Privacy policy

Granular is a free sustainability and ESG tool for UK organisations. It is run by Kyle Nicholas Vincent, who is the “controller” of your personal information for the purposes of data protection law — that means deciding how and why it is used. You can contact us about anything in this policy at info@granularesg.com.

If you use Granular without signing in

Your questionnaire answers, action progress and carbon estimates are saved only in your own web browser (its “local storage”). They are not sent to us and we cannot see them. Clearing your browser data deletes them.

If you sign in

When you create an account, we store the following in our database so you can pick up where you left off on any device:

• your email address (used to send you sign-in links)
• your organisation's name, country and sector
• your questionnaire answers, including earlier completed questionnaires so you can see progress over time
• which actions on your dashboard you have marked as in progress or done
• the figures you enter into the carbon estimator, the estimates you save for different periods, and any carbon target you set
• basic account records, such as when your account was created and which organisation you belong to

Most of this is information about your organisation rather than about you personally, but we treat all of it carefully. Please don't enter personal information about other people into free-text answers.

Visiting the website

We use Vercel Web Analytics to count visits. It records things like which pages are viewed, the site that referred you, and your browser, device type and country. It does not use cookies and is not used to identify you or follow you across other websites. Like all websites, our hosting and database providers also keep short-lived technical logs (such as IP addresses) to run the service and keep it secure.

Data protection law requires us to have a valid reason, called a “lawful basis”, for each way we use personal information.

• To provide the service you asked for — creating your account, sending sign-in emails, and saving and showing your answers, actions and carbon estimates. Lawful basis: contract (it is needed to give you the service you signed up for).
• To understand how the site is used through cookieless analytics, so we can improve it. Lawful basis: legitimate interests (we have a genuine reason to understand which pages help people, and the data is minimal and not used to identify you).
• To keep the service secure and working through technical logs. Lawful basis: legitimate interests.

We do not sell your information, use it for advertising, or make automated decisions about you that have legal or similar effects.

We use two trusted service providers (“processors”) who handle data on our behalf and only on our instructions:

• Supabase — runs our database and sends sign-in emails. Your account data is stored in its EU (Ireland) region.
• Vercel — hosts the website and provides the cookieless analytics described above.

We would only share information with anyone else if the law requires it.

Our database is in the EU (Ireland), which the UK recognises as giving an adequate level of protection. Vercel is a US company, so some data — for example website traffic and analytics — may be handled in the United States. Where data leaves the UK, our providers use recognised legal safeguards, such as the UK's approved data transfer agreements and standard contractual clauses, to protect it.

• Sign-in cookie — if you sign in, we set a cookie that keeps you signed in. It is strictly necessary for the account to work.
• Browser storage — Granular saves your answers and progress in your browser's local storage so the tool works without an account. This is strictly necessary for the features you use. Signing out removes it from that browser.
• Analytics — uses no cookies and stores nothing on your device.

We do not use advertising or tracking cookies. Because everything we store is strictly necessary, we don't need to ask for cookie consent.

We keep your account information for as long as your account exists. If you ask us to delete your account, we will delete your account and your organisation's saved data. Answers saved only in your browser stay there until you clear them or sign out.

Under UK GDPR you have the right to:

• ask for a copy of the personal information we hold about you
• ask us to correct information that is wrong or incomplete
• ask us to delete your information
• ask us to limit how we use it, or object to us using it (including for analytics)
• ask for your information in a format you can take to another service

To use any of these rights, email info@granularesg.com. We will reply within one month. There is normally no charge.

If you are unhappy with how we have handled your information, please contact us first at info@granularesg.com so we can try to put it right. You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator, at ico.org.uk.

If we change how we use your information, we will update this page and the “last updated” date at the top.