Privacy Policy

1In short

This summary does not replace the sections below. This policy covers the Substrate website, the producer application, the Supplier Portal and the PRO Console (together, the “Service”), on both of the deployments described in §6.

2Who we are

The Service is run by Trash Club Insights (“we”, “us”). For the personal information we handle for our own purposes, such as running accounts, keeping the Service secure and answering your email, we decide how it is used, and this policy governs.

For the packaging, volume and filing data a customer puts in its workspace, we are a service provider under the California Consumer Privacy Act, and a processor under similar laws. We handle that data to provide the Service, and as the law allows a service provider: to build and improve our services, and to de-identify it (§4). Our customer data processing agreement sets out those terms. If your personal information is in a customer’s workspace, that customer is responsible for it, and §12 explains how we pass your request on.

3What we collect

The categories use the names California law uses. The only sensitive personal information, as California defines it, that we collect is your account sign-in: your email address and password, which we keep only as a one-way hash. We use it only to sign you in and keep your account secure. We collect no government identifiers, no financial account numbers, no precise location, and no biometric, health, racial, religious or union data.

What we do not collect

• No advertising or cross-site tracking identifiers.
• No analytics or product-tracking service. The Service runs no such script.
• No precise location.
• No personal information bought from data brokers.
• No consumer data. Substrate is a business tool. The packaging data it holds describes materials and weights, not people.

4Why we use it

We use personal information for these purposes:

• To run your account: sign you in, keep you signed in, apply your role’s permissions, and show colleagues and the companies you work with who you are.
• To keep the Service secure: slow down password guessing, end sessions, and look into suspected misuse.
• To keep regulatory records sound: record who confirmed a figure and who attested a filing, so a filing can be defended for as long as a state may question it.
• To write to you: invitations, password resets, notices about the Service, and replies to you.
• To improve and develop our services: read the feedback reports you send, study how the Service is used and performs, and build and improve our products, including through analysis and model development.
• To create aggregated or de-identified data that does not identify you, which we may use for any purpose, including benchmarks, research and training models.
• To meet legal duties: including answering lawful requests and enforcing our Terms.

When we de-identify information, we keep it in de-identified form, take reasonable measures so it cannot be linked to you, and do not try to re-identify it. We make no automated decisions about you that have legal or similarly significant effects.

5We do not sell or share it

We have not sold personal information, or shared it for cross-context behavioral advertising, in the 12 months before the date of this policy. We do neither now. That is why we offer no “Do Not Sell or Share” link: there is nothing for it to stop. For the same reason, Global Privacy Control and similar browser signals are honored by default.

6Two deployments, and the wall between producers and the PRO

Substrate runs as two separate deployments, built from the same code:

• The demonstration, at substratereport.com. Its workspaces hold invented companies. To enter, a visitor needs an access code or pass from us, which we may send by email. It has its own database.
• The client service, at app.substratereport.com. Real customers work here, on a database of its own. We never copy data between the two databases, and client data never goes to the demonstration.

Substrate also has a console for a producer responsibility organization (PRO), the body that receives filings. Today the PRO Console runs only on the demonstration, on invented data, on its own host with its own database credential, which cannot read producer workspaces. The client service has no PRO Console.

7Cookies

These are all the cookies the Service sets. Each is needed for the site to work, none is used for analytics or advertising, and no other company sets cookies through the Service. Each is set HttpOnly and Secure, so page scripts cannot read it and it never travels over an unencrypted connection.

Because these cookies are strictly necessary, we show no consent banner. If you block them, you cannot sign in.

8Who else receives your data

We use the providers below. Each is bound by data-protection terms with us that limit it to handling data to provide its service to us. The same list is on its own page, at substratereport.com/subprocessors, and we keep it current.

Some features are built but switched off. Switching one on would add a provider:

• Reading uploaded specification sheets with an AI model. This feature exists in the code and is switched off. It would send a document's contents to an AI provider. Before it is switched on, the provider will be added to this list. It refuses a supplier's confidential document unless a zero-retention agreement with the provider is on file.

Changes. We may change these providers. When we do, we update the list. The data processing agreement covers customers.

Beyond these providers, we disclose personal information only: to the administrators of your own workspace; where you tell us to (a supplier publishing a specification to a brand that asked for it); to our professional advisers, under confidentiality; where the law or valid legal process requires it, or to protect our rights, our users or the Service; and in connection with a merger, acquisition, financing or sale of all or part of our business. Aggregated or de-identified data that identifies no one is not personal information, and we may share it.

9How long we keep it

We keep personal information for as long as the purpose it was collected for needs, and then as long as the law requires or we need it to resolve disputes and enforce our agreements. The table gives the longest period, or the reason, for each kind of record.

Uploaded files are not in the database backups. Specification documents are kept in a separate file store, one copy each. If a file were lost, we could not restore it from a backup, and we would ask for it again. Keep your own copy of anything you upload.

10How we protect it

We use reasonable administrative, technical and physical measures to protect personal information, suited to the data we hold.

No system is perfectly secure, and we do not claim ours is. If a breach affects personal information, we will notify the affected people, our customers and the authorities as the law requires. Report a suspected weakness to legal@trashclubventures.com.

11Your rights

If you live in California, the CCPA, as amended by the CPRA, gives you the rights below. Colorado and several other states give their residents similar ones.

• To know what personal information we hold about you, where it came from, why we use it, and who we disclosed it to.
• To access a copy of it in a portable format.
• To correct it if it is wrong.
• To delete it, with the exceptions below.
• To limit the use of sensitive personal information and to opt out of sale or sharing. We use your sign-in only to sign you in and keep the Service secure, which the law does not ask us to let you limit, and we sell or share nothing, so there is nothing to limit or stop.
• Not to be treated differently for using any of these rights.

When we may decline to delete

The law lets a business keep information it needs to meet a legal obligation or to protect the security and integrity of its systems. Two of our records fall within those exceptions:

• Filing attestations. The name and title on a sealed filing are part of a record made under state law, which we and our customer may have to produce. We will not remove them.
• The change log. Removing a line from an integrity log defeats it. We will limit its use instead.

When you ask us to delete your account, we close it at once, and de-identify it within the period §9 gives. That removes your name and email from the account itself. Records that are part of a workspace’s history, such as who asked a supplier for a specification, who invited whom, or who attested a filing, keep the name or email as it was written there. If we decline part of a request, we will say which part and why, and do the rest.

If you are in the EEA or the United Kingdom

The Service is run from the United States for United States programs, and your data is held there. If you use it from the EEA or the UK, you also have the rights to restrict processing, to object, and to data portability, and the right to complain to your data protection authority. We rely on two legal bases: performing our contract with you or your employer, and our legitimate interests in keeping the Service secure, keeping regulatory records sound, and improving and developing our services.

12How to use your rights

Email legal@trashclubventures.com from the address on your account, or write to us at the address in §17. Tell us which right you are using.

Timing. We will confirm we received your request within 10 business days. We will respond in full within 45 calendar days. If we need more time, we may extend that once, by up to another 45 days, and we will tell you why within the first 45. There is no fee unless a request is plainly unfounded or excessive.

Checking it is you. We confirm that you control the email address on the account. For a higher-risk request, we may also ask for details that match what we already hold. Someone may act for you with your written permission, which we will confirm with you directly.

If your information is inside a customer’s workspace, we will pass your request to that customer, tell you we have done so, and help them answer it.

13Children

The Service is a business tool and is not meant for children. We do not knowingly collect personal information from anyone under 16, and we sell or share no one’s. If you believe a child has given us information, write to legal@trashclubventures.com and we will delete it.

14Changes to this policy

Each version of this policy and of the Terms of Service carries a date: the “last updated” date at the top of this page. When you agree to them, we record that date with your agreement. The current version is 2026-10-11.

When we change either document, we publish the new version with a new date and a short list of what changed. Each account is asked to agree to the new version on the next signed-in page it opens. Before a material change takes effect, we will tell you by email or in the Service. We review this policy at least once a year.

15Business contact information

Most personal information in the Service is business contact information: a work email, a name, a job title. California’s partial exemption for this kind of information ended on January 1, 2023. We give it the same rights and protection as any other personal information.

16Your data, and ours

The specifications, weights, volumes, citations and filings in a customer’s workspace belong to that customer. A workspace administrator can download the workspace while the account is in good standing and for 30 days after it ends. Uploaded files are not in the download; ask, and we will send them to an administrator.

What we own is the Substrate software, the aggregated and de-identified data we create, and the data about how the Service is used. The Terms of Service §6 say so in full.

17Contact us

For privacy questions, or to use a right: legal@trashclubventures.com. For anything else, see our contact page.

Trash Club Insights
PO Box 1067
Indian Hills, CO 80454