Legal
Privacy Policy
Version 1.0 · Effective date: 8 June 2026
1. Who we are
Energy Mind ("we", "us", "our") is an energy analytics platform developed and operated in the United Kingdom in association with Aston University, Birmingham.
Data Controller: Energy Mind
Contact: [email protected]
Address: Birmingham, West Midlands, United Kingdom
This policy explains how we collect, use, store, and share personal data when you use the Energy Mind platform, in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018).
2. Personal data we collect
| Category | Data items | Source |
|---|---|---|
| Account identifiers | Username, email address, hashed password | You, at registration |
| Organisation data | Organisation name, industry sector | You, at registration or in settings |
| Energy consumption data | Half-hourly meter readings (CSV/Excel), utility bill figures, working schedules, production volumes, site names used as report titles | You, during platform use |
| Bill documents | PDF utility invoices you upload for AI-assisted data extraction | You, optionally |
| Technical and session data | Session cookie (to keep you signed in), security cookie (to protect your account), and server-side access logs | Automatically, when you use the platform |
| Consent records | Date and version of Privacy Policy accepted at registration | Recorded automatically at sign-up |
3. How and why we use your data
| Purpose | Lawful basis (UK GDPR Art. 6) |
|---|---|
| Providing the energy analytics service (uploading data, generating reports) | Art. 6(1)(b): performance of a contract |
| Account management (registration, login, password reset, email verification) | Art. 6(1)(b): performance of a contract |
| Communicating service-related emails (verification codes, password resets) | Art. 6(1)(b): performance of a contract |
| AI-assisted extraction of billing data from uploaded PDF invoices, and an optional AI-written plain-English narrative summary within a report. The core analysis, charts, and calculations are produced entirely by Energy Mind's own analytical engine and do not involve AI. | Art. 6(1)(b): performance of a contract; only used when you explicitly trigger these features |
| Platform security, fraud prevention, and abuse detection | Art. 6(1)(f): legitimate interests |
| Compliance with legal obligations (e.g. tax, audit) | Art. 6(1)(c): legal obligation |
| Recording your consent at registration | Art. 6(1)(c): legal obligation (accountability) |
4. Data processors and third-party sharing
We do not sell, rent, or trade your personal data. We share data only with the following processors under data processing agreements (DPAs) or equivalent protections:
| Processor | Purpose | Data transferred | Location |
|---|---|---|---|
| Google Cloud Platform (GCP) | Hosting (Cloud Run), database (Cloud SQL), file storage (Cloud Storage) | All platform data | EU/EEA (adequacy decision applies) |
| OpenAI, L.L.C. | AI-assisted extraction of billing data from uploaded PDF invoices. Optionally, AI is used to write a plain-English narrative summary section within a report. The core analysis, charts, and calculations are produced entirely by Energy Mind's own analytical engine and do not involve AI. Only used when you explicitly trigger these features. | Bill PDF text and page images; aggregated energy metrics (kWh, costs, CO₂, site name from report title, industry, phantom load %) | USA (UK/US adequacy framework applies) |
| Microsoft (Microsoft 365 / Exchange) | Sending transactional emails (verification codes, password resets) | Email address, username, reset links | EU/EEA |
OpenAI note: When you use the AI bill extraction or AI narrative summary features, content from your uploaded documents and aggregated report metrics are sent to OpenAI's API. The full energy report, including all analysis, charts, and calculations, is generated by Energy Mind's own analytical engine without AI involvement. OpenAI processes data under its Data Processing Addendum. OpenAI states it does not train its models on data submitted via the API by default. You may choose not to use these AI features; all core analytics remain available without them.
6. Data retention
| Data category | Retention period | Reason |
|---|---|---|
| Account data (username, email, profile) | Until you delete your account, or 3 years of inactivity | Service provision |
| Reports and energy data | Until you delete the report or your account | User-controlled |
| Uploaded files (CSV, Excel, PDF) | Deleted when the associated report or account is deleted | Minimal retention |
| Email verification and reset tokens | 15 minutes (verification) or 24 hours (reset), then auto-deleted | Security |
| Server access logs | Up to 90 days | Security and abuse prevention |
7. Your rights under UK GDPR
Under the UK GDPR and DPA 2018, you have the following rights:
- ✓Right of access (Art. 15): Request a copy of all personal data we hold about you. You can download this directly from Settings, under Privacy and Data.
- ✓Right to rectification (Art. 16): Correct inaccurate or incomplete data via Settings.
- ✓Right to erasure ("right to be forgotten", Art. 17): Delete your account and all associated data via Settings. This permanently removes your data from our systems.
- ✓Right to data portability (Art. 20): Export your data in machine-readable JSON format from Settings, under Privacy and Data.
- ✓Right to restrict processing (Art. 18): Request that we limit how we process your data in certain circumstances.
- ✓Right to object (Art. 21): Object to processing based on legitimate interests.
- ✓Right not to be subject to automated decision-making (Art. 22): We do not make solely automated decisions with significant effects on you.
- ✓Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time by contacting us, without affecting the lawfulness of prior processing.
To exercise any right, or to submit a Subject Access Request (SAR), email us at [email protected]. We will respond within one calendar month as required by UK GDPR Article 12.
8. Data security
We implement the following security measures:
- All passwords are stored using a strong one-way hashing algorithm and are never stored in plaintext.
- Data in transit is encrypted using TLS (HTTPS).
- Database access is restricted to authorised systems within our GCP environment.
- Session and security cookies are transmitted only over secure connections.
- Security protections are applied to all account-related requests.
- Access to administrative functions is restricted to designated staff accounts.
Despite these measures, no internet transmission is 100% secure. In the unlikely event of a data breach affecting your rights and freedoms, we will notify the ICO within 72 hours and inform affected individuals without undue delay, as required by UK GDPR Articles 33 and 34.
9. International data transfers
Your data is primarily stored within the EU/EEA on Google Cloud infrastructure. When you use AI features, data may be transferred to OpenAI in the United States. Such transfers are protected by the UK/US Data Bridge adequacy decision or, where applicable, the UK International Data Transfer Agreement (IDTA).
10. Children's data
Energy Mind is a B2B platform intended for use by organisations and business professionals. We do not knowingly collect personal data from anyone under the age of 18. If you believe a minor has provided us with personal data, please contact us immediately.
11. Changes to this policy
We may update this Privacy Policy from time to time. When we do, we will update the version number and effective date at the top. If we make material changes, we will notify registered users by email. Continued use of the platform after the effective date constitutes acceptance of the updated policy.
12. How to complain
If you have concerns about how we handle your personal data, please contact us first at [email protected] so we can try to resolve the matter. You also have the right to lodge a complaint with the UK supervisory authority:
Information Commissioner's Office (ICO)
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Tel: 0303 123 1113
Web: ico.org.uk
13. Contact us
For any data protection queries, Subject Access Requests, or to exercise your rights:
Energy Mind, Data Controller
Email: [email protected]
Birmingham, West Midlands, United Kingdom