01Who we are
EnDepth ("we", "us") runs the Biomethane & Renewable Gas Desk at biomethane.endepth.ai. We decide how and why your personal data is used, so we are its controller under the EU and UK General Data Protection Regulation (GDPR).
- Legal entity: ENDEPTH AI LTD, Company Number: 15945442
- Registered address: 20 Wenlock Road, London, N1 7GU, United Kingdom
- Privacy contact: hello@endepth.ai
02What this policy covers
This policy covers the website, including the published analyses, member accounts, the account area, policy questions, feature requests and the emails we send. It applies whether you visit as a guest or as a registered member.
Analyses link to government and third-party websites. Those sites have their own privacy policies, which this one does not cover.
03Information we collect
Most of what we hold comes from you when you register or use your account. Guests who do not register give us no personal details.
| Category | What we collect | When |
|---|---|---|
| Account details | First name, last name, job title, company, country, email address and password | When you register or edit your profile |
| Sign-up context | Where you registered from (for example, reaching the free-read limit or saving an analysis) and which analysis you were reading | When you register |
| Email confirmation | Whether and when you confirmed your email address; a new address you asked to switch to, until you confirm it | When you confirm or change your email |
| Reading activity | Which analysis was opened, when, and whether it was a member read, the free read or a preview. Linked to your account if you are signed in; not linked to anyone for guests | Each time an analysis page is opened |
| Saved analyses | The analyses you save and when | When you save or remove one |
| Email preferences and consent history | Your choices for each email type, and a record of every opt-in and opt-out: the wording you saw, where you made the choice and when | At registration, on the preferences page, or via an unsubscribe link |
| Policy questions | Topic, market, your question and our experts' replies | When you ask a question |
| Feature requests | Title, description, product area and status, notes our team adds, and when we contacted you about it | When you submit a request |
| Email records | Which alerts, answer notices and product updates were sent to you and whether delivery succeeded; when account emails were sent | When we email you |
| Technical data | IP address and browser details, used for the bot check at registration and in our providers' request logs | When you visit or register |
Your password is stored only in hashed form by our authentication provider; we cannot read it. We do not collect payment details or any special-category data.
04How we use your information
We use your information only for the purposes below, each with a legal basis under the GDPR.
| Purpose | Information used | Legal basis |
|---|---|---|
| Create and run your account and give you full access to analyses | Account details, saved analyses | Contract |
| Send account emails: confirmation, password reset, email change and security notices | Name, email address, email records | Contract; legitimate interests in keeping accounts secure |
| Answer your policy questions and tell you when an expert replies | Account details, policy questions | Contract |
| Review feature requests and contact you about them | Account details, feature requests | Legitimate interests in improving the service |
| Send new-analysis alerts and product news | Name, email address, email preferences | Consent |
| Limit guests to one free analysis | Free-read cookie, reading activity | Legitimate interests in managing access to our content |
| Understand our readership: which analyses are read and what leads people to register | Reading activity, sign-up context, job title, company, country | Legitimate interests in developing our analyses and service |
| Block automated sign-ups | IP address, browser signals | Legitimate interests in security |
| Prove what you consented to, and when | Consent history | Legal obligation |
Where we rely on legitimate interests, you can object at any time (section 11). We do not make automated decisions with legal or similarly significant effects about you.
05Emails and your choices
You choose which optional emails you receive, and you can change your mind at any time on your account's preferences page.
| Default | How to stop it | |
|---|---|---|
| New-analysis alerts | Off, unless you tick "Email me when new analysis is published" at registration | Preferences page or the unsubscribe link in any alert |
| Answers to my questions | On | Preferences page |
| New features (product news) | Off | Preferences page or the unsubscribe link in any update |
| Account emails (confirmation, password reset, email change, security notices) | Always sent | Cannot be turned off while you have an account |
Alerts and product news go only to confirmed email addresses. Every one carries a one-click unsubscribe link that works without signing in.
Each time you switch an email type on or off, we record the choice, the wording you saw, where you made it and when. This lets us show we had your consent.
06Cookies and similar technologies
We set only cookies that are strictly necessary for the site to work, so we do not ask for cookie consent. We use no analytics, advertising or social-media cookies.
| Cookie | Purpose | Lasts |
|---|---|---|
ed_free_read | Remembers which analysis a guest chose as their one free read. It holds only that analysis's name and is signed so it cannot be altered | 12 months |
sb-…-auth-token | Keeps you signed in | Until you sign out, up to 400 days |
Two outside services also receive your browser's request:
- Cloudflare Turnstile runs a bot check on the registration form. Cloudflare processes your IP address and browser signals to tell people from bots. See Cloudflare's privacy policy.
- Google Fonts supplies the typefaces on analysis pages, so Google receives your IP address and browser details when you open one. See Google's privacy policy.
07Who we share it with
We share personal data only with the service providers that run the site for us, under contracts that limit them to our instructions. We do not sell or rent your data.
| Provider | What they do for us | Where data is processed |
|---|---|---|
| Supabase | Database, sign-in and file storage | Ireland (EU) |
| Vercel | Hosts and runs the website | Dublin, Ireland, with a global delivery network; Vercel Inc. is based in the US |
| Resend | Sends our emails | Ireland (EU) |
| Cloudflare | Bot check at registration | Global; Cloudflare Inc. is based in the US |
| Serves fonts on analysis pages | Global; Google LLC is based in the US |
Within EnDepth. Our policy experts see the questions you ask and your account details so they can answer. Administrators can see the member list, feature requests and email opt-ins, and can export the member list. New questions and feature requests are also emailed to our team inbox.
When the law requires it. We may disclose information to comply with a legal obligation, to protect our rights or users' safety, or as part of a sale or reorganisation of our business, in which case this policy continues to apply.
08International transfers
Our database and website run in Ireland, inside the EU. Some providers in section 7 are US companies and may process data outside the UK and European Economic Area.
Where that happens, we rely on the EU–US Data Privacy Framework and its UK extension where the provider is certified, or on the European Commission's Standard Contractual Clauses and the UK Addendum. You can ask us for a copy of the relevant safeguards.
09How long we keep it
We keep your account data for as long as you have an account. When your account is deleted, we delete your personal data with it, except as shown below.
| Information | How long |
|---|---|
| Account details, saved analyses, email preferences, consent history, policy questions and replies, feature requests, email records | Until your account is deleted |
| Reading activity | Kept for statistics; the link to you is removed when your account is deleted |
| A new email address awaiting confirmation | 48 hours, or until you confirm or cancel |
| Inactive accounts | 3 years. Account is deleted after 3 years without sign-in, with a warning email first |
| Backups and providers' request logs | We retain production database data through Supabase’s automated daily backup system for a period of 7 days to ensure business continuity and disaster recovery. Additionally, operational application logs and request metadata are collected and stored via Vercel for up to 24 hours, after which they are permanently deleted unless required for ongoing security investigations. |
Cookie lifetimes are listed in section 6.
10How we protect it
We use technical and organisational measures suited to the data we hold:
- All traffic to the site is encrypted in transit (HTTPS).
- Passwords are stored only as secure hashes.
- Database access rules let each member read only their own records. Questions, feature requests and email records can be read only by our server.
- Staff areas are open only to accounts with an expert or administrator role.
- A change of email address must be confirmed from the new inbox, and we notify the old address. We also email you when your password changes.
- Account emails are rate-limited, and registration is protected by a bot check.
No system is perfectly secure. If a breach puts your rights at high risk, we will tell you and the relevant authority as the law requires.
11Your rights
You have rights over your personal data under the GDPR. Many can be used directly in your account; for the rest, email hello@endepth.ai and we will reply within one month.
| Right | How to use it |
|---|---|
| See and correct your data | Account page: edit your profile, email address and password |
| Withdraw consent to emails | Preferences page, or the unsubscribe link in any alert or update |
| Delete your account and data | Email us from your account's address |
| Get a copy of your data, including in a portable format | Email us |
| Object to or restrict our use of your data | Email us |
Withdrawing consent does not affect emails already sent. We may need to confirm your identity before acting on a request.
You can also complain to a data protection authority, such as the one where you live or work. Our lead authority is UK ICO. We would welcome the chance to address your concern first.
12Children, changes and contact
Children. The site is a professional service for the energy sector and is not intended for anyone under 16. We do not knowingly collect data from children; if you believe we have, contact us and we will delete it.
Changes. We will post any changes here and update the date at the top. If a change materially affects how we use your data, we will also email members before it takes effect.
Contact. Questions about this policy or your data: hello@endepth.ai, or write to us at 20 Wenlock Road, London, N1 7GU, United Kingdom.