1. Introduction and Scope

This Privacy Policy describes how 3Degrees Group, Inc. ("3Degrees," "we," "us," or "our") collects, uses, shares, and protects information through the EAC Management platform (the "Platform").

By creating an account or using the Platform, you acknowledge that you have read and understand this Privacy Policy and that your use of the Platform is subject to this Policy.

This policy applies specifically to the Platform. For information about 3Degrees’ general business practices, please see our Corporate Privacy Policy.

Material Changes: If we make material changes to this Privacy Policy, we will notify you by email (to the address associated with your account) and/or by posting a prominent notice on the Platform at least 30 days prior to the change becoming effective. Your continued use of the Platform after that date constitutes acceptance of the updated policy.

2. Information We Collect

Account & Profile: Name, business email, password, company name, industry, and role.
Business Data: Energy consumption, facility locations, sustainability goals, and EAC portfolio data.
AI Interactions: Messages sent to the AI assistant, responses generated, and any uploaded files or images.
Usage & Security: Device characteristics for bot protection (Vercel) and usage analytics (PostHog — opt-in only). See Section 11 (Cookies & Tracking) for additional information.
Payments: Handled via Stripe; we do not store full credit card details.
Inferred & Derived Data: We and our AI service providers may generate insights, scores, or other inferences derived from your Business Data and AI Interactions — for example, sustainability performance assessments or usage-pattern analysis. These inferences are treated as personal data under this policy.

3. How Your Data is Used

We process your data under the following legal basis:

Contractual Necessity — to perform our agreement with you:

Operate your account and display your energy data.
Generate responses via the AI Assistant.
Send transactional emails (Resend).

Legitimate Interests — where our interests or those of third parties are not overridden by your rights:

Protect the Platform from fraud and automated attacks.
Monitor and improve the quality and security of the Platform, including review of AI interaction transcripts (see Section 4).

4. AI Assistant — Data Processing & Consent

The Platform utilizes third-party AI providers (Anthropic, OpenAI, and Google) to generate insights.

Specific Consent: Before using the AI Assistant for the first time, you will be asked to provide affirmative consent for AI-specific processing.
Data Minimization: We do not send your email address to AI providers; we use internal identifiers.
Model Training: Under our enterprise agreements, your data is not used to train the public models of these providers. For reference, see each provider’s commercial use policy:
- Anthropic: anthropic.com/legal/commercial-terms
- OpenAI: openai.com/policies/usage-policies
- Google: cloud.google.com/terms/data-processing-addendum
Monitoring: 3Degrees employees (not subcontractors) may review transcripts for quality assurance. This processing is based on our Legitimate Interests in maintaining Platform quality and security. You have the right to object to this processing at any time by contacting us at privacy@3degreesinc.com; we will assess your objection and respond within 30 days.

5. Supplier Reach (Cross-Company Sharing)

Aggregate Data: Program sponsors see anonymized statistics. We apply minimum-threshold rules to prevent the identification of individual suppliers.
Detailed Data: Shared only with your explicit opt-in consent provided during program enrollment. You may withdraw this consent at any time by emailing privacy@3degreesinc.com or adjusting your sharing preferences in your account settings. Withdrawal will not affect the lawfulness of sharing that occurred before withdrawal.

6. Third-Party Sub-processors

3Degrees maintains Data Processing Agreements (DPAs) with each sub-processor listed below in accordance with GDPR Article 28. Our sub-processors are contractually required to process personal data only on our instructions and to maintain appropriate security measures.

Category	Provider	Purpose
AI Services	Anthropic, OpenAI, Google	Prompt processing & response generation
Hosting	Vercel	Infrastructure, routing, and bot protection
Database	Supabase	Data storage and user authentication
Payments	Stripe	Subscription billing
Email	Resend	Transactional notifications
Analytics	PostHog	Usage tracking (opt-in only)

7. Data Retention

AI Chat History: Retained for 24 months, then automatically purged.
Account Data: Retained for the duration of your active subscription plus 3 years.
Analytics: Individual-level data (if opted in) is retained for 12 months.
Billing & Transaction Records: Records of your subscription and payment transactions are retained for 7 years from the date of the transaction for tax, accounting, and legal compliance purposes.

8. Your Rights & International Transfers

Global Rights: You have the right to access, correct, delete, or export (portability) your data. Submit requests to privacy@3degreesinc.com. We will respond to verified requests within 30 days of receipt. We may extend the response period by an additional 30 days if necessary, in which case we will notify you of the extension. We may request verification of your identity before processing a rights request.
International Transfers: The Platform is hosted in the US. For EEA/UK users, we utilize Standard Contractual Clauses (SCCs) to ensure data protection for transfers to US-based AI providers.
CCPA (California Residents): We do not "sell" or "share" your personal information for cross-context behavioral advertising. In addition, California residents have the following rights under the California Consumer Privacy Act (as amended by CPRA):
- Right to Know: Request disclosure of the categories and specific pieces of personal information we have collected about you in the preceding 12 months.
- Right to Delete: Request deletion of personal information we have collected, subject to certain exceptions.
- Right to Correct: Request correction of inaccurate personal information.
- Right to Opt-Out: We do not sell or share your personal information. A "Do Not Sell or Share My Personal Information" link is provided on our website for your reference.
- Right to Limit Use of Sensitive Personal Information: To the extent we process Sensitive Personal Information as defined by CPRA, you have the right to limit such processing to permitted purposes.
- Right to Non-Discrimination: We will not discriminate against you for exercising any of the above rights.
- Authorized Agent: You may designate an authorized agent to submit a CCPA request on your behalf. We may require written proof of authorization and verification of your identity.

9. International Data Transfers & SCC Fallback

3Degrees is headquartered in the United States. Data collected through the Platform will be stored and processed in the U.S.

For users in the European Economic Area (EEA), the United Kingdom, or Switzerland:

Primary Mechanism: We transfer data based on "Adequacy Decisions" where applicable or through specific Data Processing Agreements (DPAs) with our sub-processors.
SCC Fallback: To the extent that a transfer of personal data is not governed by an existing DPA or an adequacy decision, the 2021 EU Standard Contractual Clauses (SCCs) and/or the UK International Data Transfer Addendum are hereby incorporated by reference. These clauses act as a backup compliance obligation to ensure your data receives a level of protection equivalent to that provided in the EEA/UK.
Hierarchy: In the event of a conflict between a provider’s terms and the SCCs, the SCCs shall prevail regarding the protection of personal data transferred from the EEA/UK.

10. Security & External Links

We use industry-standard encryption (AES-256) and secure transit (TLS). We are not responsible for the privacy practices of third-party websites linked within the Platform.
Data Breach Notification: In the event of a data breach affecting your personal information, we will notify you and applicable supervisory authorities as required by law. Under GDPR, we will notify the relevant supervisory authority within 72 hours of becoming aware of a qualifying breach and notify affected individuals without undue delay where the breach is likely to result in high risk to their rights and freedoms. Under applicable US state laws, we will provide notification within the timeframes required by each applicable jurisdiction.

11. Cookies & Tracking Technologies

The Platform uses cookies and similar tracking technologies. These include:

Strictly Necessary Cookies: Required for the Platform to function (e.g., session management, security). These cannot be disabled.
Analytics Cookies: We use PostHog for usage analytics on an opt-in basis only. You may opt in or out through your account settings.
Security/Bot Protection Cookies: Vercel uses device characteristics and cookies to detect and prevent automated attacks. This processing is based on our Legitimate Interests in Platform security.

For EEA/UK users, non-essential cookies are set only with your consent, which you may withdraw at any time by adjusting your cookie preferences in your account settings or by contacting us at privacy@3degreesinc.com.