Privacy Policy

Night Lite USA LLC ("we," "us," or "our") operates the Eco-Auditor platform, a carbon accounting and emissions management service. Developer312 is a brand (dba) of Night Lite USA LLC. This Privacy Policy describes how we collect, use, disclose, and protect information when you use our service.

By accessing or using Eco-Auditor, you agree to the collection and use of information in accordance with this policy. If you do not agree with the terms of this policy, please do not access the service.

This policy applies to all users of Eco-Auditor, including account holders, team members invited by account holders, and visitors to our website.

Night Lite USA LLC operates the Eco-Auditor platform from Hayward, CA. Developer312 is a brand (dba) of Night Lite USA LLC.

Contact information:

• Night Lite USA LLC, 25200 Carlos Bee Blvd, Hayward, CA 94542
• Email: hello@developer312.com
• Phone: (510) 591-0163

We collect information in several categories to provide and improve our service:

When you create an account or use our service, you may provide:

• Account details: Name, email address, password, company name, and role
• Company information: Organization name, industry, facility locations, and operational details
• Billing and contact information: Payment details, billing address, and designated billing contacts
• Support communications: Messages, attachments, and correspondence submitted through our support channels
• Uploaded documents and data: Utility bills, invoices, freight records, supplier spreadsheets, and other files you upload for emissions processing
• Sales chat: Messages you type in the on-site sales chat. If you book a demo or ask to be contacted, we also store your name, email, company, and the date, time, or message you submit. The browser keeps a session id named ecochat_session_id in local storage. The assistant runs on Eco-Auditor's own application server. It does not send the conversation to a third-party AI model. Those lead details are stored in the application database.
• Configuration choices: Organizational boundaries, emission factors, methodology selections, and reporting preferences

We process this information to deliver the service you requested, maintain your account, and communicate with you about our platform.

When you interact with our service, we may automatically collect:

• Usage and log data: Pages visited, features used, click patterns, session duration, and interaction timestamps
• Device and connection data: Browser type, operating system, IP address, screen resolution, and referring URL
• Performance data: Load times, error reports, and system performance metrics

We collect this information to ensure platform stability, diagnose issues, and improve user experience. We do not sell this data.

Eco-Auditor does not currently connect to any third-party accounting, shipping or logistics service, so we do not receive data from them today. The following categories describe what we would receive if and when such integrations are released:

• Data from accounting integrations (e.g., QuickBooks, Xero) such as transaction records relevant to emissions calculations
• Data from shipping and logistics providers (e.g., UPS, FedEx) such as shipment records for freight emission estimates
• Data from cloud service providers for Scope 3 ICT emission calculations

If released, we will only access data you explicitly authorize through those integrations, and we will process it solely for the purpose of generating emissions estimates within your account. Any new integration will be listed as a subprocessor before it goes live.

We use the information we collect to:

• Provide, operate, and maintain the Eco-Auditor platform
• Process and organize uploaded documents and data into emissions records, estimates, and reports
• Answer the on-site sales chat and store demo or contact requests you submit there
• Communicate with you about your account, billing, support requests, and product updates
• Improve our service, develop new features, and conduct internal analytics
• Detect, prevent, and address technical issues, security threats, and fraud
• Comply with applicable legal obligations

Where we process personal data of individuals in the European Economic Area or the United Kingdom, we rely on the following legal bases:

• Contract performance: Processing necessary to deliver the service you subscribed to
• Legitimate interests: Improving our service, preventing fraud, and ensuring security, where those interests are not overridden by your rights
• Consent: Where you have provided explicit consent for specific processing activities, such as optional marketing communications
• Legal obligation: Processing required to comply with applicable law

We do not sell your personal data. We may share information in the following circumstances:

Service Providers and Subprocessors

We engage third-party service providers who process data on our behalf to deliver our service. These providers are contractually obligated to process data only as instructed and to maintain appropriate security measures. Categories include:

• Railway: Hosts the application.
• Cloudflare: CDN and reverse proxy in front of the application.
• InsForge: Authentication (including Google, Microsoft, and Apple sign-in), the Postgres database, and verification or password-reset email. The project API host is in us-east.
• Stripe, Inc.: Subscription billing.
• Google: Sign-in, and Google Tag Manager and Google Analytics 4, which load only after you accept analytics cookies.
• Microsoft and Apple: Sign-in, only if you choose those buttons.

The sales chat does not use a separate AI vendor. Fonts are served from this application, not from Google Fonts. The Data Processing Addendum lists the same parties. A copy is available on the DPA page and on request.

Compliance and Legal Requirements

We may disclose information when required by law, regulation, legal process, or governmental request, or when we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others.

We retain your information for as long as your account is active or as needed to provide our services. Data retention and deletion work as follows:

• Export: You can export your workspace data at any time from Settings as a machine-readable JSON download
• Audit data: You can delete your emissions entries and facilities at any time from Settings (“Delete my audit data”); deletion takes effect immediately
• Account record: Your account record is retained while your subscription is active and until you request full account deletion via support
• Account deletion: Full account deletion requests submitted via support are processed within 30 days, subject to retention required by applicable law
• We may retain anonymized, aggregated usage data indefinitely for service improvement
• Some data may be retained longer where required by law or for legitimate business purposes such as fraud prevention

We implement appropriate technical and organizational measures to protect your information, including:

• Encryption of data in transit using TLS 1.2+
• Encryption of data at rest
• Role-based access controls and least-privilege principles
• Regular security assessments and vulnerability management
• Incident response procedures
• Employee confidentiality obligations

While we strive to protect your information, no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security.

Eco-Auditor is operated from the United States. If you are accessing our service from the European Economic Area, the United Kingdom, or other regions with data protection laws, please be aware that your information may be transferred to and processed in the United States.

Where required, we implement appropriate safeguards for international transfers, including Standard Contractual Clauses where applicable. EU-facing customers can request a Data Processing Addendum from our legal page.

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you
• Correction: Request correction of inaccurate or incomplete personal data
• Deletion: Delete your audit data (emissions entries and facilities) yourself from Settings at any time; request full account deletion via support, and we will process it within 30 days, subject to lawful retention requirements
• Portability: Export your data yourself as a machine-readable JSON download from Settings at any time
• Restriction: Request restriction of processing in certain circumstances
• Objection: Object to processing based on legitimate interests or for direct marketing
• Withdrawal of consent: Withdraw consent you have previously provided, without affecting the lawfulness of processing based on consent before its withdrawal

To exercise any of these rights, please contact us using the information in the Contact section below. We will respond within the timeframe required by applicable law.

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) as amended by the CPRA:

• Right to know: You can request information about the categories of personal information we have collected, the purposes, and the categories of third parties with whom we share it
• Right to delete: You can request deletion of personal information we have collected, subject to certain exceptions
• Right to correct: You can request correction of inaccurate personal information
• Right to opt out of sale or sharing: We do not sell personal information. Marketing cookies that may involve sharing for cross-context behavioral advertising are used only with your consent, and you can opt out at any time through the cookie preferences settings; we also honor Global Privacy Control signals
• Right to limit use of sensitive personal information: We do not collect or use sensitive personal information beyond what is necessary to provide our service

We are not a data broker and do not sell personal information. Our service is directed at businesses, and the personal information we process is primarily business-related rather than consumer-oriented.

Authorized agents may submit requests on your behalf, subject to verification.

To submit a privacy request, exercise your rights, or ask questions about this policy, you may contact us through:

We will verify your identity before processing your request and respond within the timeframe required by applicable law, typically within 30 days. If more time is needed, we will notify you of the reason and the expected timeline.

We use cookies and similar tracking technologies to operate our service, maintain session state, and analyze usage patterns. Categories of cookies we use include:

• Essential cookies: Required for authentication, security, and basic service functionality
• Analytics cookies: Help us understand how users interact with our service so we can improve it. Google Analytics 4, loaded through Google Tag Manager, may set cookies whose names start with _ga (including _ga_*) and _gid. Google Tag Manager and Google Analytics 4 are not part of the initial page; they load only after you accept analytics cookies
• Preference cookies: Remember your settings such as theme preferences
• Marketing cookies: Used only with your consent to support marketing activities such as personalized advertising; these are off by default

Analytics, preference, and marketing cookies are set only if you consent to them. You can grant or withdraw consent at any time through the cookie preferences settings on our site or manage cookies through your browser settings. We also honor Global Privacy Control (GPC) and Do Not Track browser signals. Disabling essential cookies may affect service functionality.

Our service is intended for business use and is not directed at individuals under the age of 16. We do not knowingly collect personal information from children. If we learn that we have collected personal data from a child under 16, we will take steps to delete it promptly. If you believe we have inadvertently collected such information, please contact us.

We may update this Privacy Policy from time to time to reflect changes in our practices, features, vendors, or legal requirements. When we make material changes, we will:

• Update the "Last updated" date at the top of this page
• Provide notice through our service or by email for significant changes
• Obtain your consent where required by applicable law

Continued use of the service after changes become effective constitutes acceptance of the updated policy.

If you have any questions about this Privacy Policy or our data practices, please contact: