Privacy Policy

1. Introduction & Scope

This Privacy Policy explains how Impact Link Asia ("Impact Link Asia", "EcoChain", "we", "us", or "our") collects, uses, shares, and protects information in connection with the EcoChain platform (the "Service"). It applies to registered users acting on behalf of a Company, and to visitors of our public pages.

This Policy should be read together with our Terms of Service.

2. Information We Collect

Account information: your email address, password (stored as a salted hash, never in plain text), and sign-in activity, including one-time passcodes (OTP) sent for verification.

Company Profile information you or your Company provide, which may include:

• company name, registration number, tax ID, and legal representative;
• contact person, contact email, contact phone, business address, and country;
• industry and sub-industry classification, employee-count range, and annual revenue range;
• website, year established, number of locations, and a description of products/services offered.

Assessment & report data: your responses to sustainability assessment questions, supporting evidence documents you upload, computed scores, and any AI-generated Engineering Report produced from this data.

Usage data: log and device information such as IP address, browser type, pages visited, and timestamps, collected automatically as you use the Service.

We do not knowingly collect more personal information than is needed to provide the Service.

3. How We Use Your Information

We use the information described above to:

• create and secure your account, and authenticate sign-ins (including OTP delivery);
• calculate your sustainability assessment scores and generate reports;
• operate account features such as the dashboard, notifications, and document storage;
• provide customer support, including authorized account troubleshooting by EcoChain staff;
• maintain the security, integrity, and audit trail of the Service;
• comply with legal obligations and enforce our Terms of Service.

We do not sell your personal information, and we do not use your Company Profile or assessment data to train AI models for use outside your own account, except where a specific feature explicitly says otherwise and you have consented to it.

4. Cookies & Similar Technologies

We use strictly necessary cookies/local storage to keep you signed in and remember basic preferences (such as a collapsed sidebar). We do not currently use third-party advertising or cross-site tracking cookies on the authenticated application. If that changes, this Policy will be updated in advance.

5. How We Share Your Information

We do not share your Company's data with other Companies on the platform. We share information only in the following situations:

• Service providers (processors) who help us operate the Service under confidentiality obligations — for example, cloud object storage for uploaded documents, transactional email delivery for account and OTP messages, and AI service providers used to generate the Engineering Report;
• EcoChain staff, on a need-to-know basis, including through an audited "view as" support mode that lets authorized staff see an account the way its users do to diagnose issues — every use of this mode is logged with the staff member, the account, and the time;
• legal & compliance reasons, where we believe disclosure is required by law, regulation, or valid legal process, or to protect the rights, property, or safety of EcoChain, our users, or the public;
• business transfers, if EcoChain or Impact Link Asia is involved in a merger, acquisition, or asset sale — you will be notified before your information becomes subject to a different privacy policy.

6. Data Storage & International Transfers

Your information is stored using reputable cloud infrastructure providers, including object storage for uploaded documents. Because our providers operate global infrastructure, your information may be processed or stored in a country other than your own. Where this occurs, we require our providers to maintain appropriate safeguards for the information they process on our behalf.

7. Data Retention

We retain account, Company Profile, and assessment data for as long as your account is active, and for a reasonable period afterward to comply with legal, accounting, or reporting obligations, resolve disputes, and enforce our agreements. You may request deletion of your account and associated data as described in "Your Rights & Choices" below, subject to any retention we are legally required to keep.

8. Your Rights & Choices

Depending on your location, you may have the right to:

• access the personal information we hold about you;
• correct inaccurate or incomplete information — most Company Profile fields can be edited directly in the app;
• request deletion of your account and associated personal information;
• object to or request a restriction on certain processing;
• request a copy of your data in a portable format.

To exercise any of these rights, contact us using the details in "Contact Us" below. We may need to verify your identity before acting on a request.

9. Data Security

We use technical and organizational measures designed to protect your information, including password hashing, transport encryption, role-based access control, and audit logging of sensitive administrative actions such as support "view as" access. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

10. Children's Privacy

The Service is intended for business use by adults acting on behalf of a Company and is not directed to children. We do not knowingly collect personal information from children.

11. Changes to This Policy

We may update this Policy from time to time. If we make material changes, we will notify registered users (for example, by email or an in-app notice) before the change takes effect.

12. Contact Us

Questions about this Policy, or requests to exercise your data rights, can be sent to: