Privacy and security

KarbonKit is built and run by Michael Fell, a researcher at University College London. For the data described on this page, KarbonKit is the data controller. Contact: hello@karbonkit.com.

KarbonKit is a working product not a UCL research project, and data collected through the widgets is not used as research data.

The widget sets no cookies. It contains no advertising or analytics trackers, no pixels, no fingerprinting, and no third-party scripts. It stores nothing in your visitor's browser unless they ask it to: the AI assistant's logbook has a “Remember on this device” box, unticked by default, which keeps their saved answers in that browser and nowhere else. There is nothing here that needs a cookie banner on your site.

The embed loader is a single small script that mounts a sandboxed iframe and stops. It makes no network request of its own, so nothing about your page is reported back to us.

KarbonKit's own marketing site uses one browser storage entry to remember UTM parameters within a single session, so we can tell which link brought a prospective embedder to us. It is not present on the widget.

On the IP address. We record a truncated one against usage events: the last part is removed before it is stored, so 203.0.113.47 is kept as 203.0.113.0. That is enough to spot abuse and see the rough region, not to identify a household. We do not hold the full address after the request is served.

Boiler escape plan. A visitor can have their plan emailed with calendar reminders attached. This needs a ticked consent box; there is no pre-ticked box and no way to reach it accidentally. The plan is emailed once, and then we do not keep the email address at all. It is used to send the message and discarded with the request. What we do keep is anonymous: boiler age, fuel, heat demand, readiness score, the outward half of the postcode – SG12, not SG12 9XY – and two flags recording that the box was ticked and that the message sent. We do not keep the full postcode, the address, or the EPC certificate reference. There is no column anywhere in that record that says who the visitor was. They are not added to any mailing list and are not emailed again.

Quote requests. The calculator had a quote request form until 2 October 2026. Requests sent through it were not passed to any installer, and are kept for 24 months.

Enquiries. Some widgets carry a short "get in touch" form. It is off by default and only appears where the organisation running that widget has switched it on and named itself, so a visitor always knows who they are about to hear from before they tick the box. We hold the name, email, optionally a phone number, the postcode, anything typed into the message box, what they are hoping to achieve where the organisation chose to ask, and a summary of what the widget worked out – including a suggested next step worked out from the answers already given – and we send it straight to that organisation. From that point they hold the details and they are the ones who will make contact; our copy exists so a bounced email is not a lost enquiry and so the record can be looked up if someone asks. We store the exact wording that was consented to alongside it.

We never market to your visitors. KarbonKit does not send promotional email to people who use a widget on your site.

The AI assistant widget takes a household through the same checks as the other widgets – boiler escape plan, radiator check, grants, costs and savings, finding installers. It stores and logs nothing a household tells it. Each check uses only the answers it needs, and says which before it starts. It never needs a name, email or phone number.

• Postcodes. A full postcode and house number or name are used only to look up the home’s EPC, if the household asks; only the postcode goes to the register. The grants check can take a postcode to compare with the government’s Warm Homes list, held on our server. Finding installers and costs and savings take only the first half of a postcode (SW1A, say); finding installers passes it to postcodes.io.
• Costs and savings. Besides the home’s type, bedrooms and age (or its EPC rating and floor area, or a year’s energy use), this check can take whether the home already has solar panels, a battery or an electric car, and, only if the household chooses to say, roughly how big the panels are or how much electricity charges the car. It uses them to avoid costing what the home has and to size new kit; they are kept only in the household’s own pick-up message.
• Anthropic. Processes chat and helper messages for us under its standard data processing terms. It does not train its models on them and deletes them within 30 days, or keeps them for up to 2 years if its automated safety checks flag them (and the safety checks’ scores for those messages for up to 7 years). Data is stored in the US, under the EU standard contractual clauses with the UK addendum. Visitors are asked not to type their name, address or contact details.
• The conversation. The chat is held in the visitor’s browser until they close the page. We keep no copy, and the organisation running the widget never sees it.
• Saved answers. A household keeps its answers as a short pick-up message, which it holds, not us. Pasted back, it is read and nothing is kept. A link back to the logbook carries the answers in the part of a web address that browsers never send to a server.
• Notes for an installer. Where a household’s home doesn’t fit an answer, they can keep a note in their own words. It stays in the page and reaches the organisation only inside an enquiry they choose to send, shown to them first, and is then kept like any enquiry.
• Usage counts. For each assistant widget we count events per day – a check started, a chat finished – as the widget’s id, the date, the event and a number. Nothing about who. Unticking “Count visits” stops it.

The installer finder lists businesses that install heat pumps, solar panels or home batteries. Since 14 November 2026 every detail in it comes from one of two places: Companies House (the company’s name, number and status), and the business’s own website (its website address, phone number, a general email address such as info@ or enquiries@, postcode, what it says it installs, the areas it says it covers and the accreditations it names). Nothing comes from Google, the MCS register, review sites or social media.

We do not keep ratings or reviews, staff names, or email addresses that name a person. Our crawler identifies itself as KarbonKitBot, follows each site’s robots.txt, and the pages it fetches are deleted after 90 days.

If your business is listed and a detail is wrong, or you would rather not be listed, email hello@karbonkit.com from an address at your business’s own domain. We will correct or remove the listing, and a business that has been removed is not listed again.

Postcodes, addresses and EPC lookups used to produce an on-screen estimate are never saved to a database or written to our logs. To make repeat searches faster, the server keeps recent results in memory – up to 7 days for an EPC search, 24 hours for finding where a postcode is – not linked to who searched, and loses them whenever it restarts. The same goes for what a household tells the AI assistant: it is used for the reply and not saved.

Usage events, boiler escape plan records (which identify no one) and the earlier quote requests are kept for 24 months. Enquiries are kept for 12 months – shorter, because they hold the most identifying set of details we handle and a year-old enquiry is no longer a live one. Account data is kept while the account is open and deleted within 30 days of closure. A widget you delete stops working at once and can be restored for 30 days; its settings are then removed by the next monthly run. Enquiries it has already sent you are kept for their own 12 months.

Deletion is a scheduled monthly job. We can evidence the runs if your governance process needs that.

If you want something removed sooner – yours or, as an embedder, on behalf of one of your visitors – email us and we will do it.

Everything below is in the UK or the EEA, or covered by the UK's adequacy and transfer arrangements. There are no advertising or analytics companies on it, because we use none.

We do not sell data, and we do not share it with anyone not listed here.

• Everything is served over HTTPS. Widgets run in a sandboxed iframe, so a widget cannot read or alter the page it is embedded in, and the host page cannot read the widget.
• Database tables have row-level security enabled with no public grants. There is no browser-direct database access from anywhere in the product; the application server is the only path in.
• Personal data is never written to application logs. Email addresses are excluded explicitly, not incidentally.
• Each embed is issued a random configuration id. An embedder can restrict their widget to named websites. This is a convenience control, not a security boundary: some browsers do not tell an iframe which site it is on, and then the widget still loads.
• API endpoints are rate limited, and the paid third-party lookups have hard daily caps.
• Payment card details are never handled by KarbonKit and never touch our servers.

Under UK GDPR you can ask us for a copy of your data, ask us to correct or delete it, object to processing, or withdraw consent. Email hello@karbonkit.com and we will respond within one month.

Because most widget use is not linked to anyone's identity, we often hold nothing about a given visitor at all – and that includes the boiler escape plan, where the email address is discarded once the plan is sent, so there is nothing left to look up, hand over or delete. If you sent a quote request or an enquiry, tell us the email address you used and we can find it. For an enquiry, note that the organisation you sent it to holds their own copy – we will tell you who that was so you can ask them too.

If you are unhappy with how we have handled it you can complain to the Information Commissioner's Office at ico.org.uk.

This section is for the organisation putting a widget on its site – a council, a housing association, a community energy group, an installer – and is the part worth forwarding to a data protection officer.

• Roles. For the widget's own processing, KarbonKit is a controller in its own right, not your processor: we decide what the calculator collects and why, and we are accountable for it. You do not need a processor agreement to embed a widget. Where you send us your own data – a curated installer list, your branding, your account details – we act on your instructions, and we will sign a data processing agreement covering that if your governance requires one.
• Enquiry collection changes that. It is off unless you switch it on. If you do, you are asking visitors to hand you their contact details, and from the moment they arrive with you, you are the controller of them: your own privacy notice needs to cover contacting people who use the widget, and the lawful basis is the consent they gave to hear from you, named on the form. We hold our copy for 12 months so you can retrieve an enquiry a bounced email lost, and we will sign a processing agreement for that. We do not contact your visitors ourselves and we do not pass them to anyone else.
• Cookie consent. The widget sets no cookies and stores nothing in the visitor's browser unless they tick a box asking it to, so embedding one does not add anything to your cookie banner or your consent management platform.
• DPIA. If your process requires a data protection impact assessment for a new digital tool, we will help fill it in. The material facts are on this page; ask us for anything else and we will answer specifically rather than pointing at a policy.
• Analytics are yours to turn off. Untick “Count visits” on the widget in your dashboard and nothing at all is recorded about visits to it.
• Your description in the AI assistant. What you approve about your organisation is stored with your widget and shown to households. If you ask us to draft it from your website, we read up to six pages of the site you name, honouring its robots.txt, and send their text to Anthropic to write the draft, along with your answers to any follow-up questions. The same reading notes your site’s name and colour (from its page title and settings) and any KarbonKit widgets already on those pages, to suggest your widget’s settings; those are not sent to Anthropic. Nothing reaches households until you approve it, and we keep neither the pages nor the draft. Once you approve a description drafted this way, we keep the address and a fingerprint of each page – never its text – and re-read the same pages from time to time, the same way, to compare them. If they have changed, your dashboard shows a note asking you to review the description; we never change it ourselves. Removing the description stops this.
• Accessibility and estimates. Widgets present ranges, never quotes, and the installer directory is explicitly labelled as a public-records listing rather than a recommendation. That matters for a public-sector site and it is deliberate – see how we work.

If we change what we collect, we will change this page and move the date at the top. Material changes affecting existing embedders will be emailed rather than only posted here.