Privacy Policy

At Futureproof we care about your privacy. That's why we only collect personal data where there is a clear reason to do so, and why we aim to communicate transparently about how data is used.

This Privacy Policy explains the types of information we may collect from you or that you may provide when using our website or services. It also describes Futureproof's practices for collecting, using, maintaining and protecting your information.

Ella is an AI-powered sustainability platform operated by Futureproof. When this policy refers to "Ella", it refers to the Ella product operated by Futureproof Tech Ltd.

For the purposes of European Economic Area data protection law (the "Data Protection Law"), the data controller of data processed through the Ella platform is the Customer organisation that provides its users access to the Services.

For data retained through our website, marketing pages, demo requests or other interactions with Futureproof, Futureproof Tech Ltd acts as the data controller.

If you are an employee of a Customer organisation that uses Ella, your employer determines how your personal data is processed within the platform.

Who are we?

Futureproof is a technology company providing sustainability and ESG software.

Ella is an AI-powered sustainability platform developed and operated by Futureproof.

The company behind Futureproof and Ella is:

For ease of reference we refer to ourselves throughout this policy as "we", "us", "our", or "Futureproof".

"You", "your", or "yours" refers to the organisation or individual using our services.

You can contact us at: support@poweredbyfutureproof.com

Which personal data do we collect and why?

We only collect personal data where it is necessary to provide our services, operate the platform, or respond to enquiries.

Personal data may be collected in the following situations:

• When you create an account to use Ella
• When your organisation signs up to use the platform
• When you interact with the platform or upload files
• When you contact us or request a demo
• When you visit our public website

Below is a description of the types of personal data we may collect.

User account information

When you create an account we may collect:

• First and last name
• Email address
• Role within your organisation
• Company association
• Phone number (optional)
• Profile image (optional)

This information allows us to create and manage your user account and provide access to the platform.

Authentication is handled using secure login links or authentication tokens provided via email.

We retain account data for as long as your organisation continues to use the platform or until the account is deleted.

Company information

When your organisation registers to use Ella we may collect company-level information including:

• Company name
• Website
• Industry
• Employee headcount range
• Revenue range
• Reporting currency
• Financial year end
• Sustainability goals or pressures

This information allows the platform to configure ESG workflows, reporting frameworks and analytics tailored to your organisation.

Platform usage data

When you interact with Ella we may collect operational data required for the system to function.

This may include:

• Chat messages and prompts submitted within the platform
• Activity logs recording user actions
• Questionnaire responses and ESG metrics entered into the system
• AI usage data such as token consumption
• Audit trail entries showing actions performed in the platform

This data enables the operation of platform features, auditability and AI-assisted functionality.

Files and documents uploaded to the platform

Users may upload documents to Ella including:

• CSV or Excel files containing emissions or sustainability data
• ESG reports and supporting documentation
• Supplier questionnaires
• Attachments shared within platform chats
• Evidence documents used for ESG frameworks or certifications

Uploaded files are stored securely and remain private to your organisation unless explicitly shared.

These files may be processed by AI models in order to:

• Extract structured data
• Summarise documents
• Assist with ESG reporting
• Generate insights or responses within the platform

Files remain stored until deleted by the user or organisation.

AI processing of platform data

Ella uses external artificial intelligence providers to power certain features within the platform.

These services may include:

• OpenAI
• Google Gemini
• Climatiq (for emissions factor data)

When you use AI-powered features, relevant information such as chat prompts, uploaded documents or ESG data may be securely transmitted to these providers for processing.

This processing is limited to providing the requested functionality within the platform.

Data submitted through these APIs is not used to train AI models under the providers' API usage policies.

Some uploaded documents used for AI search features may be temporarily stored within AI provider infrastructure until deleted through the platform.

Contact and demo request information

If you contact us, request a demo or submit a form on our website we may collect:

• Name
• Email address
• Company name
• Message or enquiry information

This information is used solely to respond to your enquiry or provide the requested information.

Website visitor data

When you visit our public marketing website we may collect limited information about how the site is used.

We use Apollo.io on public marketing pages to help identify company visitors and understand how organisations discover our services.

This tracking is limited to marketing pages and does not operate inside the authenticated Ella platform.

How do we protect your personal data?

We implement both technical and organisational safeguards designed to protect personal data.

Security measures include:

• Encrypted data transmission using HTTPS
• Encryption of stored data
• Role-based access controls
• Row-level security within the database
• Audit logging of system actions
• Restricted internal access to customer data
• Private storage buckets for uploaded files

Access to personal data is limited to authorised personnel, contractors and service providers who require that access to perform legitimate business functions and who are subject to confidentiality obligations.

We also maintain internal procedures for investigating suspected security incidents and responding to potential data breaches. Where required by law, we will notify affected individuals and relevant regulators.

Do we share your data with others?

We never sell personal data.

However, we rely on trusted third-party providers to operate the platform and deliver our services.

These include:

Where third-party providers process personal data on our behalf, we require them to do so under appropriate contractual and confidentiality obligations and to implement reasonable security protections.

Where do we store your data?

The Ella platform is hosted using Supabase infrastructure.

Our primary database is hosted in:

Uploaded files are stored within secure object storage in the same infrastructure.

Some data processed through AI services may be transmitted to servers located in the United States.

Where personal data is transferred internationally we rely on recognised legal safeguards such as the EU–US Data Privacy Framework or equivalent contractual protections.

Does Futureproof use cookies or similar technologies?

Yes.

We use cookies and similar technologies to ensure that the platform functions correctly and to improve the user experience.

Examples include:

• Maintaining login sessions
• Remembering interface preferences
• Supporting platform functionality

Public marketing pages may also include analytics or visitor identification tools used to understand how visitors interact with the website.

At present, tracking tools are limited to marketing pages and are not used inside the authenticated Ella platform.

Privacy of the data processed using the Services

Organisations using Ella may store operational, sustainability or ESG-related information within the platform.

This may include data relating to:

• Employees
• Suppliers
• Emissions measurements
• Sustainability questionnaires
• Internal ESG metrics

Futureproof acts as a data processor for this information and processes it only on behalf of the organisation using the platform.

If an organisation stops using Ella, platform data may remain stored temporarily before deletion in accordance with operational requirements, system backups, legal obligations, or dispute resolution needs.

Can we change this Privacy Policy?

We may update this Privacy Policy from time to time.

If changes are significant we will notify users through the platform or by email.

The most recent version will always be available on this page.

Your rights

Depending on your location, you may have rights relating to your personal data including:

• The right to access your data
• The right to correct inaccurate data
• The right to request deletion of personal data
• The right to restrict processing
• The right to object to certain uses of data

Requests relating to personal data stored within the Ella platform should normally be directed to the organisation that provided you access to the platform.

If you believe your data has been processed incorrectly or wish to exercise your rights you may contact us at: support@poweredbyfutureproof.com

If you are located in the UK you also have the right to lodge a complaint with the Information Commissioner's Office (ICO): https://ico.org.uk