Privacy Policy

1. Who we are

METIMO is a trading name of Calculate My Product Carbon Footprint Ltd (company number 11820814), registered at 11b Newton Court, Pendeford Business Park, Wolverhampton, West Midlands, WV9 5HB, United Kingdom. We are the data controller for personal data processed through the individual app. For company reporting features, we act as a processor on behalf of your employer (see section 8). Our ICO registration reference is ICO:00015440175.

We help you and your employer understand the greenhouse gas emissions from your commute, using UK Government (DESNZ) conversion factors. If you have any question about this policy or your data, contact us at privacy@metimo.io.

2. The data we collect

Depending on how you use METIMO, we collect the following categories of personal data:

• Account details: your name, email address, and a securely hashed password.
• Commute profile: your home postcode, your employer name and postcode, your approximate one-way commuting distance, the transport modes you use, and your typical working and work-from-home days.
• Commute activity: your weekly check-ins, calculated carbon emissions, holidays, and participation in low/no-carbon commute campaigns.
• Offset records: the offsets you purchase, the amount, and the certificate issued. Card payments are handled directly by Stripe — we never see or store your full card details.
• Usage data: basic technical information such as device type and pages visited, used to keep the service secure and working.

We use your home postcode only to estimate commuting distance. We do not track your live location. Please do not enter special category data (such as health information) into free-text fields.

3. How we use your data

• To provide the service: create your account, calculate your commuting carbon footprint, and show your history.
• To process carbon offsets and issue your certificates.
• To send service emails such as sign-in, invitations, password resets, and offset confirmations.
• To send you a weekly commute check-in reminder if you have not confirmed a past week, so you do not lose credit for commutes you made. These are optional and you can turn them off at any time (see section 4).
• To provide aggregated Scope 3 Category 7 reporting to your employer where you are part of a company account.
• To improve, secure, and troubleshoot the service.

4. Legal bases for processing

Under UK GDPR we rely on: performance of a contract (to provide the app you signed up for); our legitimate interests (to secure, maintain, and improve the service, and to help employers measure and reduce commuting emissions); your consent (where required, which you can withdraw at any time); and legal obligation (for example keeping records of transactions).

Creating a METIMO account and logging your commute is voluntary. Even where your employer offers METIMO, you choose whether to sign up and take part, and you can stop and delete your data at any time. If you choose not to take part, your employer's reporting simply uses estimated or roster-based figures for unconfirmed employees instead of your personal data.

We apply the data minimisation principle in Article 5(1)(c) of the UK GDPR: we collect and expose only the personal data needed for each purpose. In particular, employer administrators are shown aggregated reporting rather than individual employees' commute data (see section 8).

Where we rely on legitimate interests, we have carried out a Legitimate Interests Assessment (LIA) balancing those interests against your rights and freedoms, and we keep it under review. You can request a summary of the relevant assessment from us at any time.

Weekly commute check-in reminder emails are sent on the basis of our legitimate interest in helping you keep your commute record complete and accurate. You have an absolute right to object to this under Article 21 of the UK GDPR: you can turn these reminders off at any time from the Account & privacy page, or with the one-click unsubscribe link in the footer of every reminder email. Turning them off stops only the reminders — you will still receive service emails you need, such as sign-in, invitations, password resets, and offset confirmations.

5. Carbon offsets and affiliate links

When you offset your commute, payment is processed by Stripe and a certificate is generated. When you shop low-carbon products, we may use affiliate links provided through AWIN; if you make a purchase we may earn a commission, which does not affect the price you pay. These partners process data under their own privacy policies.

6. Who we share data with

We do not sell your personal data. We share it only with the sub-processors that help us run the service, and with your employer where you belong to a company account (see section 8). Our current sub-processors are:

• Vercel — Application hosting and content delivery (USA / EU).
• Neon — Database hosting (account and commute data) (EU).
• Stripe — Payment processing for Business plan subscriptions and carbon offsets (USA / EU).
• Resend — Transactional email delivery (USA / EU).
• AWIN — Affiliate links for low-carbon products (EU / UK).

Where data is transferred outside the UK, we rely on appropriate safeguards such as the UK International Data Transfer Agreement or adequacy regulations.

7. How long we keep it

We keep your account and commute data for as long as your account is active. If you delete your account, your personal data — including your commute profile and history — is removed after a 30-day recovery window. The one exception is a minimal financial record of any carbon offset you purchased (the certificate reference, amount, date, and payment reference), which we must keep for about six years to meet UK accounting and tax obligations. This retained record contains no commute detail and is not linked to your identity in our systems.

8. Company accounts

If your employer provides METIMO to you, your employer is a data controller for the reporting they receive, and we process that data on their behalf as their processor under a data processing agreement — you should also refer to your employer's own staff privacy notice. Taking part is voluntary: you decide whether to sign up and log your commute.

To respect data minimisation, we limit what your employer's administrators can see. Specifically:

• What your employer CAN see: aggregated commuting emissions for Scope 3 Category 7 reporting — company and period totals, tCO2e, distance and data-confidence summaries, and participation levels. Breakdowns are hidden for reporting groups of fewer than five people so individuals cannot be re-identified.
• What your employer CAN see for administration only: your name, email and membership status, so they can approve members, mark leavers, and remind people who have not yet taken part.
• What your employer CANNOT see: your individual commuting distance or carbon emissions, your home postcode, or your week-by-week transport-mode detail. These are never shown to employer administrators.

Your full individual records are accessible only to you and to METIMO's own staff acting as processor (for example to run the service and support you), and to any independent verifier your employer formally appoints. Administrators do not need your home postcode to view reports — it is used only to compute distance.

Some engagement features are optional and off by default. In particular, the colleague leaderboard is opt-in: you only appear on it — showing your first name, last initial and the CO2e you have saved on Low/No Carbon Commute Days — if you choose to join, and you can leave again at any time.

9. Your rights

You have the right to access, correct, delete, restrict, or object to the processing of your personal data, and the right to data portability. You can download a copy of everything we hold about you, or permanently delete your account and commute history, from the Account & privacy page in the app. You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.

10. Security

We protect your data with encryption in transit, hashed passwords, access controls, and reputable infrastructure providers. No system is completely secure, but we take reasonable measures to protect your information and to notify you and the regulator of any breach where required.

11. Cookies

We keep our use of cookies to a minimum. We do not use advertising cookies or any third-party cross-site tracking, and we do not build advertising profiles about you. We use only the following first-party cookies:

• Strictly necessary — a sign-in cookie that keeps you securely logged in once you sign in. It is essential to provide the app you asked for, so it does not require consent and cannot be switched off while you use the service.
• Referral (optional) — if you arrive through a partner's referral link, we store a small cookie recording the referral code for up to 60 days, so the partner who introduced you is credited if your employer later subscribes. It contains only the referral code, is not used for advertising or cross-site tracking, and is set only if you accept cookies.

When you first visit, a cookie notice lets you accept cookies or choose essential cookies only. If you choose essential only, or ignore the notice, the optional referral cookie is not set. You can change your mind at any time by clearing cookies in your browser, which will make the notice appear again. Payment pages hosted by Stripe may set their own cookies under Stripe's own notice when you make an offset purchase.

12. Children

METIMO is intended for use by working adults and is not directed at children under 16. We do not knowingly collect data from children.

13. Changes to this policy

We may update this policy from time to time. We will change the 'Last updated' date above and, for material changes, notify you in the app or by email.

14. Contact us

For any privacy question or to exercise your rights, email privacy@metimo.io or write to us at 11b Newton Court, Pendeford Business Park, Wolverhampton, West Midlands, WV9 5HB, United Kingdom. We will respond within one month, as required by UK GDPR.