Data Trust & Safety

Is my commute data safe?

Yes. Your data is encrypted in transit and at rest, held by ISO 27001 / SOC 2 certified hosting and database providers, and reachable only through your authenticated account and a small, logged group of administrators. We collect the minimum needed to calculate your commuting emissions and nothing more.

What information do you actually collect?

Only what the calculation needs: your home postcode (or the stations/places on your journey), your transport modes, your one-way distance, your usual working and working-from-home days, and — where a vehicle is used — whether it is a company vehicle. Plus your account email so you can sign in.

We do not need or ask for your full home address, your salary, your bank details, or your location in real time. We never track your phone or follow your movements.

Could this data reveal when my home is empty?

No. We only ever ask for your postcode — never your house number, building name, or street — so we cannot tell which specific home is yours. A postcode typically covers a group of neighbouring properties, not a single address. Declaring that you are working at the office therefore does not point anyone to an identifiable, empty house. If you would rather not share a postcode at all, you can skip it entirely and simply enter your commute distance yourself.

Can my employer see my home address or my individual commute?

No. Employers only ever see aggregated figures for their organisation — total and average commuting emissions across the team. Individual-level results are never shown to your employer, and any grouping small enough to identify a person is suppressed below a minimum-headcount threshold before an employer can view or export it.

Who can see my data inside METIMO?

You can, through your account. A very small number of named METIMO administrators can access data to run and support the service, their access is restricted by role, and every time an administrator exports personal data or generates a report it is written to an append-only audit log.

Do you sell my data or use it for advertising?

No. We do not sell your personal data and we do not use it for advertising or profiling. It is used to calculate your commuting emissions and to provide the service to you and your employer, as described in our privacy notice.

How long do you keep it, and can I delete it?

You are in control. You can export a copy of your data at any time, and you can delete your account whenever you like. After deletion your data goes to a 30-day recovery window (in case of mistakes) and is then permanently erased. The only thing we keep afterwards is a minimal, de-identified financial record of any carbon-offset purchase — certificate reference, amount and date, with no commute detail — because tax and accounting law requires it.

Where is my data stored?

In the UK/EEA and the US, with reputable providers (see our sub-processor list on the Security page). Where data moves outside the UK, it is protected by an approved safeguard such as UK adequacy or the IDTA / UK Addendum to the Standard Contractual Clauses.

Is my payment information safe?

METIMO never sees or stores your card details. Payments for Business plans and carbon offsets are handled directly by Stripe, a PCI-DSS Level 1 certified payment provider.

What happens if there is a data breach?

We have a defined breach procedure. If a breach is likely to put individuals at risk we notify the ICO within 72 hours of becoming aware, and we tell affected individuals directly where the risk to them is high. You can also report a concern to us at any time using the contact below.

What certifications do you have?

METIMO holds Cyber Essentials certification, awarded by the IASME Consortium on 22 September 2026 (certificate 4fe69677-5c59-4ee2-a700-f754bc1e93eb, whole-organisation scope, renewal due 22 September 2027). We are also registered with the UK Information Commissioner's Office and build in line with UK GDPR and the principles of ISO 27001. The creators of METIMO are BSI-certified GHG Professionals and BSI-certified Lead GHG Verifiers & Validators, so the methodology is designed by people trained to verify greenhouse gas statements. These are personal professional qualifications held by our founders, not a certification of METIMO itself. We stay transparent about the difference between certification and alignment: Cyber Essentials is certified, whereas our ISO 27001 work is alignment and readiness rather than a formal certificate — and we say so plainly rather than imply otherwise.

How do I ask a question or exercise my rights?

You have the right to access, correct, export, delete and object to the processing of your data. Email privacy@metimo.io and we will help. The full detail is in our privacy notice and Data Processing Agreement.