What we hold, why we hold it, who else sees it, and how to make us delete it. Written plainly, because half-hourly electricity data is more personal than it looks.
[LIKE THIS].
Orza is operated by [LEGAL ENTITY NAME], of
[REGISTERED ADDRESS]. For anything in this notice, or to
exercise any right described in it, write to
[CONTACT EMAIL].
We are an independent software product. We are not affiliated with, endorsed by or acting for your battery manufacturer or your electricity supplier.
The Orza web app, the mobile apps when they exist, and this website. This site loads no third-party scripts, fonts, images or resources of any kind. Everything it uses is served from the same place as the page, so simply reading it sends your data to nobody.
An email address and a password. Authentication is handled by Supabase; your password is hashed by them and is never visible to us or stored by us. You can also tell us whether to email you when something breaks; that preference is stored against your system.
The join form stores the email address you type, the battery or inverter
system you choose and the time you sent it, in our database in London.
Nothing else is collected with it, and the website itself cannot read the
list back. We use it to email you about getting your system connected.
[STATE HOW LONG A SIGNUP IS KEPT if it never becomes an account, and
how someone asks to be removed.]
A UK postcode, and the latitude and longitude it resolves to. The coordinates are what the solar forecast needs; the postcode is kept so you can see where the figure came from. We also hold what you tell us about the equipment: battery capacity, charge and discharge limits, reserve floor, solar array size, tilt and orientation, your tariff and pricing region, and what you are paid for export.
The credential you authorise: a manufacturer account or an API key. It is encrypted with AES-256-GCM before it is stored. Only the backend can decrypt it; the browser cannot read that table at all, and no credential is ever written to a log or returned to a page. If the encryption key is unavailable the service refuses to store anything rather than falling back to plain text.
Every five minutes, through your manufacturer's cloud: solar generation, grid import and export, household consumption, battery power and state of charge. On first connection we also read back the day-level history your manufacturer holds, so your ledger does not start empty.
If you connect an Octopus Energy account, we read your tariff, your export rate and your metered half-hourly consumption. The tariff and export rate are what stop the plan running on invented prices; the consumption is what lets the saving be scored against your real bill rather than against a model.
Plans, the forecast snapshot each plan was made against, what each half hour actually cost, daily totals, and alerts. If you use a mobile app, a push notification token for your device.
No analytics, no advertising technology, no third-party trackers, no cookies beyond the session that keeps you signed in. We do not sell personal data and we do not share it for anyone else's marketing. We hold no payment details, because there is nothing to pay for.
Reading your system, planning against prices and a forecast, and showing you what that plan was worth. Under UK GDPR this is performance of a contract with you. Without this data there is no product: the saving figure is only defensible because it is scored against your own readings.
Error logs, alerting when a connection fails, and rate-limit and abuse protection. Legitimate interests: ours in running a service that works, yours in being told when it stops.
Service messages, such as a failed connection or a broken plan, are part of the service. Anything else, including news about the beta, is sent only with your consent, and you can withdraw it at any time.
We measure how well the forecast and the planner actually performed,
which necessarily uses real readings. Where this is used to improve the
product beyond your own account, it is [AGGREGATED AND
DE-IDENTIFIED: CONFIRM THE EXACT TREATMENT BEFORE PUBLISHING].
We use a small number of providers, each doing one job:
Supabase: the database and sign-in, hosted in London
(eu-west-2). Railway: runs the backend that does the
reading and planning, currently in Railway's iad region,
which is in the United States (Virginia).
Vercel: serves this website and the web app.
Resend: sends service email, so it processes your
address and the message.
Your battery manufacturer's cloud: we authenticate as you, with the credential you authorised, and read your system. Their own privacy terms govern what they hold. Octopus Energy, if you connect it, for your tariff and consumption. Open-Meteo, for the solar forecast; this receives your coordinates, rounded to the resolution the forecast needs, and nothing that identifies you.
No. We would disclose personal data outside that list only where the law requires it, and we would tell you unless we were prohibited from doing so.
Your data is stored in London, but it does not only stay there. The backend that reads your system and builds your plans runs in the United States, so your readings and the details of your house are transferred there and back in the course of normal operation.
[BEFORE PUBLISHING: either move the backend to a European Railway
region, or name the safeguard relied on for this transfer, such as the UK
International Data Transfer Agreement or Addendum, or the UK Extension
to the EU-US Data Privacy Framework if the provider is certified under
it. Also confirm where Resend and Vercel process, and whether a transfer
risk assessment is needed.]
We would rather tell you this plainly than leave it implied by a provider list.
Energy readings and the ledger built from them are kept for as long as you have an account, because the product's whole claim is a running record of what your battery did and what a better plan would have been worth. A ledger you cannot look back through is not worth having.
Deleting your account deletes the data. See your rights for exactly what that removes.
[SET A RETENTION PERIOD for error logs and email delivery
records, which sit with Railway and Resend rather than in our database,
and state it here.]
Deleting your account removes every system on it, and with it every reading, plan, forecast snapshot, outcome, daily total, alert and stored credential. The database is built so those cannot survive their system. Your sign-in is deleted too. It is not a flag that hides you; the rows are gone, and we cannot recover them afterwards.
Everything your account holds is readable by you in the app, and can
be exported from there. If you would rather we assembled it for you,
ask at [CONTACT EMAIL].
You can ask us to correct anything wrong, to restrict or stop a particular use, or to object to processing we have based on legitimate interests. Where you gave consent, you can withdraw it. We answer within one month.
If we have not put something right, you can complain to the
Information Commissioner's Office at ico.org.uk, or by
telephone on 0303 123 1113. We would rather you told us first, but you
do not have to.
Every table carrying your data is protected by row-level security in the database itself, keyed to your account, rather than by the application remembering to filter. One owner's rows are unreachable from another owner's session even if the application above them is wrong.
Sealed with AES-256-GCM, written only by the backend, never readable by any browser, never logged. The technical detail is in the technical FAQ.
No service can promise it will never be breached. What we can say is what we would do: tell you, tell the ICO within 72 hours where the law requires it, and say plainly what was reached, without waiting until we understood it perfectly.
This page carries the date it last changed. If we change it in a way
that matters, we will email you rather than quietly re-date it.
Last updated: [DATE ON PUBLICATION].
Ask before you sign up, not after. The technical FAQ has the detail behind most of this page.