Privacy Policy

SOLR AI Limited ("Enerwise", "we", "us") is the data controller for personal data processed via Enerwise Commercial.

• Data Controller: SOLR AI Limited
• Email: info@solr.ai
• ICO registration: available on request

We collect directly from you:

• Account data (name, work email, organisation, role)
• Property data (address, EPC, building footprint, energy consumption)
• Smart meter data, only with explicit user consent (N3rgy)
• Technical data (IP, user agent, request logs) for security and abuse prevention
• Auth events (login, MFA setup, password resets) for fraud detection

Some personal data we process is not obtained from you. To identify and qualify commercial sites for our lead-generation service, we obtain limited personal data about business occupiers, their owners and contacts from the publicly accessible sources below. This is the source disclosure required by UK GDPR Article 14.

Where the occupier or owner is a company these records are not personal data; they are personal data only where they identify an individual (for example a sole trader, or a named company director or officer). We rely on our legitimate interests in identifying and qualifying commercial solar opportunities for this processing, and you have the right to object (see section 7).

• Contract — to deliver assessments and partner services you sign up for
• Legitimate interests — security monitoring, fraud prevention, service improvement, and identifying and qualifying commercial solar sites for our lead-generation service (see section 2)
• Consent — marketing emails, smart meter consumption data, optional cookies
• Legal obligation — record-keeping (e.g. MCS, Companies House)

We use a limited set of vetted subprocessors to operate the service. The full list is maintained at /subprocessors. Each is bound by a Data Processing Agreement compliant with UK GDPR Article 28.

We never sell personal data, and we do not share it with advertising networks or data brokers. Where you hold an account with us, we share your assessment and property data with a partner organisation only where you have chosen to engage that partner.

Separately, the lead-generation data described in section 2 — including business contact details — is disclosed to our delivery partner, HDM Energies Ltd, so that HDM can approach those sites about commercial solar power-purchase agreements. HDM receives this data as an independent data controller, not as our processor: it determines and is responsible for its own outreach, including its own compliance with the Privacy and Electronic Communications Regulations (PECR). This is a controller-to-controller disclosure made under a separate agreement (see /subprocessors). The businesses concerned will not necessarily have engaged with us or with HDM beforehand; they may object to or request erasure of this processing at any time (see section 7).

Primary storage is in the UK / EEA (Supabase eu-west-1, GCP europe-west2). Some subprocessors (e.g. Vercel, Cloudflare, Sentry EU) operate global networks; transfers outside the UK rely on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses (SCCs).

• Account data — for the life of the account, plus 12 months after deletion
• Lead-generation contact data (section 2) — deleted or anonymised automatically within 24 months of collection, or within 24 months of delivery to a partner where that is later; removed sooner on a valid objection or erasure request
• Assessment outputs — 7 years (commercial record-keeping)
• MCS / installation documents — 10 years (regulatory)
• Server logs — 30 days
• Sentry error events — 90 days
• Marketing consent records — 6 years after withdrawal

Under UK GDPR you may:

• Access a copy of your data
• Correct inaccurate data
• Request erasure (right to be forgotten) — account holders via /dashboard/settings/account/delete; anyone else, including a business whose details reached us through the sources in section 2, by emailing info@solr.ai
• Restrict or object to processing — in particular, you may object at any time to our use of lead-generation contact data (section 2, relied on under legitimate interests) by emailing info@solr.ai; we will then stop that processing and remove the data from our lead pipeline
• Data portability
• Withdraw consent at any time
• Lodge a complaint with the ICO (ico.org.uk)

To exercise any right, email info@solr.ai.

We use Cloudflare Enterprise (WAF, DDoS, bot management), TLS 1.2+, HSTS, Turnstile, GCP Secret Manager, Supabase Row-Level Security, TOTP MFA, Sentry with PII scrubbing, encrypted backups, and least-privilege access. Incidents are reported to the ICO within 72 hours where required.

See our Cookie Policy for details. We use only strictly-necessary cookies by default; analytics and marketing cookies are off until you opt in.

We will post any material changes to this policy here and notify account holders at least 14 days before changes take effect.

SOLR AI Limited — info@solr.ai

If you are unhappy with how we have handled your personal data, you can complain to us directly by emailing info@solr.ai. We will acknowledge your complaint within 30 days and respond without undue delay.

If you remain dissatisfied, you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.