Skip to content

Pilot for 20 exporters: the Evidence Pack free for your 2026 data and 50% off for 2027, in return for your feedback. Apply

CBAM Exporter Pack
English
Menu

Privacy policy

Last updated: 11 October 2026

This policy explains how Hari Krishnan, sole proprietor, Bengaluru, Karnataka 560048, India ("we"), handles personal data in CBAM Exporter Pack. We act as data fiduciary under India's Digital Personal Data Protection Act, 2023 and, for visitors in the EU, as controller under the GDPR.

What we collect

  • Account data: name, email address and a hashed password, and the names and email addresses of team members you invite.
  • Company details for approval: legal name, country, GSTIN and IEC (or the equivalent in your country).
  • Business records you upload, such as invoices, production registers and supplier reports. These are mainly business data but may contain names, signatures or contact details.
  • Data your suppliers enter through supplier links you send them, and the supplier contact details you enter so you can send them requests and reminders.
  • When you sign up: the versions of the terms and privacy policy you accepted, the time and the IP address it came from. Until you confirm your email address these details travel only inside the encrypted link we email you; nothing is stored unless you confirm.
  • Basic technical logs (IP address, time, page requested) needed for security.
  • An activity log of changes in your account (who changed what, and when), and a record of each output download with the IP address, country and browser it came from. We use the download record to decide refund requests and to stop abuse.
  • Purchase records from Dodo Payments: amount, status and invoice link (not card details).
  • View counts for buyer links you share.

The free cost calculator does not store what you type into it.

This policy also covers the hub at vedacta.com, which sets no cookies and loads nothing from other sites.

When you download, print, copy or share something from the free tools, or click a "buy me a coffee" link, the site counts that click: which button, on which page, and your country as Cloudflare reports it. No cookie, identifier or IP address is stored with the count, and nothing you typed is sent. We use the totals to decide which tools to improve. Cloudflare keeps them for 90 days.

If you use the language request form, we receive by email the language you chose and anything else you typed in it (optionally your country, email address and a message), together with the page you sent it from. We use it to decide which languages to add and, if you left an address, to reply. We keep these emails for up to 12 months and do not add you to any mailing list. Cloudflare counts requests per IP address for a minute to stop abuse; it does not store them for us. The feature request form works the same way: we receive by email what you typed (the idea, and optionally your country and email address) and keep it for up to 12 months. The pilot application form sends us your company, country, products and email address (and optionally your name, number of plants and a note); we use them only to run the pilot and keep them for up to 12 months after it ends.

If you sign up for CBAM email alerts, we keep your email address, your role (exporter or importer), the CN code and country you chose, which alerts you want and a log of the alerts we sent you. Nothing is sent until you confirm by the link we email you; an unconfirmed sign-up is deleted after 7 days. Every alert has an unsubscribe link, and unsubscribing deletes your address, choices and log at once. To stop the form being used to flood an inbox, we keep a record of each confirmation email (the address and the time) for 2 days, also for addresses that never confirm. Cloudflare counts sign-ups per IP address for a minute to stop abuse; it does not store them for us.

Advertising and cookies

The free tool pages (calculators, product checker, deadline planner and the other free tools) may show ads served by Google AdSense. Google and its partners may use cookies or similar technologies to show ads based on your visits to this and other websites. Visitors in the EEA, UK and Switzerland are asked for consent first. You can manage personalised ads at adssettings.google.com. See how Google uses data from sites that use its services. The logged-in app does not show ads.

If you make a voluntary contribution, Buy Me a Coffee processes it under its own privacy policy; we receive only your name and the amount.

Your browser's storage

Several free tools save your draft (and the supplier letter and buyer summary your company details) in your browser's local storage, on your device only, so you can continue later; the site also remembers there whether you closed the language banner. Nothing of it is sent to us. Clear it with a tool's "clear" or "start again" button or in your browser's settings. The free tools set no cookies of their own.

Why we use it

  • To provide the service you asked for (performance of our contract with you).
  • To secure the service and prevent abuse (legitimate interest; legal obligations, including CERT-In log rules).
  • To send service emails about your account. We do not send marketing without your consent.
  • To count clicks on the free tools, without any identifier, and decide which tools to improve (legitimate interest).
  • To answer a language or feature request or a pilot application you chose to send us (your consent, which you can withdraw by email).
  • To send the CBAM email alerts you signed up and confirmed for (your consent, which you withdraw with the unsubscribe link in any alert).
  • Ads: Google decides how it uses data for the ads it serves, as an independent controller; personalised ads in the EEA, UK and Switzerland need your consent.

Under India's Digital Personal Data Protection Act we process personal data with your consent, or for the legitimate uses the Act allows, such as data you give us voluntarily for a specified purpose and compliance with law.

Where your data is stored and processed

  • Paid app database (account, company, team, plants, entries, supplier and buyer links, activity and download records, purchases, email alert sign-ups): Cloudflare D1, created in Cloudflare's EU jurisdiction, so it is stored in the EU.
  • Uploaded documents: Cloudflare R2, EU jurisdiction, stored in the EU. Each file is reachable only from your account and the links you create.
  • Running the app: Cloudflare Workers. Your request enters Cloudflare's network at the data centre nearest to you (anywhere in the world) and the app code runs in Europe, next to the database. Cloudflare keeps the app's error and request logs for a few days so we can fix faults.
  • AI document reading: only when you click "Read with AI", that document is sent to Anthropic PBC in the USA, which returns the quantities it reads. Under Anthropic's commercial terms, API data is not used to train its models. Documents you do not send for reading never leave Cloudflare.
  • Emails (sign-up confirmations, password resets, team invites, company approval, purchase and refund notices, reminders you send to your suppliers, and CBAM email alerts): sent by Cloudflare Email Service; the recipient's address and the message pass through it.
  • Payments: Dodo Payments, the merchant of record when you buy the pack. It receives your name, email and payment details and processes them under its own privacy policy. We do not see or store card details.
  • Public website and free tools: served by Cloudflare from its worldwide network. What you type into the free tools stays in your browser. Cloudflare Web Analytics gives us visit statistics without cookies or cross-site tracking, and the click counts described above are kept in Cloudflare for 90 days.
  • Ads: Google (AdSense), on the free tool pages only, as described above.
  • Exchange rates: jsDelivr, a public content network. When you show a result in a currency other than euros, your browser fetches that day's rates from it. It sees your IP address, as any website you visit does, and nothing you entered.
  • Messages to us (language and feature requests, pilot applications, emails to contact@vedacta.com): delivered to our mailbox, kept as described above.

So some processing takes place outside India and outside the EU (Anthropic in the USA; Cloudflare's and Google's worldwide networks). For transfers out of the EU we rely on these providers' data processing terms, which include the European Commission's Standard Contractual Clauses; email us for details. We share data only as needed to run the service and never sell it.

How long we keep it

We keep your account and files while your account is open. A plant you delete can be restored for 30 days; after that it is removed with its documents. When you ask us to delete your account, we delete your files and data within 30 days, except records we must keep by law (such as invoices for tax purposes and security logs for 180 days).

Your rights

You can ask to access, correct or delete your personal data, withdraw consent where we rely on it, and nominate someone to exercise your rights. Under the GDPR you can also object to processing based on legitimate interest, ask us to restrict processing, and receive the data you gave us in a portable format. We make no decisions about you by automated means alone. Email contact@vedacta.com. We reply within 30 days. If you are not satisfied, you may complain to the Data Protection Board of India, your local supervisory authority in the EU, or the Information Commissioner's Office in the UK.

Grievance officer

Hari Krishnan, Bengaluru, Karnataka 560048, India, contact@vedacta.com.

Children

The service is for businesses and is not directed at anyone under 18. We do not knowingly collect children's personal data; if you think we have, email us and we will delete it.

Security

Passwords are hashed, connections are encrypted, and access to files is limited to your account and the links you create. No system is perfectly secure; we will notify you and the authorities of a breach as the law requires.