Who is responsible
Ketan Patel, Cascais, Portugal, operates Sustainability Language and is responsible for the processing described here. Contact contact@sustainabilitylanguage.com for privacy questions or to exercise your rights.
Privacy and GDPR
Privacy
This notice explains how Sustainability Language uses personal information when you browse the site, create an account, submit material or create a collaborator profile.
Effective 22 August 2026
Information we collect
This can include account email, name, organisation, role, professional profile, expertise, submissions, evidence links, editorial correspondence and, only if supplied, a collaborator photo. We ask you not to include sensitive personal information in submissions.
Why and on what basis
We use account details to provide and secure accounts and submission details to assess contributions and respond. We use a collaborator’s public profile, LinkedIn link and optional photo only with separate publication consent. We rely on consent for public profiles and optional communications, performance of the requested service for account functions, compliance with legal obligations for rights and content reports, and our legitimate interests in operating a safe, editorially reliable public resource.
Public profiles
When a collaborator submits a profile, it remains private while an editor checks it. Once approved, the name, role, organisation, biography, expertise, LinkedIn link and optional photo become public. Profiles are self-described and publication does not mean Sustainability Language has verified identity, employment or expertise. Public material may be indexed by search engines or copied by third parties. A collaborator can remove a published profile at any time; this removes it from our site but cannot erase third-party copies already made.
Service providers and transfers
We use Cloudflare to host and protect the site, Supabase for authentication, database and file storage, Zoho Mail for operational correspondence, and Resend for automated request receipts. OpenAI supports a private advisory editorial check: it receives current and proposed wording, an editor note or explanation, and a supporting source link. The application does not add contributor or editor names, email addresses, profiles or account IDs to that check; editors are instructed not to put personal data in free-text notes or source links. These providers process information for the stated service purposes.
How long we keep it
Account information is kept while the account is active and then reviewed for deletion or anonymisation. Submission and decision records are normally kept for up to six years where an editorial history or legal record is needed. Content reports and data-rights cases are normally kept for three years after closure. Unpublished or rejected collaborator profiles and draft photos are reviewed for deletion after 12 months. Published profile data is kept until consent is withdrawn or the profile is no longer needed, then removed from public display without undue delay. Security logs are kept for the shorter period set by the relevant provider unless an incident requires preservation.
International transfers
Some providers may process information outside the EEA or United Kingdom. Where required, we rely on an adequacy decision or approved contractual safeguards, such as standard contractual clauses. Contact us to request information about the safeguard relevant to your data.
Automated decisions
We do not make solely automated decisions that produce legal or similarly significant effects. Editorial decisions are made by people.
Cookies and local storage
Necessary authentication and security cookies may be used to run contributor accounts. The Nespresso demonstration also uses an essential access cookie lasting up to four hours; “Lock demonstration” removes that access. It does not store your report or password. No optional analytics provider is active. Where relevant, an unfinished form draft or interface preference may be stored in your browser. See the Cookie Policy.
Your data rights
You may request access, correction, deletion, restriction, portability or objection to processing. Where we rely on consent, you can withdraw it at any time. You may also complain to your local data-protection authority. Deletion requests are reviewed against any necessary legal, security or minimal editorial record-keeping need.
Use the data rights page to make a request. We keep a private record of the request, decision and completion date so that we can demonstrate and complete the request responsibly.