us, and the campaign tags in the link. Each browser gets a random id in a cookie so we can count visits and see which page led to an application. We do not store IP addresses. Google Analytics and Microsoft Clarity run on the public site as well; section 4 has the detail and the opt-outs.
• ChatGPT and Claude plugin: your email address and how many checks you have run. Section 8 gives the detail.

2. Why

• To review your application and decide on a place.
• To run the programme: sessions, recordings, deliverables, feedback, certificates.
• To send you emails about your application and the programme. We do not send marketing email without asking first.
• To issue invoices and meet tax obligations.

3. Where it lives and who processes it

• Our application and database run on Cloudflare (Workers, D1, R2), stored in the Asia-Pacific region.
• Email is sent through Resend. Session recordings are hosted as unlisted YouTube videos. Live sessions use Google Meet.
• Applications are mirrored to a Google Sheet we control, for review.
• Site usage records are stored in our own Cloudflare R2 bucket and analysed by us. Google LLC and Microsoft Corporation process the Google Analytics and Clarity data in the United States (section 4).

4. Analytics and cookies

Three things measure how the public site is used. Google Analytics and Clarity never run on the learning platform or in the evidence workspace.

• Our own analytics. One first-party cookie, cf_vid, a random id that lasts a year. It lets us count visits and see which page led to an application. The records (page, time, country and city from Cloudflare, referring page, campaign tags) are stored in our own Cloudflare R2 bucket in the Asia-Pacific region and seen only by us. No IP address is stored and nothing is shared. On the platform, in the evidence workspace and in the ChatGPT and Claude plugin we record the steps people take, such as signing in, importing a questionnaire, opening the first result, uploading a document, signing the gates, asking for a review and which plugin tool ran, by account number and with short codes (a document type, a size band, a rule id). These records never hold your name, email address, company name, file names or file contents; we use them to see where people get stuck. To switch it off in your browser, open climatefluent.com/?notrack once; /?track switches it back on.
• Google Analytics 4 (Google LLC, United States). Pseudonymous usage data: pages, events such as opening the application form, device and coarse location; Google truncates the IP address before storing it. We keep event data for 14 months. Opt out with Google's browser add-on.
• Microsoft Clarity (Microsoft Corporation, United States). Recordings of how pages are used, scrolling, clicks, mouse movement and the page structure, plus heatmaps. Text you type into forms is masked and never recorded. Our own visit id and any campaign tag in the link are attached to the recording, and Clarity's session id is stored with our visit record, so that we can match a recording to a visit; none of this identifies you. Recordings are kept for 30 days and heatmaps for 13 months. Microsoft's privacy statement applies to its processing.

In the European Union, the EEA, the United Kingdom and Switzerland, Google Analytics and Clarity load only after you choose OK on the bar at the foot of the page, and your choice is kept in a cookie (cf_consent) for a year, or 180 days if you declined. Elsewhere this page is the notice, as the applicable laws provide. Our own analytics run everywhere; the opt-out above applies everywhere.

Lawful basis: our legitimate interest in understanding how the site is used, and your consent where the law requires it. Site usage data is never used to make decisions about an application.

5. Retention

• Unsuccessful or withdrawn applications: deleted within 12 months.
• Participant records and certificates: kept so that certificates can be verified. Ask us and we will delete everything except the minimum needed to keep a certificate verifiable.

6. Your rights

Email hello@climatefluent.com to see, correct or delete your data, or to withdraw an application. We reply within five working days.

7. Watermarks

Recordings you watch on the platform display your name and email. This is how we keep recordings from being shared outside the cohort.

8. ChatGPT and Claude plugin

• Independent of EcoVadis. ClimateFluent prepares your evidence; EcoVadis does the rating. EcoVadis is a trade mark of EcoVadis SAS; we are not affiliated with or endorsed by it.
• What we collect. The email address you sign in with, when you first and last signed in, and how many checks you have run and have left. The figures you give the CBAM, EcoVadis readiness, GHG and GRI checks (product, tonnes, documents held, country, report topics) are used to work out the result and are not stored. If you press “Email me this result”, the text of that result is emailed to you and to our team inbox.
• EcoVadis assessment workflow. If you start an assessment, we keep it so you can continue later: the company name and any other names it uses, the reference date, the impact label for each theme and question, the question codes from the questionnaire text you paste, and that questionnaire's question and answer wording, stored on your own assessment only, visible only to you, never pooled with other users' or reused (including to write our guidelines), and deleted with the assessment when you ask us to delete it; your own document names and page numbers from that text; for each document you discuss, the facts the assistant reads from it (type, title, issue and expiry dates, the company name as printed, file type and size, page count, reporting year, issuer); your yes or no answers to the three checks on each document; the actions in your plan (question code, effort, impact, owner, status); and, where the assistant proposes a reading of a document, short quotations from it (up to 160 characters each) with the page they come from and the name of the assistant that read it, deleted with the document. Apart from those short quotations, through the plugin we never receive or keep the document files or their text; the evidence workspace (section 9) is different.
• Why. To sign you in, to count your checks, to send you a result you ask for, so a mentor can reply to it, and to keep your EcoVadis assessment and plan for when you come back.
• Who receives it. Cloudflare runs the plugin and its database (Asia-Pacific region) and keeps technical request logs for 3 days. Resend delivers the emails. We do not sell your data, share it for advertising, or use it to train models. OpenAI and Anthropic handle your conversation under their own policies.
• How long we keep it. Your sign-in record and any EcoVadis assessment stay while you use the plugin. Ask us and we delete them within 30 days. An emailed result is kept in our team inbox for up to 24 months, then deleted.
• Your controls. You choose whether to email a result. You can disconnect ClimateFluent at any time in ChatGPT or Claude settings. To see, correct or delete your data, write to hello@climatefluent.com; we reply within five working days.

9. Evidence workspace

• What we hold. When a consulting firm or a company uses our evidence workspace, we hold what they put into it. That is: the names of the firm and its client companies, any other names those companies trade under, and their size; the people who sign up for it or are invited to it (name, email address, role, and the themes they work on; a sign-up gives only the company name and a work email); the files they upload, with the facts recorded for each (title, type, issue and expiry dates, the company name printed on it, page numbers, file type and size, who uploaded it and when); the question codes and impact labels from the questionnaire export they paste or upload, that questionnaire's question and answer wording, and the answers already in it (which options are ticked, who is assigned, document names, comments, page numbers, previous validity dates and previous rejection reasons), stored on that project only, visible only to the project's members (contributors for their themes) and the ClimateFluent staff who run the workspace, never pooled across clients or reused (including to write our guidelines), and deleted with the project or company; each person's yes or no on the three checks for a document, with who answered and when; where an assistant proposes a reading of a document, short quotations from it (up to 160 characters each) with their page and the name of the assistant, deleted with the document, project or company; the corrective action plan (question code, effort, impact, owner, status); and a log of who uploaded, linked, signed, invited or removed what, or asked for a review, and when.
• How a file is read. When a file is uploaded, Cloudflare's Workers AI converts it to text once, so that we can suggest the dates and the company name printed on it. That text is discarded straight away and never stored. When a workspace member asks their AI assistant (ChatGPT or Claude) to read a workspace file, we convert it to text the same way and send that text to the assistant for that request only; we do not keep the text. The file itself is kept in a private store and served only to signed-in members of that company with access to it, and to the ClimateFluent staff who run the workspace.
• On whose behalf. We hold workspace content on the instructions of the firm or company that set up the workspace, and only to run the workspace for them. Members see only the companies they are added to; contributors see only their themes. ClimateFluent staff who run the workspace, our mentors and rule editors, can open any workspace to answer a review request or to help; what they change is in the activity log under their name.
• Who receives it. Cloudflare hosts the workspace, its database and file store, and keeps technical request logs for 3 days. Resend delivers invitation and sign-in emails. We do not sell this data, share it for advertising, or use it to train models.
• How long we keep it. Workspace content stays while the firm or company uses the workspace. When they ask, or within 90 days of the engagement ending, we delete the files and records, except the minimum we must keep by law. A removed member loses access at once; the activity log keeps what they did.
• Your rights. If you signed up for or were invited to a workspace, write to hello@climatefluent.com to see, correct or delete your data. Where the content belongs to your employer or client, we act together with them.

10. Changes

If this policy changes materially we will email current participants.