Privacy Policy & Terms of Service · MCAT

01

About Us

Carbon Architecture Advisory Services ("CAAS", "we", "us", "our") is a specialist advisory firm providing carbon market intelligence and project development services. We are based in Nairobi, Kenya. We are the data controller for personal data collected through MCAT.

This Privacy Policy applies to personal data collected through the Methodology Comparison & Assessment Tool ("MCAT" or "the Tool") and any related correspondence. Our contact for all privacy and data matters is Karen Too. Contact details are in Section 13.

02

What Data We Collect

We collect the following when you start an assessment, use the Tool, or buy a full report:

Identity Data

Your full name, entered when you start an assessment.

Contact Data

Your email address, used to identify your account, deliver payment confirmations and respond to your requests.

Professional Data

Your organisation name (optional) and the type of project you are assessing, which help us understand our user base and improve the Tool.

Project & Assessment Data

The details you enter in the intake form (for example country, sector, scale, land tenure and carbon rights status, baseline data, monitoring capability, budget bands, financing stage and target market) and the scores and comparison that the Tool generates from them. This data is sent to our server so the Tool can compute your results. We keep a copy of each generated report alongside your name and email address.

Uploaded Documents

If you use the document upload feature, your browser reads the file (PDF, CSV or spreadsheet) and extracts the text. That text is sent to our server and to the AI service described in Section 5, which proposes answers for the intake form. You review and confirm the critical fields before anything is scored. As a fail-safe, we keep a backup copy of the extracted text and the pre-filled answers with your account record.

Transaction Data

Payment reference number, currency, amount, timestamp and the email address that the payment unlocked. We do not store card numbers, mobile-money numbers, bank account details or any other payment instrument data. Those are handled exclusively by Paystack.

Session & Security Data

A session identifier, and a timestamped record, linked to your name and email, each time the Tool window loses focus while results are displayed (see "Report protection" below). Our hosting provider also processes your IP address and standard request information to serve the site, and we use IP address to rate-limit requests.

Data Stored in Your Browser

We store a project ID, a session token, and your name and email in your browser's local storage so that a page reload does not lose your project or a payment you have made. Clearing your site data removes them. This is browser storage, not cookies.

        No advertising or analytics trackers
        MCAT does not use advertising pixels, analytics trackers or behavioural profiling. Third-party resources that the page loads (fonts, document-reading libraries and Paystack's checkout) receive your IP address when they load, and Paystack's checkout may set its own cookies. See Section 5.
      

        Report protection
        To protect the methodology library and reports from copying, MCAT displays a watermark carrying your name and email over results, and records when the Tool window loses focus. We use these records only to protect the Tool and to investigate suspected misuse. They are not used for marketing or profiling.
      

03

How We Use Your Data

We process your personal data on the following lawful bases under the Kenya Data Protection Act, 2019 and, where applicable, the EU General Data Protection Regulation (GDPR):

Contract Performance

To run your assessment, generate and unlock the report you request or purchase, process payment and deliver the service you asked for.

Legitimate Interest

To keep records of assessments and transactions; to protect the Tool, its methodology library and its reports from copying and misuse; to prevent abuse through rate limiting; and to understand aggregate demand by sector and project type so that we can improve the Tool.

Legal Obligation

To meet financial record-keeping requirements under Kenyan law, including the Tax Procedures Act, 2015.

Consent

Where you have given consent, for example by ticking the acknowledgement checkbox at the payment gate or by choosing to upload documents for pre-fill.

We do not sell your data, use your project details for advertising, or make automated decisions that have legal or similarly significant effects on you. The AI service is used only to propose answers for the intake form, which you review and confirm. MCAT's scores are decision-support outputs, not decisions about you. We do not send unsolicited marketing.

04

Payment Processing

All payments are processed by Paystack. When you pay, you are subject to Paystack's own privacy policy and terms, available at paystack.com/privacy.

CAAS receives a payment confirmation from Paystack containing your name, email address, payment reference, amount and currency. CAAS does not receive, store or have access to your card number, mobile-money details, bank account details or any other payment instrument data.

Paystack states that it is PCI-DSS Level 1 certified. Payment details are entered on Paystack's checkout, not on our pages.

05

Who Handles Your Data

We do not sell, rent or trade your personal data. We use the following service providers to run MCAT, and share with each only what it needs to do its job:

Provider	What it does	What it receives
Render	Hosts the Tool and its server	All data described in Section 2 is stored on and served from Render's infrastructure. Render also processes IP addresses and request logs.
Resend	Sends email	Your email address and the content of emails we send you.
Paystack	Processes payments	Your name, email address and payment details (entered on Paystack's checkout).
Anthropic (Claude)	Proposes intake-form answers from uploaded documents	The text extracted from documents you choose to upload. Do not upload documents you are not entitled to share.
Google Fonts, cdnjs	Deliver fonts and the PDF/CSV reading libraries to your browser	Your IP address and browser details, as with any website that loads these resources.

Legal Requirements

We may disclose your data if required by law, court order or regulatory authority, or where we believe disclosure is needed to protect the rights, property or safety of CAAS, our users or the public.

Business Transfers

If CAAS is merged with, acquired by or sells assets to another entity, personal data may be transferred to the successor, subject to the protections in this policy.

06

International Transfers

The providers in Section 5 operate servers outside Kenya, so your personal data may be processed in other countries. Where we transfer personal data out of Kenya, we do so in line with the Kenya Data Protection Act, 2019, and we choose providers that commit to appropriate safeguards for personal data. If you would like details of the safeguards for a specific provider, contact us.

07

Data Retention

As a fail-safe, we keep a record of everything described in Section 2 for three (3) years. This covers your account details, project and assessment data, saved copies of generated reports, the text extracted from documents you upload and the answers pre-filled from it, transaction and payment-unlock records, and window-focus and session logs. The period runs from the date of the transaction or, for other records, from your last activity. It reflects our financial record-keeping obligations under Kenyan law, our interest in resolving disputes and our need to restore your work if something goes wrong.

After three years, we permanently delete or anonymise the data. Data in your browser's local storage stays until you clear your site data.

You may ask for earlier deletion at any time. See Section 9. Some records, such as transaction records, may have to be kept for the legal period even if you ask for deletion.

08

Security

Data is sent over HTTPS. Access to stored records is restricted to authorised CAAS staff through access keys, and the administrative functions of the Tool are not open to the public. No online service is completely secure, so we cannot guarantee absolute security.

If a breach of personal data occurs that is likely to put your rights at risk, we will notify you and the Office of the Data Protection Commissioner as the law requires.

09

Your Rights

Under the Kenya Data Protection Act, 2019 and, where applicable, the GDPR, you have the following rights in relation to your personal data:

Right of Access

To request a copy of the personal data we hold about you.

Right to Rectification

To request correction of inaccurate or incomplete personal data.

Right to Erasure

To request deletion of your personal data, subject to our legal record-keeping obligations.

Right to Restrict Processing

To request that we limit the processing of your personal data in certain circumstances.

Right to Data Portability

To receive your personal data in a structured, commonly used format.

Right to Object

To object to processing based on legitimate interest, including the report-protection records described in Section 2.

Right to Withdraw Consent

Where processing is based on consent, to withdraw consent at any time without affecting the lawfulness of earlier processing.

To exercise any of these rights, email karen.too@carbonarchitectureadvisoryservices.com with the subject line "Data Rights Request — MCAT." We will respond within 21 days. There is no charge for a first request. If you are unsatisfied with our response, you may lodge a complaint with the Office of the Data Protection Commissioner of Kenya (odpc.go.ke).

10

Children & Changes

Children. MCAT is a professional tool for carbon project developers, investors and advisers. It is not directed at anyone under 18, and we do not knowingly collect personal data from children.

Changes. We may update this policy. We will post the new version at this address and change the "last updated" date above. If a change materially affects how we use personal data you have already given us, we will tell you by email.

11

Terms of Service

By accessing or using MCAT, you agree to these Terms of Service. If you do not agree, do not use the Tool.

Nature of the Service

MCAT provides an evidence-qualified comparison of carbon methodologies against the project information you enter. It is a screening and decision-support instrument. It is not a registry eligibility determination, validation or verification opinion, legal advice, financial advice, investment advice, or a guarantee of any outcome. Scores and rankings come from weightings that CAAS designed. They are heuristics, not empirically calibrated probabilities, and small differences between methodologies are inside the noise of those weightings.

No Professional Relationship

Use of the Tool does not create a client, advisory or other professional relationship between you and CAAS. Such a relationship exists only under a separate written engagement agreement.

Free and Paid Access

MCAT offers a limited free assessment and a paid full report, priced per project at the amount shown at the payment gate. We may change pricing and the free allowance at any time, but a change does not affect a report you have already unlocked.

Payment, Delivery and Refunds

Your full report unlocks immediately once payment is confirmed. Because the report is generated instantly and is specific to your project inputs, payments are non-refundable once the report has been unlocked. If you were charged but your report did not unlock, or you believe you were charged in error, contact us within 24 hours with your Paystack reference number.

Your Inputs and Uploads

You are responsible for the accuracy of the information you enter and for confirming every field that was pre-filled from your documents. The quality of the output depends on the quality of your inputs. You confirm that you are entitled to share any document you upload, and you must not upload documents that contain personal data about other people unless you have the right to do so.

Permitted Use

You may use the Tool and the report generated for your own internal professional purposes. You may share the report with colleagues, co-investors, lenders and counterparties as part of your project or investment process. You may not resell, sublicense or commercially redistribute the report or any part of it without our written permission.

Acceptable Use and Report Protection

You may not scrape, copy, extract or reverse-engineer the methodology library, scoring framework or reports; use automated tools to query the Tool at scale; share your access with others; or try to bypass the watermark, window-focus protection, rate limits or payment gate. MCAT watermarks results with your name and email and records window-focus events, as described in Section 2. We may suspend or end access if we reasonably believe these terms have been breached.

Accuracy and Currency of Data

The methodology library, including methodology versions, applicability notes, integrity reviews and Core Carbon Principles (CCP) label status, is compiled from public registry and third-party sources as of the dates shown in the Tool and its reports. Registry rules, methodology versions and label decisions change often, and the CCP label attaches to specific methodology versions and to credits issued under them, not to your project by default. Where the Tool shows a version as unverified, confirm it with the registry. CAAS makes no warranty that the data is current when you use it. You are responsible for checking current registry documentation, and your host-country requirements, before acting on any result.

Limitation of Liability

To the fullest extent the law allows, CAAS accepts no liability for any loss, damage or adverse outcome arising from reliance on the Tool's outputs, including scores, rankings, recommendations, issuance and revenue estimates and Article 6 readiness indicators. You use the Tool and its outputs at your own risk. Our total liability to you in connection with the Tool is limited to the amount you paid for access. Nothing in these terms excludes liability that cannot be excluded under Kenyan law.

Availability

We do not guarantee uninterrupted or error-free access. We may modify, suspend or discontinue the Tool at any time. If access is interrupted after you have paid but before you could use your report, we will restore it or refund you.

Governing Law

These Terms are governed by the laws of Kenya. Disputes arising from use of the Tool are subject to the exclusive jurisdiction of the courts of Nairobi, Kenya.

Changes to These Terms

We may update these Terms and the Privacy Policy at any time. The current version is always available at this address. Continued use of the Tool after an update means you accept the revised terms.

12

Intellectual Property

MCAT, including its scoring framework, weighting system, question set, report format, comparison logic and the compiled methodology library and its annotations, is the original intellectual property of Carbon Architecture Advisory Services. All rights are reserved. Reproduction, redistribution, reverse-engineering or derivative use of any part of the Tool without our prior written permission is prohibited and may constitute infringement under the Kenya Copyright Act, 2001.

The underlying carbon methodologies and registry documents belong to their respective registries and standard setters, such as Verra, Gold Standard, ACR, Climate Action Reserve, the Global Carbon Council, ART and the UNFCCC. MCAT refers to them for comparison only, and their names are used to identify them. They do not mean that those organisations endorse MCAT.

13

Contact

For privacy enquiries, data rights requests, legal questions or service issues, contact:

Carbon Architecture Advisory Services

Karen Too
Nairobi, Kenya

Email: karen.too@carbonarchitectureadvisoryservices.com
Subject line for privacy matters: "Data Rights Request — MCAT"
Subject line for legal matters: "Legal Enquiry — MCAT"
Subject line for payment issues: "Payment Issue — MCAT"

We aim to respond to all enquiries within 2 business days and to data rights requests within 21 days.

Privacy Policy &Terms of Service

Privacy Policy &
Terms of Service