Privacy Policy

We collect three kinds of data, and nothing else:

• Account data — your name, email address, and password hash; the enterprises you own or belong to and your role in each.
• Workspace data you create — your business profile and Business Context, CRM contacts, companies, deals and tasks, sites and funnels, articles and media, products and orders, prospect and buying-signal records, outreach drafts, and automations. Some of this is information about other people (a contact’s name and email, a prospect’s company). You are the controller of that data; we process it on your behalf.
• Operational records — AI usage events and credit transactions (which model, how many tokens, what it cost), sign-in and connector-connection events, and standard server logs (IP address, user agent, timestamps, error traces).

We do not collect payment card details. Card data goes directly to Stripe through Stripe-hosted checkout; we store only Stripe’s identifiers and the resulting order record.

When you connect Earth Care Network to Claude — or any other MCP client — the connector acts on your behalf, inside the workspace you selected, limited to the scopes you approved on the consent screen (read, build, sell, refer). Specifically:

• The connector reads and writes only your own workspace data. Every call is membership-gated: a request naming an enterprise you do not belong to is refused, not silently redirected.
• We do not read your Claude conversations. We receive only the arguments of the tool call Claude makes, and we return only that tool’s result. We do not query Claude’s memory, chat history, conversation summaries, or your files.
• We do not use connector traffic to train models. Tool arguments are used to serve the request and are not retained as a training corpus.
• Anything that publishes, sends a message, or moves money stays behind an explicit human approval, regardless of which AI is driving.
• OAuth access tokens, refresh tokens, authorization codes, and API keys are stored only as SHA-256 hashes. We cannot recover the plaintext of a token or key after it is issued.

To operate the product you asked for: to run the directory and your workspace, to execute the tool calls and automations you or your agent trigger, to meter AI usage against your wallet, to bill hosted membership, to send service email you have opted into, and to keep the service secure and debuggable.

We do not sell your data, and we do not run advertising on it. Your private workspace data is not used to train our models or anyone else’s.

Note that some data is public by design: a published directory profile, its public Business Context, and a published site, funnel, or article are visible to anyone, including via our Murmurations feed. Publishing is always an explicit action.

We share the minimum necessary with providers who run parts of the service. Each is used only for the function listed, and only when you invoke a feature that needs it:

• Hosting & infrastructure — our cloud host, database, and object storage (all workspace data at rest).
• AI model providers — the model you or your workspace selected, for the content of a generation request. On BYOK the call goes out on your own key and we bill you nothing.
• Stripe — payments and hosted checkout.
• Data & enrichment providers — Crustdata (prospect, funding, and hiring signals), Firecrawl (fetching public pages you point us at), Pexels (stock image search), and public-records sources. These receive the query, not your workspace.
• Channel providers — email, X, LinkedIn, and social scheduling, for messages you have approved for sending.
• GitHub — only when you explicitly import from or export a site to a repository you control.

We also disclose data where the law requires it, and to a successor in the event of a merger or acquisition (you will be notified before your data moves).

• Workspace and account data — for as long as your account is open. When you delete your account we delete or irreversibly anonymise it within 30 days, except where we must keep records longer by law.
• Billing and metering records — retained up to 7 years for tax and accounting obligations.
• Server logs — 90 days, then deleted.
• OAuth grants expire in minutes; access tokens are short-lived and refreshable. Revoking a connection invalidates them immediately.

• Disconnect at any time — revoke the Claude connector from your workspace settings, or from Claude’s own connector settings. Header API keys are revoked under Settings → Connect external AI tools.
• Access, correct, export, or delete your data — most of it is editable in the app directly; for a full export or deletion, email us and we will respond within 30 days.
• Self-host instead — The AGPLv3 core (the API, worker and database) runs on your own servers with your own keys, and then your workspace data does not reach us. The web app you are using is not yet part of the self-host bundle. See deployment modes.

Depending on where you live you may have additional rights (GDPR, UK GDPR, CCPA/CPRA), including objecting to processing and lodging a complaint with your supervisory authority. We honour these regardless of residence.

Earth Care Network admins can access your data to serve you. When staff open your portal it is a time-limited, logged grant. Outside a grant, staff reads are not recorded one by one.

Who can see your private data

• Your team — People you invite, with the role you give them. Viewers can look but not change anything.
• Earth Care Network staff, through a grant — To help you, a staff member opens your portal with a written reason, for 60 minutes at a time, as themselves. Everything they change carries their name, and their visit is logged. Under a grant they cannot touch billing, your sign-in, API keys or connected accounts, and cannot send email or messages for you. Owners and admins can see every visit from the last 90 days in Settings.
• Earth Care Network engineers who run the service — A small number of people can reach the database and servers to keep the service running, fix problems and meet legal duties. That access does not go through a grant, and reads there are not recorded one by one.
• The services that run parts of Earth Care Network — Our host, database, file storage, AI providers, Stripe and the apps you connect, each only for its own job (Privacy Policy, sections 4 and 11).

How it is stored

• In transit — Every connection uses HTTPS (TLS).
• Connected apps and your AI keys — Sign-in tokens for connected apps and your own AI keys are encrypted before they are saved, because we must use them again on your behalf.
• Keys we issue — Connector access tokens, refresh tokens and API keys we issue are saved only as one-way hashes. We cannot read them back.
• Everything else at rest — Your workspace lives in our hosting providers' database and file storage. Disk encryption there is provided by each host; we do not add a second layer of encryption to every record.

Connector sign-in uses OAuth 2.1 with PKCE (S256). Access is scoped and checked against your membership on every call. We do not offer end-to-end encryption. No system is perfectly secure; if a breach affects you we will notify you and, where required, the relevant authority.

Earth Care Network is a business tool and is not directed to children under 16. We do not knowingly collect their data; if we learn we have, we delete it.

We will update this page when our practices change and revise the date at the top. Material changes affecting connector data handling will also be announced in-product before they take effect.

Privacy questions, data requests, and security reports: privacy@earthcare.network.

See also our legal & licensing overview and the connector documentation.

Product analytics and error reports

• PostHog receives product events from our servers, such as a sign-up starting or a page being published, so we can see what works. Email addresses and other personal fields are removed from an event before it is sent.
• Sentry receives error reports: what failed, where, and technical details such as the browser and time, so we can fix it.

When an enterprise runs ads through us

• We send the ad platform the enterprise chose (Meta, Reddit, LinkedIn or Pinterest) the ad itself: its words, its images, the landing link, the budget, the dates and the targeting the enterprise picked, such as a place. Only published images are sent, never a private file.
• AI that helps write an ad reads only the enterprise’s public information. We never send a contact list, a customer’s details or any other personal data to an ad platform. We do not build custom or lookalike audiences, and we do not use conversion APIs.
• We read back each platform’s report for the ad: impressions, reach, clicks and spend, as totals per ad per day. These are counts, not people.
• For Google, Microsoft, X, TikTok, Snapchat and ChatGPT ads (OpenAI Ads), we only prepare files for the enterprise to upload itself. We send those platforms nothing.

How we measure results

• Measurement is first-party only. The links in an ad carry UTM tags (which channel, campaign and ad). When someone opens a page on Earth Care Network from that link, we record the visit and, if they sign up or leave their details, that result, with its tags.
• For our own sign-up, we count how many people started, confirmed their email and published, by the tags on the link they first arrived from. Those records hold no email address and no IP address, only a one-way code that changes daily so the same visit is not counted twice.
• We do not install any ad platform’s tracking pixel or tag on our pages or on the pages we host for you. Reddit requires a pixel ID on each ad group; where an enterprise already has one, we may attach its ID to the Reddit ad group, but we still never install Reddit’s tag, so it records nothing on our pages.
• When you click an ad, the platform that showed it knows you clicked, under its own privacy policy. We see only the tags on the link and the totals above. This is also how Earth Care Network’s own ads work.

Connected apps through Composio

• When you connect an app, such as an ad account, a social account, email or a calendar, Composio handles the sign-in and holds the connection, and passes our requests to that app. We keep which account you connected, never your password for it.
• We call a connected app only when you, or something you approved, asks us to. You can disconnect at any time in the app, and we stop at once.

AI images

When an enterprise asks for an AI illustration, the request goes to an image model through OpenRouter. The prompt is written from public information only and asks for scenes, never people, faces, text or logos. The image is labelled “AI illustration” wherever it appears.

How long we keep it

Ad reports and first-party results are workspace data: they are kept while the workspace exists and deleted as section 5 describes.