What we hold, why we hold it, who else sees it, and how to make us delete it. Written plainly, because half-hourly electricity data is more personal than it looks.
Orza is operated by Louis Cross, trading as Orza, in the United Kingdom. For anything in this notice, or to exercise any right described in it, write to hello@orza.co.uk.
We are an independent software product. We are not affiliated with, endorsed by or acting for your battery manufacturer or your electricity supplier.
The Orza web app, the mobile apps when they exist, and this website. Apart from Cloudflare's check on the sign-up form, described under "Who else sees it", this site loads no third-party scripts, fonts, images or resources of any kind. Everything else it uses is served from the same place as the page, so simply reading it sends your data to nobody.
We count visits to orza.co.uk, so we can see which pages are read and where visitors came from. No cookie is set and nothing is stored on your device. Each visit records the page, the page that linked you here, the time, the kind of device, its operating system and browser, and the country, region and city your connection appears to be in. It does not record your IP address or anything that names you, and it is not joined to your account if you have one.
Vercel, which serves this website, does the counting. To tell one visitor from another it makes a code from the request and discards it within 24 hours, so a visit on one day cannot be linked to a visit on another. We also count how many people reach each step of the sign-up page (the form sent, the emailed code, the account open), as numbers and nothing more. A link we post may carry a label saying which post it is (orza.co.uk/join?src=...). The label is counted with the visit and passed on to the sign-up page, so we can count how many people from each post, or each site that linked here, reach each step. It is not stored on your device or joined to your account.
In the app at app.orza.co.uk we count visits to two places only, the demo home and the sign-in page, in the same way. The address of any other page, including your own home's, never leaves your browser.
An email address and a password. Authentication is handled by Supabase; your password is hashed by them and is never visible to us or stored by us. You can also choose whether we email you if something is seriously wrong with your battery, and whether you want Orza's advice by email; those choices are stored against your system.
You can create your account or sign in with your Google account instead of a password. If you do, Google shares with us only what its basic sign-in shares: your name, your email address, your profile picture and an identifier for your Google account. We ask for nothing more: no access to your Gmail, contacts, calendar, files or anything else in your Google account, and we never see your Google password.
We use that information only to create your Orza account, sign you in and know it is you. Your email address is then used as any account's is, for service messages. It is stored with your account by Supabase, which handles sign-in, is never sold, is never shared for advertising or anyone else's purposes, and is deleted with your account. Orza's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can also remove Orza's access at any time from your Google account's security settings.
You can also create your account or sign in with one of these instead of a password. Each shares with us only what its basic sign-in shares. Facebook: your name, email address, profile picture and an identifier for your account. X: your name, username, email address, profile picture and an identifier for your account. Apple: your email address, or the private address Apple makes if you choose to hide yours, and an identifier for your account. We never see your password for any of them, we can't post anything for you, and we don't read your posts, messages, friends or followers.
We use that information as we use Google's, above: only to create your Orza account, sign you in and know it is you, and your email address for service messages. It is stored with your account by Supabase, is never sold, is never shared for advertising or anyone else's purposes, and is deleted with your account. You can remove Orza's access at any time from your settings on Facebook, X or Apple.
The join form stores the email address you type and the time you sent it, in our database in London. Nothing else is collected with it, and the website itself cannot read the list back. We use it to email you about getting your system connected. A sign-up is deleted 12 months after you made it. To be removed sooner, write to hello@orza.co.uk.
A UK postcode, and the latitude and longitude it resolves to. The coordinates are what the solar forecast needs; the postcode is kept so you can see where the figure came from. We also hold what you tell us about the equipment: battery capacity, charge and discharge limits, reserve floor, solar array size, tilt and orientation, your tariff and pricing region, and what you are paid for export.
The credential you authorise: a manufacturer account or an API key. It is encrypted with AES-256-GCM before it is stored. Only the backend can decrypt it; the browser cannot read that table at all, and no credential is ever written to a log or returned to a page. If the encryption key is unavailable the service refuses to store anything rather than falling back to plain text.
Every five minutes, through your manufacturer's cloud: solar generation, grid import and export, household consumption, battery power and state of charge. On first connection we also read back the day-level history your manufacturer holds, so your ledger does not start empty.
If you connect an Octopus Energy account, we read your tariff, your export rate and your metered half-hourly consumption. The tariff and export rate are what stop the plan running on invented prices; the consumption is what lets the saving be scored against your real bill rather than against a model.
Bright is a free app from Hildebrand that reads a smart meter for any supplier. If you sign in to it during setup, we send your Bright email and password to Bright once, read your last 90 days of half-hourly electricity readings, and keep the readings. We do not store your Bright email or password.
What you write in the app's chat, the page you sent it from and when, and our replies, so we can answer you and see what you were looking at. Every message is read and answered by a person.
Plans, the forecast snapshot each plan was made against, what each half hour actually cost, daily totals, and alerts. If you use a mobile app, a push notification token for your device. If you let Orza send instructions to your battery, a record of when you agreed to the terms for that and to which version.
This website sets no cookies. The app sets only what it needs to work, so it asks for no consent and shows no cookie banner:
Sign-in: when you sign in to app.orza.co.uk, Supabase
sets a cookie named sb- followed by our project's code
and -auth-token (sometimes split across two or three
cookies ending .0, .1). It is what keeps
you signed in. It lasts up to 400 days, renewed as you use the app,
and signing out removes it.
Your theme: a cookie named theme, set
only if you choose light or dark mode yourself, so each page opens
in the theme you picked. It holds that one word, lasts a year, and
choosing "System" removes it.
The check on the forms: Cloudflare's Turnstile runs
in its own frame on the sign-up, sign-in and password reset forms,
and may keep data in that frame to tell a person from a script. It
is used for nothing else (see "Who else sees it").
The mobile app keeps your sign-in, and its push notification token if you turn notifications on, in your phone's secure storage. Signing out removes the sign-in.
No advertising technology, no third-party trackers, and no cookies beyond the two above, which keep you signed in and remember your theme. Visits to this website are counted without cookies, as described above, and nothing follows you to any other site. The only outside check on you is Cloudflare's, on the forms, described under "Who else sees it". We do not sell personal data and we do not share it for anyone else's marketing. We hold no payment details, because there is nothing to pay for.
Reading your system, planning against prices and a forecast, and showing you what that plan was worth. Under UK GDPR this is performance of a contract with you. Without this data there is no product: the saving figure is only defensible because it is scored against your own readings.
Error logs, alerting when a connection fails, and rate-limit and abuse protection. Legitimate interests: ours in running a service that works, yours in being told when it stops.
Orza's staff can see your account, your system's readings, plans and savings, and the errors logged against it, exactly as you see them in the app, but cannot change anything. We use this to answer you when you ask for help, to find problems before you notice them, and to check that each make of battery works as it should. Staff are emailed your address when your account opens, when you connect a battery, and if there is no battery on it a day later, so that someone can help. Legitimate interests: ours in running a service that works, yours in getting help quickly. Your battery's login is never visible to anyone, including staff.
We email you about your battery only when something is seriously wrong: it reports a fault, or we have had no reading from it for a long time. That is part of the service, and you can turn it off in Settings. So are the sign-in codes you ask for and the replies to messages you send us. Anything else, including Orza's advice and news about Orza, is sent only with your consent, and you can withdraw it at any time.
We measure how well the forecast and the planner actually performed, which necessarily uses real readings. Where this is used to improve the product beyond your own account, it is used without your name, your email address or your home address attached, and it is never sold or shared.
Counting visits to orza.co.uk, and to the app's demo home and sign-in page, as described under "What we hold". Legitimate interests: ours in knowing whether people find the site and which pages they read. It uses no cookie and identifies nobody.
We use a small number of providers, each doing one job:
Supabase: the database and sign-in, hosted in London (eu-west-2). Railway: runs the backend that does the reading and planning, in Railway's Amsterdam region, in the Netherlands. Vercel: serves this website and the web app, and counts visits to this website; the app's server runs in London. Resend: sends service email, so it processes your address and the message. Cloudflare: runs the check (Turnstile) on the sign-up, sign-in and password reset forms that stops scripts creating accounts or guessing passwords. To tell a person from a script it looks at technical details of your browser and connection while you use those forms. Expo: delivers notifications to the mobile app, through Apple and Google, if you turn them on. It receives your device's push token and the notification's text, and says it keeps the text only as long as it takes to deliver it.
Your battery manufacturer's cloud: we authenticate as you, with the credential you authorised, and read your system. Their own privacy terms govern what they hold. Octopus Energy, if you connect it, for your tariff and consumption. Google, if you choose to sign in with it, which tells us your name, email address and profile picture (see "If you sign in with Google"). Facebook, X and Apple, if you choose to sign in with one of them (see "If you sign in with Facebook, X or Apple"). Open-Meteo and forecast.solar, for the weather and the solar forecast; these receive your coordinates, rounded to about a kilometre, with the tilt, direction and size of your panels, and nothing that identifies you.
postcodes.io and Octopus Energy's public region lookup are sent your postcode, to find where the house is and which region's prices apply. OpenStreetMap is sent the house's street address, once, when a connection reports one, to place it on the map. None of them is told who you are.
No. We would disclose personal data outside that list only where the law requires it, and we would tell you unless we were prohibited from doing so.
Your data is stored in London. The backend that reads your system and builds your plans runs in Amsterdam, in the Netherlands, so your readings and the details of your house pass between the UK and the EU in normal operation. UK law treats the EU as protecting personal data adequately, so no further safeguard is needed for that.
The app's server runs in London and our email is sent from Ireland, but Vercel and Resend are United States companies, and so is Expo, which delivers the mobile app's notifications. All three say they are certified under the UK Extension to the EU-US Data Privacy Framework, and Vercel's and Resend's data processing terms also carry the UK Addendum to the standard contractual clauses. Those are the safeguards that cover any access from the United States.
We would rather tell you this plainly than leave it implied by a provider list.
The ledger built from your readings (each half hour's cost and each day's totals) is kept for as long as you have an account, because the product's whole claim is a running record of what your battery did and what a better plan would have been worth. A ledger you cannot look back through is not worth having. The five-minute readings underneath it are kept for 13 months, then deleted.
Deleting your account deletes the data from the live database at once. See your rights for exactly what that removes, and for how long a backup holds a copy.
We back the database up once a week, to a computer of our own, so the service can be restored after a failure, and we test changes on private copies of those backups. Each backup is deleted after 60 days.
The error log we keep for each system (a failed reading, a command that did not send) and for each account (a save that did not go through, a page that did not load) is deleted after 90 days. Our server's own logs sit with Railway, which keeps them for 7 days, and email delivery records sit with Resend, which keeps them for 30 days. We keep no copy of either.
The counts of visits to this website and the app's demo sit with Vercel, which keeps them for 12 months and may keep them longer. They hold nothing that identifies you, so there is nothing of yours in them to find or delete.
Deleting your account removes every system on it, and with it every reading, plan, forecast snapshot, outcome, daily total, alert and stored credential. The database is built so those cannot survive their system. Your sign-in is deleted too. It is not a flag that hides you; the rows are gone from the live database at once. A backup made before you deleted your account still holds a copy until that backup is deleted, 60 days after it was made. If we ever have to restore the database from one, accounts deleted since it was made are deleted again before the service is back.
Everything your account holds is readable by you in the app, and can be exported from there. If you would rather we assembled it for you, ask at hello@orza.co.uk.
You can ask us to correct anything wrong, to restrict or stop a particular use, or to object to processing we have based on legitimate interests. Where you gave consent, you can withdraw it. We answer within one month.
Orza's planner works out, by itself, what your battery should do each half hour. It only sends that to your battery if you switch on Automatic control, and you can switch it off at any time. It makes no decision about you that has a legal effect on you or affects you in a similarly significant way, such as whether you get a service or what you pay for it.
If we have not put something right, you can complain to the
Information Commissioner's Office at ico.org.uk, or by
telephone on 0303 123 1113. We would rather you told us first, but you
do not have to.
Every table carrying your data is protected by row-level security in the database itself, keyed to your account, rather than by the application remembering to filter. One owner's rows are unreachable from another owner's session even if the application above them is wrong.
Sealed with AES-256-GCM, written only by the backend, never readable by any browser, never logged. The technical detail is in the technical FAQ.
No service can promise it will never be breached. What we can say is what we would do: tell you, tell the ICO within 72 hours where the law requires it, and say plainly what was reached, without waiting until we understood it perfectly.
This page carries the date it last changed. If we change it in a way that matters, we will email you rather than quietly re-date it. Last updated: 3 November 2026.
Ask before you sign up, not after. The technical FAQ has the detail behind most of this page.