Privacy Notice

1. Who we are

EM AI Ltd, trading as Energy Modeller (“we”, “us”), acts in two capacities:

• As data controller — for personal data about our installer users (account, billing, usage).
• As data processor — for personal data about installers’ end customers (homeowners / business customers), which the installer collects and controls. We process it on the installer’s documented instructions to run the Service for them.

Registered office: 2 Edensmuir Court, Glenrothes, KY7 6GQ, Scotland (registered in Scotland, company number SC892873). ICO registration number: ZC176891. Contact: privacy@energymodeller.com.

2. What we collect

From installers (as controller): email, company name, website, phone, brand colours, MCS certificate number, billing details (handled by our payment provider; we store only payment IDs and subscription state), service-account audit logs.

From installers’ end customers (as processor on behalf of the installer): name, address, postcode, email, phone, energy bill data, questionnaire responses, chatbot conversations, signature metadata (IP, timestamp, T&Cs hash), smart-meter consumption data (when authorised via our smart-meter data provider), and how you engage with your quote (for example when you open it, revisit it, or reply). This engagement data is used only by your own installer to prioritise their follow-up; it is never shown to other customers or installers. You can ask your installer to stop this at any time.

If you agree to non-essential cookies, we record how you use the proposal your installer sent you — which sections you looked at and for how long, how far you scrolled, what you clicked, and whether you watched any video. Your installer sees this so they can answer the things you actually spent time on. We do not record your name, address, or anything you type, and we delete this information after 30 days. You can decline, or change your mind at any time, and we will stop.

Identity verification (card check)

Before certain steps — for example authorising a pull of your smart-meter data — your installer may ask you to confirm your identity. If you choose the card method, the check is carried out by our payment provider using a £0 authorisation: no payment is taken, and we never receive or store your card number. Your card details are entered directly with the payment provider; we receive only a pass or fail result of a match against your name and billing postcode. The basis is legitimate interests (confirming identity to protect you and the integrity of your quote). It is optional — you can choose another method or decline — and you can object at any time (see ‘Your rights’).

3. Why we process it

• Service delivery — lawful basis: contract. Running the platform you signed up for.
• Billing — lawful basis: contract + legal obligation.
• Service improvement & analytics — lawful basis: legitimate interest, balanced against your privacy.
• Customer support — lawful basis: legitimate interest.
• Marketing emails (only to installers, not end customers) — lawful basis: legitimate interest (B2B) with opt-out in every email.

3a. How recommendations work — and how we keep your data siloed

When we generate a recommendation or quote for an installer, we process that installer’s own identifiable customer records (postcode, usage, quote activity, etc.) to return the result to that installer. We do this as the installer’s processor — on their data, for their eyes only, as part of delivering the Service they signed up for.

We do not pool one installer’s data with another’s. The results you see on your own leads and quotes are always computed from your own account’s data — never from another account’s identifiable customers, quotes or commercial figures. (If in future we introduce any platform-wide model improvement, it would use only aggregated, de-identified data that identifies no individual, and we would update this notice before doing so.)

What we do NOT do: we do not send installer or end-customer personal data to any third-party AI vendor for that vendor to train on. Our AI sub-processors are used on no-training / zero-retention API terms — they process a request to return a result and do not retain it to train their models.

How your recommendation is produced. When you ask for a quote, we use an automated model to work out which solar and battery options suit your home — using your postcode, roof details (direction, angle, space) and energy use (from your meter, your bills, or a typical profile), together with live tariff and pricing data. It ranks the options by the outcome your installer has chosen to optimise, for example lowest upfront cost, longest warranty, or greatest long-term saving. The result is a modelled estimate, not a guarantee, and it is not a decision made by a computer alone: your installer reviews it — and can change or reject it — before it is presented to you, and can explain how it was worked out. Your installer is the controller of your data for this purpose; you can exercise your rights (including access and objection) through them.

4. Who we share data with

We use a small number of trusted third-party providers (“sub-processors”) to run the Service, in the following categories:

• Cloud hosting and database — hosting the application and storing data (UK/EU/US regions; Check My Quotes document uploads are stored in a dedicated UK region).
• Transactional email — sending reminders and notifications.
• Payment and identity verification — installer billing, and the optional homeowner £0 card-identity check (no card number is stored).
• AI providers — the in-product assistant, voice features, and equipment extraction from the documents you upload to Check My Quotes, on no-training / zero-retention terms.
• Product analytics — understanding and improving the product (only with your cookie consent; see section 8).
• Address lookup — UK address autocomplete.
• Energy-data providers — tariff data, and (only with your explicit consent) smart-meter consumption data.
• Installer-connected integrations — design and accounting tools, only where an installer chooses to connect them.

We hold data-processing agreements with the providers that handle personal data, and can provide details of the specific providers in a category on request. A provider tied to an optional feature (for example voice or smart-meter data) or an installer-connected integration is covered by a data-processing agreement before that feature or integration is enabled. Where a provider processes data outside the UK (for example some hosting, payment and AI providers in the US), we rely on an approved safeguard — the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. We do not send installer or end-customer personal data to any third-party AI provider to train their models.

4a. Google API Services (connected Gmail accounts)

Where you (an installer user) connect your Google or Gmail account to send email from your own address, Energy Modeller’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

• What we access: the gmail.send scope, which lets us send email on your behalf from your connected address. We request only the scopes needed for the feature you enable.
• How we use it: solely to send messages you or your team compose or approve within Energy Modeller (for example, issuing a proposal to your customer) from your real address. We do not read your inbox under this scope.
• Storage: we store your Google OAuth tokens encrypted at rest so the connection persists; you can disconnect at any time in Settings, which revokes the token. Records of messages sent through the platform are retained subject to the limits in section 5.
• Sharing and transfer: we do not transfer Google user data to third parties except as necessary to provide this feature, and never to any AI vendor to train models. We do not use it for advertising, and no humans read it except with your explicit permission or as permitted by the policy for security or legal reasons.

5. Retention

We keep personal data only as long as necessary, then delete or irreversibly anonymise it. Key periods:

• Consent-evidence records: 4 years, in write-once (tamper-protected) storage.
• Identity-check result (the pass/fail conclusion and a reference to the evidence record — never your card number): retained as part of the consent-evidence chain above (4 years, write-once storage); the underlying verification record is kept for the life of the related consent.
• Quote / share-link data: 30 days from creation, then auto-deleted.
• Early-stage enquiry (before an installer opens the quote tool): 90 days.
• Lead-engagement signals (used to help your installer prioritise follow-up): 90 days; a decision snapshot is kept for 2 years.
• Signed-contract artifacts (signature metadata, terms hash, figures hash): 7 years.
• Account records: for the life of the account, then up to 6 years after closure for tax / accounting.
• Service-plan customer records: for the lifetime of the service plan, then 6 years after cancellation for tax / accounting.
• Security / audit logs: 5 years (UK GDPR Art. 30 accountability). Server / operational logs: 90 days rolling.
• Record that we handled a data-rights request: 1 year.

6. Your rights

Under UK GDPR you have the right to:

• Access your data
• Rectify inaccurate data
• Erase your data (subject to retention legal requirements)
• Restrict or object to processing
• Data portability (export)
• Complain to the Information Commissioner’s Office (ico.org.uk)

To exercise any of these, email privacy@energymodeller.com. We respond within one month (UK GDPR Art. 12(3)), and will tell you promptly if a request needs identity verification or an extension for complexity.

Installers can self-serve a machine-readable export of their account data at any time from their account settings. End customers (homeowners): because the installer is the controller of your data, send access or erasure requests to your installer; we action them on the installer’s instruction as their processor, or directly if you contact us and we route it to them.

7. International transfers

Some sub-processors — including cloud-hosting, AI and payment providers — process data in the US. We rely on Standard Contractual Clauses + the UK Addendum and, where applicable, the EU-US Data Privacy Framework.

8. Cookies

We use a single httpOnly session cookie (__Host-em_session) for authentication, which is strictly necessary and needs no consent. We also use a third-party product-analytics provider (hosted in the EU region) for product analytics and session replay to understand how the product is used and improve it. It is off by default and only starts after you accept non-essential cookies via the banner; it is disabled for our own staff sessions, does not auto-capture every click, and masks form inputs. Session replay is switched off entirely on customer- facing pages (proposal, intake, formal-quote). You can decline at any time and we respect Do-Not-Track.

9. Changes

Material changes to this Notice will be emailed at least 30 days before they take effect.