GHGMET PLATFORM

1. INTRODUCTION

Colorado State University ("CSU," "we," "us," or "our") operates the GHGMet Platform ("Platform"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Platform at ghgmet.com, app.ghgmet.com, and associated services.

We are committed to protecting your privacy and ensuring you understand how your information is handled. Please read this policy carefully. If you disagree with its terms, please discontinue use of the Platform.

2. OUR CORE PRIVACY PRINCIPLE

You own your data. The Platform does not claim ownership, reuse rights, or research rights over user-submitted data. Your agricultural field data, model inputs, and model outputs belong entirely to you.

3. INFORMATION WE COLLECT

3.1 Account Information

When you create an account through our authentication provider (Auth0), we collect:

Email address

Name (as provided during registration)

Authentication credentials (managed securely by Auth0)

3.2 User-Provided Project Data

When you use the Platform, you may provide:

Field boundaries and geographic coordinates

Field location data (latitude, longitude, administrative area)

Crop and agricultural management information

Model inputs and configuration selections

Project names, descriptions, and organizational data

3.3 Model Outputs

The Platform generates model outputs based on your inputs, including greenhouse gas emissions estimates and related calculations. These outputs are stored in association with your account.

3.4 Automatically Collected Information

We automatically collect certain technical information required for Platform operation:

Timestamps and activity logs

Model run identifiers and execution metadata

Error logs and diagnostic information

Browser type and device information (for compatibility and troubleshooting)

4. HOW WE USE YOUR INFORMATION

We use collected information solely for:

Platform Operation: Providing, maintaining, and improving Platform functionality

Model Execution: Running agricultural models based on your inputs

Account Management: Managing your account and authentication

Support: Responding to your inquiries and providing technical assistance

Security: Protecting against unauthorized access and ensuring system integrity

Communications: Sending important Platform notices and updates

5. WHAT WE DO NOT DO WITH YOUR DATA

We explicitly commit to NOT:

Share your data publicly

Use your data for research purposes without your explicit consent

Sell your data to third parties

Use your data for advertising or marketing purposes

Access your data without your consent (except as required by law)

6. DATA ACCESS AND ADMINISTRATIVE CONTROLS

6.1 Limited Administrative Access

Platform administrators may only access your project data if you explicitly grant permission through in-platform settings. Such access is limited to troubleshooting and support purposes.

6.2 Contractor Access

Software development contractors working on the Platform have access to code and infrastructure but do not have routine access to user project data.

7. DATA STORAGE AND SECURITY

7.1 Infrastructure

Your data is stored on cloud infrastructure (Google Cloud Platform) with industry-standard security measures including encryption in transit (TLS 1.2+) and encryption at rest.

7.2 Security Measures

We implement security measures consistent with HECVAT Lite compliance standards, including:

Multi-factor authentication (MFA) requirement

Secure session management with automatic timeout

Audit logging of authentication events

Role-based access controls

Regular security monitoring

8. DATA RETENTION

Data Type

Retention Period

User Project Data

Retained until you delete it or request deletion

Model Outputs

Retained until you delete associated project

Account Information

Retained while account is active; deleted upon account closure

Operational Logs

Approximately 30 days (for troubleshooting)

9. THIRD-PARTY SERVICES

The Platform uses the following categories of third-party services:

Authentication (Auth0): Manages user login and security. Subject to Auth0's privacy policy.

Cloud Infrastructure (Google Cloud): Hosts Platform services and data storage.

Data Providers: Soil data, climate data, and mapping services that enhance Platform functionality.

We do not share your personal project data with third-party data providers. Only anonymized location coordinates are used to retrieve environmental data.

10. INTERNATIONAL USERS AND GDPR

10.1 European Users

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, the General Data Protection Regulation (GDPR) and related laws apply to our processing of your personal data.

10.2 Data Controller

You are the Data Controller for the agricultural and project data you submit to the Platform. CSU acts as the Platform Operator, providing the infrastructure and tools for your use.

10.3 Legal Basis for Processing

We process your data based on:

Contract Performance: To provide the Platform services you request

Legitimate Interests: To maintain Platform security and functionality

Legal Obligation: When required by applicable law

10.4 Your GDPR Rights

Under GDPR, you have the right to:

Access: Request a copy of your personal data

Rectification: Request correction of inaccurate data

Erasure: Request deletion of your data ("right to be forgotten")

Data Portability: Receive your data in a structured, machine-readable format

Restriction: Request limitation of processing in certain circumstances

Objection: Object to processing based on legitimate interests

To exercise these rights, contact us at privacy@ghgmet.com.

10.5 International Data Transfers

Data may be transferred to and processed in the United States. We implement appropriate safeguards for such transfers, including standard contractual clauses where applicable.

11. YOUR CHOICES AND CONTROLS

Delete Data: You may delete projects, fields, and associated data at any time through the Platform

Export Data: You may export your data in supported formats (JSON; PDF planned)

Close Account: You may close your account by contacting us or using in-platform features

Consent Withdrawal: Where processing is based on consent, you may withdraw consent at any time

12. CHILDREN'S PRIVACY

The Platform is not intended for individuals under the age of 16. We do not knowingly collect personal information from children. If we learn we have collected information from a child, we will delete it promptly.

13. CHANGES TO THIS POLICY

We may update this Privacy Policy periodically. If we make material changes, we will notify you by email or through the Platform before the changes take effect. The "Effective Date" at the top indicates when this policy was last revised.

14. CONTACT INFORMATION

For privacy-related questions, concerns, or to exercise your rights, please contact:

Email: privacy@ghgmet.com

Mail:

GHGMet Platform - Privacy Inquiries

Colorado State University

1490 Campus Delivery

Fort Collins, CO 80523

For EU residents with unresolved privacy concerns, you also have the right to lodge a complaint with your local data protection authority.

* * *

© 2026 Colorado State University. All rights reserved.