Privacy

CBAMReturn is pre-launch. The only personal information we collect is what you choose to give us through the waitlist form: your email address and, optionally, your company, role, the sectors you import and a rough import-value band.

We use it for one thing: telling you about CBAMReturn — early access, the supplier data template, and occasional plain-English updates when the UK CBAM rules move. We don't sell it, share it, or add you to anything else. Every email includes an unsubscribe link, and you can ask us to delete your details at any time by emailing hello@cbamreturn.co.uk.

Waitlist entries are stored on our own server infrastructure, and signup notifications are delivered to us by email. The legal basis for processing is your consent, given when you submit the form.

The threshold checker runs entirely in your browser — nothing you enter into it is transmitted to us.

Liability preview. The file you upload is processed in memory on our own infrastructure and discarded when the page responds; it is never written to disk or stored. We keep your email address, company name and the headline totals of the report (so we can send you the summary email and rule-change alerts) — nothing line-level.

Accounts. If you create an account, we store your email address, company name, an optional password (as a one-way hash), and any import ledgers you explicitly choose to save, on our own server infrastructure in the UK/EU. Saved ledgers exist so we can re-test them for you monthly; you can delete any ledger, or the whole account, at any time from the dashboard or by emailing us. Organisations add: the documents you upload to the records vault (kept until you delete them, with a SHA-256 checksum), an append-only audit log of actions taken in the organisation (who, what, when, and the IP address the request came from), the email addresses you invite, and, if you turn on two-step verification, an authenticator secret and hashed recovery codes. For each signed-in device we record its browser identifier, IP address and last-seen time so you can review and sign out devices. Owners can export everything the organisation holds at any time. Signed-in users receive two strictly necessary cookies (the session and the current organisation); the site sets no other cookies and uses no tracking cookies.

Server logs and analytics. Like every website, our server records each request (page requested, time, IP address, browser type, referring page) in access logs, which are kept on our own infrastructure and rotated automatically. We use these logs, aggregated, to count visits and see which pages are read — no analytics scripts, no third-party services, no cookies, and no profile of any individual. The legal basis is our legitimate interest in running and improving the site.

Last updated 4 September 2026.