Privacy Policy

Carbon Network Solutions ("we," "our," or "us") operates https://carbonnetworksolutions.com (the "Site"). This Privacy Policy explains how we collect, use, disclose, and protect information when you use our Site or engage our services.

By using the Site or our services, you agree to the practices described in this policy. If you do not agree, please discontinue use of the Site.

Contact & Inquiry Data

When you submit our contact form, we collect your name, email address, organization type, phone number (optional), and the message content you provide. This information is used solely to respond to your inquiry.

Payment Information (via Stripe)

We use Stripe, Inc. to process payments for consulting engagements and invoices. When you make a payment, your payment card details (card number, expiration date, CVV) are entered directly into Stripe's secure payment interface and are never transmitted to or stored on our servers.

Stripe is PCI-DSS Level 1 certified. Your payment data is governed by Stripe's Privacy Policy. We retain only non-sensitive billing records (invoice amounts, dates, Stripe transaction IDs) for accounting and tax purposes.

Bank Account & Financial Data (via Plaid)

For clients who choose ACH bank transfer as a payment method, we use Plaid Technologies, Inc. ("Plaid") to verify bank account ownership and facilitate ACH transactions. To connect your bank account, you will authenticate directly through Plaid's secure interface using your financial institution's credentials.

Through this process, Plaid may access account holder name, account and routing numbers, account type, and account balance. This data is used only to verify your account and initiate the authorized payment. We do not store your bank login credentials; those are held by Plaid.

Your use of Plaid is subject to Plaid's End User Privacy Policy. By connecting your bank account through Plaid, you authorize Carbon Network Solutions to receive the account verification data described above and to share it with Plaid as necessary to complete your transaction.

Communications & SMS Data

If you opt in to receive SMS text messages from us (e.g., service alerts, appointment confirmations, or support communications), we collect your mobile phone number. Text messages are sent through Telnyx LLC, our SMS communications provider. See our SMS Terms of Service for full details.

Usage & Technical Data

Like most websites, our hosting provider (Cloudflare) automatically logs standard server data including IP addresses, browser type, referring URLs, and pages visited. This data is used for security monitoring and performance analysis. We do not use third-party analytics trackers (e.g., Google Analytics) on this Site.

• To respond to inquiries and provide consulting services
• To process payments and maintain billing records
• To send transactional SMS messages you have opted into
• To comply with applicable legal and tax obligations
• To protect against fraud, abuse, and security threats
• To improve and maintain the Site

We do not sell, rent, or trade your personal information to third parties for marketing purposes.

We share your information only in the following circumstances:

• Service Providers: Stripe (payment processing), Plaid (bank account verification), Telnyx (SMS delivery), Cloudflare (hosting and security). Each is bound by its own privacy policy and data processing agreements.
• Legal Compliance: Where required by applicable law, court order, or to respond to lawful government requests.
• Business Transfers: In the event of a merger, acquisition, or sale of company assets, personal data may be transferred as part of that transaction.

We retain personal data only for as long as necessary to fulfill the purpose for which it was collected and to comply with applicable legal obligations. Our specific retention periods are:

• Contact inquiry data — retained for up to 3 years from the date of last contact, then permanently deleted.
• Payment records and invoices — retained for 7 years to satisfy federal and state tax and accounting requirements, then permanently deleted.
• Plaid-sourced financial data — bank account holder name, account/routing numbers, account type, and balance data obtained through Plaid are used solely to complete the authorized transaction. This data is purged from our systems within 90 days of the transaction completion date, or immediately upon your written request, whichever comes first. We do not retain Plaid data beyond what is minimally necessary to reconcile the associated payment.
• SMS opt-in records — retained for 4 years from the date of opt-in or opt-out, as required by CTIA guidelines and applicable telecommunications regulations.
• Technical/server logs — retained for up to 90 days for security and performance purposes, then purged.

Data Deletion Requests

You have the right to request deletion of your personal data at any time. To submit a deletion request, contact us at [email protected] with the subject line "Data Deletion Request." We will acknowledge your request within 5 business days and complete the deletion within 30 days, except where retention is required by law (e.g., tax records). We will notify you in writing when the deletion is complete and confirm which, if any, data was retained and the legal basis for retention.

Note that deleting Plaid-sourced data does not affect data Plaid holds directly under their own privacy policy. To request deletion of data held by Plaid, submit a request directly via Plaid's privacy portal.

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your personal data (subject to legal retention requirements)
• Opt out of SMS communications at any time by replying STOP
• Lodge a complaint with the relevant data protection authority

To exercise any of these rights, contact us at [email protected].

This Site does not use advertising or analytics cookies. Cloudflare may set a security cookie (__cf_bm) for bot management purposes. Our Cloudflare Turnstile CAPTCHA integration may set a session cookie to verify human interaction on the contact form.

We implement reasonable technical and organizational measures to protect your information, including TLS/HTTPS encryption for all data in transit, Content Security Policy headers, and rate limiting on form submissions. No method of transmission over the internet is 100% secure; we cannot guarantee absolute security.

Our Site and services are not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it promptly.

We may update this Privacy Policy periodically. The "Last updated" date at the top reflects the most recent revision. Continued use of the Site after any changes constitutes acceptance of the updated policy.

For questions, concerns, or data requests related to this Privacy Policy, contact us at: