Privacy Policy

This policy explains what EnergyWiz collects, why, who it goes to, and what you can do about it. EnergyWiz is operated by Axolotl Advisors LLC.

1. What we collect

Information you give us

• Account identity. Your email address. If you sign in with a password, the password itself is handled by our authentication provider (Supabase) and is never visible to us. If you sign in with Google, we receive your email address and basic profile identifiers from Google, not your Google password.
• Utility account details. Customer name, utility account number, meter number, service address, billing address, rate class, and tax jurisdiction. Most of this is read automatically out of the bills you provide.
• Documents. Your utility bills, and any other documents about your energy service that you upload or send us — for example a supplier’s or community solar provider’s bill, an invoice, or a contract — stored as you gave them to us.
• Usage data. Interval electricity data — typically one reading every 15 minutes — and gas usage data, from Green Button files or your utility’s data export.
• Utility login credentials, only if you choose to save them for automated data retrieval. See Section 4.
• Supply contract details for third-party energy suppliers — the supplier, start and end dates, prices, fees, and what happens when the contract ends — whether you enter them, we work them out from the prices on your bills, or our staff copy them from a contract or letter you send us. Also any comparison offers you ask us to compare, and any budget targets you set.
• Energy charges paid outside your utility billthat you choose to enter for an account — for example what you pay a community solar provider that bills you separately — and the amounts you paid.
• Whether you take part in an energy assistance program (such as Con Edison’s Energy Affordability Program or HEAP), if we ask and you choose to tell us. Some suppliers aren’t allowed to serve customers in those programs, so we use your answer only to decide which supply offers to show you.
• Profile and contact details, all optional: your name and preferred name, company and job title, additional email addresses and phone numbers (and whether we may text them), mailing address, time zone, and preferred way to be contacted. Your birthday (month and day; the year is optional), which we use to send you a birthday greeting. Whether you want marketing email from us, which is off unless you turn it on.
• Emails you send us. When you write to any @energywiz.net address, we store the message — sender, recipients, subject, body, attachments, and the email’s technical headers — together with our replies, so we can answer you and keep the conversation in one place. You don’t need an EnergyWiz login for this to apply. We send an automatic acknowledgement to most messages, and we may in future use automated tools, including AI, to help draft our replies.
• Messages you write to us in the app. What you write on the Messages page or in a “tell us” box, any files you attach (for example a contract from your energy supplier), our replies, and, where the box was about something specific, a few facts the page already knew (for example which rate plan or which bill period it was about). These sit in the same conversation as any email between us. We also keep how you want to be emailed about new messages (each message, a daily summary, or not at all), which you can change on your account page at any time.

Information we generate or collect automatically

• Calculated results — modeled bills, comparisons, projections, and insights derived from the above.
• Audit records. We log permission changes on shared accounts, downloads of bill PDFs and usage files, edits to account information, and consent changes. These records include your user identifier, your IP address, and your browser’s user-agent string. They exist so an account owner can see who touched their data, and so we can investigate a security incident.
• Supply-offer activity. When we show you energy supply offers (from New York State’s Power to Choose website), we record which offers you look at, open or click through to, with the offer’s price and our estimate of what it would have cost you at the time. We use this to improve our recommendations, and may use it to support referral arrangements with suppliers in future. It never changes the order we show offers in, and we don’t send it to the supplier.
• Relationship records. Our staff keep a record of our dealings with you: notes, records of phone calls, meetings and other communication outside the app, how you came to us, and when to follow up. We also note when you last used the app. Someone may also be entered here before they have an account, for example after emailing us. These records are included in your data export.
• Weather data for your service location’s area, retrieved from public government sources, used to weather-normalize your usage. We send a location to those services; we do not send them anything identifying you.
• Error diagnostics. When something breaks we capture the error to our monitoring provider (Sentry), with personal data scrubbed before it is sent.

A note on how sensitive interval data is

We want to be direct about this rather than bury it. Fifteen-minute electricity readings are revealing. Over time they can indicate when a home is occupied or empty, roughly when people wake and sleep, when large appliances run, and when a household is away. We treat this as the most sensitive category of data in the system, and we protect it accordingly (Section 5). It is also why we do not share it.

2. Why we use it

What we do not do

• We do not sell your personal information.
• We do not share your personal information with third parties for their own marketing, and we do not serve advertising.
• We do not use your identifiable data for anything beyond operating and improving EnergyWiz for you — and we do not use your identifiable bills to improve our rate models without the separate opt-in below.

De-identified and aggregated data is treated differently, and we would rather say so here than leave you to find it in the Terms. See “De-identified and aggregated data” below.

Model improvement, specifically — and how to turn it off

One use needs spelling out, because it is on unless you turn it off. We use your bills and usage data to check and improve our rate models — comparing what we calculated against what you were actually billed is how we find modeling errors, and it is the main reason the calculations are as accurate as they are. This includes complete, unredacted bill documents, which carry your name, service address, and utility account number, and it includes automated analysis by an AI agent.

This is on by default.

To opt out:

• Open the account settings for a utility account (the ✎ beside the account name, or the Add data panel) and clear “Help improve rate models”. It takes effect immediately.
• The setting is per utility account, so if you have several you will need to clear it on each. A single control covering every account you own is planned.
• Opting out stops future use. It does not retroactively unwind modeling work already done, and it does not reach de-identified or aggregated data already derived (see above) — once that no longer relates to you, we cannot find it to remove it.

Every change in either direction is recorded in an immutable log with a timestamp, the wording in force at the time, and the IP address it came from — so there is always a record of what you chose and when, including a decision to opt out.

De-identified and aggregated data

Separately from all of the above, we create de-identified and aggregated data from your bills and usage, and we use it for analytics, benchmarking, research, improving our rate models and other products, and publishing statistics about energy usage and rate plans. We may share or publish it. This does not depend on the opt-in above, and it is not limited to improving EnergyWiz.

What that does and doesn't mean:

• It must not identify, or be reasonably capable of being associated with, you, your household, or your accounts.
• We will not attempt to re-identify it, we will keep it in de-identified form, and we require the same by contract of anyone we share it with.
• Anything published or shared is aggregated across enough accounts that no individual’s usage can be picked out.
• It is not your personal information once de-identified, so it is not covered by the access, correction and deletion rights in Section 7 — and deleting your account does not remove it, because by then nothing connects it to you.

We want to be honest about the limits of the word “de-identified.” Detailed interval usage is hard to anonymize well: a household’s consumption pattern is close to a fingerprint, and stripping a name off a file is not enough on its own. That is why our commitments above are about aggregation thresholds and a binding promise not to re-identify, rather than about the label.

3. Who we share it with

We share data with service providers who run parts of the infrastructure, and only as needed for them to do so:

We also transmit your utility credentials to your utility’s own website when retrieving your data at your direction — that is the point of saving them.

Otherwise, we share personal information only: with other users you have explicitly granted access to an account; when you ask us to; when required by law or valid legal process; or in connection with a merger, acquisition, or sale of assets, in which case we will give you notice before your data becomes subject to a different policy.

All of our providers are located in the United States.

4. Utility credentials

Saving your utility login is optional; EnergyWiz works fully if you upload bills and usage files yourself.

If you do save them:

• They are encrypted before storage, using a per-account key that is itself protected by a master key held separately from the database. A copy of the database alone does not yield your password.
• They are decrypted only in memory, only at the moment of signing in to your utility on your behalf.
• They are never written to logs or error reports, and are never sent to your browser after you save them.
• The session your utility issues after login is also stored encrypted, so we do not need to re-use your password on every retrieval.
• You can delete them at any time from account settings. Deletion removes them from our systems.
• Each use is recorded in the account’s audit log.
• Saving credentials is not permission to change your utility service. We use them to read your data. If we ever offer to submit a rate-plan change for you, that will take a separate, explicit yes to that specific action — see the Terms of Service, Section 3.

5. How we protect data

• Encrypted in transit (HTTPS) everywhere.
• Encrypted at rest. Documents and usage files live in private storage that issues no public links; access goes through short-lived signed URLs after we have checked your permission.
• Access control enforced in two independent layers — the application checks your permission on every request, and the database enforces row-level security underneath it, so a bug in one is caught by the other.
• Downloads of documents and usage files are recorded and visible to the account owner.
• Utility credentials get the additional protections in Section 4.

No system is perfectly secure, and we cannot guarantee absolute security. If we become aware of a breach affecting your personal information, we will notify you as required by applicable law, including New York’s SHIELD Act.

6. How long we keep it

• Your account data — for as long as your account exists. When you delete a utility account it is held recoverable for 30 days, then permanently deleted along with its stored documents and usage files.
• Your login — deleted on request, as described in Section 7.
• Your contact record (profile, contact details and relationship records) — kept until you ask us to delete it, including after you delete your account, so that our history with you isn't lost if you come back or write to us again. Write to privacy@energywiz.net and we will delete it, together with our email correspondence with you.
• Audit records — five years, then deleted. The IP address and browser details in them are removed after one year.
• Supply-offer activity — five years, then deleted.
• Messages and emails you send us, and our replies — kept until you ask us to delete them (write to privacy@energywiz.net). They are included in your data export.
• Consent records — retained as long as we operate the service. These are deliberately immutable: a record of what you authorized is only worth anything if it cannot be quietly rewritten, including by us. They contain no billing or usage data.
• Backups — deletions propagate to live systems immediately, but data may persist in encrypted backups for up to 30 days before those age out.

7. Your choices and rights

You can, at any time and from within the application:

• See and correct the account information and profile details we hold.
• Turn marketing email on or off.
• Export a copy of your data in a machine-readable format.
• Delete a utility account and its data, or your login. To delete your contact record and our correspondence as well, email privacy@energywiz.net.
• Withdraw the model-improvement consent, per account.
• Remove saved utility credentials without deleting anything else.
• Revoke access you granted to another person.

If you are a resident of California, Colorado, Connecticut, Virginia, or another state with a comprehensive privacy law, you have rights to know, access, correct, delete, and to not be discriminated against for exercising them. We honor these requests for everyone regardless of where you live, because it would be strange not to. We do not sell personal information or share it for cross-context behavioral advertising, so there is nothing to opt out of on that front.

To make a request that you cannot complete in the app, email privacy@energywiz.net. We will respond within 45 days. We may need to verify your identity, which normally means confirming control of your account email.

8. Children

EnergyWiz is not intended for anyone under 18, and we do not knowingly collect information from children. If you believe a child has provided us information, contact us and we will delete it.

9. Changes to this policy

We will update the version and effective date above when this policy changes, and ask you to review it in the application when the change is material. Prior consent records keep the version of the wording that was in force when you agreed to it.

10. Contact

Axolotl Advisors LLC — privacy@energywiz.net