Privacy, cookies and AI.
How we handle your data under the EU and UK GDPR, India's DPDP Act and US state privacy laws, including when AI tools are involved.
Privacy notice
Controllers: GreeneStep Technologies Inc. (United States) and GreeneStep Technologies Pvt Ltd (India). For any privacy question or request, write to info@greenestep.com.
| What we collect | Why | Lawful basis | Kept for |
|---|---|---|---|
| Name, designation, work email, mobile | Create your JIVA account, run the beta | Contract | Beta + 24 months |
| Organization, sector, roles, location | Configure emission factors and templates | Contract | Beta + 24 months |
| Maturity answers and five measures | Baseline and progress tracking | Contract | Beta + 24 months |
| Marketing preferences | Product news and events | Consent | Until withdrawn |
| Consent records | Prove what you agreed to | Legal obligation | 6 years |
Transfers between India, the US and the EU use the European Commission's Standard Contractual Clauses. We never sell personal data.
When we use AI assistants
JIVA's embedded agents may call third-party models such as OpenAI ChatGPT, Anthropic Claude or Google Gemini. These rules apply to every model and every call.
Enterprise and API tiers only
We use business offerings where prompts and outputs are not used to train the provider's models, never consumer chat apps.
Contracts first
Every model provider signs a data processing agreement with Standard Contractual Clauses before any personal data reaches it.
Minimise and mask
Names, emails and phone numbers are stripped or pseudonymised before a prompt leaves JIVA. Special category data is never sent.
Short retention
We choose zero or minimal retention settings, and keep our own audit log of what each agent sent and received.
A human decides
AI drafts reports and suggestions. No decision with legal or similar effect on you is made by AI alone (GDPR Article 22).
Labelled and optional
AI-generated content is marked as such, in line with the EU AI Act. You can switch AI features off at any time.
Want the model-by-model sub-processor list? Ask at info@greenestep.com. You can switch off AI features per company in JIVA settings.
AI crawlers and training
Public pages on greenestepjiva.com may be read by search engines and AI answer agents, but are never to be used for AI training. The JIVA app, form submissions and any page holding personal data are closed to every crawler.
Security by design
- HTTPS only, with HSTS and a strict Content-Security-Policy.
- Third-party scripts load only after consent, with Subresource Integrity.
- Forms carry CSRF tokens, rate limits and a bot check. No personal data in URLs.
- Passwords are hashed by the JIVA app and never stored in your browser.
- Personal data is minimised before any AI call, and every AI request is logged for audit.
Use your rights
Access, correct, erase, restrict, object, or take your data with you. We reply within 30 days. You can also complain to your data protection authority.