Legal

Privacy Policy

Last updated: 30 July 2026

This Privacy Policy explains how Energy Site collects, uses, and protects personal information when you use energy-site.com.

Data Controller and Operator

Energy Site is operated by Matthew Cartlidge, an individual and sole trader trading as Energy Site. Matthew Cartlidge is the data controller responsible for the personal information processed through energy-site.com.

For privacy questions, data rights requests, or complaints, contact:

Matthew Cartlidge, trading as Energy Site
8 Cromer Road
Stoke-on-Trent
Staffordshire
ST1 6QN
Email: [email protected]
Online: contact form

Information We Collect and Its Source

• Information you provide: display name, email address, password (stored only as a hash), preferences, trial or subscription details, and contact messages.
• Information from Octopus Energy when you connect an account: account and property identifiers, meter points, meter serial numbers, tariff agreements, region, and electricity and gas usage data. We store an encrypted copy of the Octopus API key you provide, but not your Octopus password.
• Information generated when you use the service: verification, password-reset and sign-in status, chart preferences, calculated usage costs and averages, records of service emails, operational and security logs, IP addresses in server logs, and browser or device type.
• High-level visitor statistics. We do not store raw IP addresses in visitor statistics; a daily hash is used to estimate unique visitors.
• Cookie and similar technology data described in our Cookie Policy.

What Information Is Required

An email address and password are required to create and secure an account. Without them, we cannot provide account features. Connecting an Octopus account is optional, but a valid account number and API key are required to import meter and usage data. Display preferences are optional. A name, email address, and message are required if you want us to respond to the contact form.

Purposes and Lawful Bases

• Contract and steps at your request: creating and managing your account; providing dashboards, charts, and preferences; connecting to Octopus on your behalf; storing and analysing usage; managing a trial or subscription; and sending necessary service messages.
• Legitimate interests: securing the service; preventing misuse; keeping operational logs, privacy-light visitor statistics, and backups; diagnosing and fixing problems; improving reliability; and responding to enquiries. Our interests are to run a safe, reliable, and useful service. We limit the data and retention periods and do not use this information for advertising.
• Legal obligation: retaining or disclosing information where required by law, tax or accounting rules, a court order, or a lawful authority.
• Consent: any non-essential cookies or optional communications introduced in future. You can withdraw consent at any time. We do not currently operate a marketing email list.

Octopus Energy

If you connect an Octopus account, your API key is used to make requests to Octopus Energy services on your behalf. Octopus Energy controls its own systems and use of information. You can disconnect an account in Account Options and choose either to retain the stored usage data or permanently delete the connection and its stored meter and usage data.

Who We Share Information With

• Matthew Cartlidge: Energy Site's server, databases, and backups are self-hosted in the United Kingdom, with administrative access limited to Matthew Cartlidge.
• Cloudflare: website DNS, proxy and security services, email routing, and transactional email sending. This may include IP addresses, request metadata, email addresses, and email content.
• Google Gmail: messages to energy-site.com addresses, including support, hello, and privacy, are forwarded to Matthew Cartlidge's personal Gmail mailbox so they can be read and answered.
• Octopus Energy: the API and account details necessary to fulfil requests you authorise.
• Authorities and advisers: where necessary to comply with law, establish or defend legal rights, or protect users and the service.

We do not sell personal information. Live payments are not currently enabled. We will update this policy before sharing payment data with a payment processor.

International Transfers

The main server and backups are in the United Kingdom. Cloudflare and Google operate global networks, so they may process some information outside the United Kingdom. Where required, providers use legal mechanisms such as adequacy regulations, the UK Extension to the Data Privacy Framework, Standard Contractual Clauses, and the UK International Data Transfer Addendum. You can ask for more information or a copy of the applicable safeguards at [email protected].

Retention

• Active accounts: account, preference, Octopus connection, and subscription data is kept while the account is active and as needed to provide the service.
• Account security tokens: emailed password-reset links expire after 30 minutes and become unusable after first use or when a replacement is requested. Only a hash of the token is stored.
• Usage: Premium accounts have unlimited usage storage while Premium is active; "unlimited" means no plan-based age limit, not permanent storage after account closure. When Premium expires or an account moves to Free, there is a 7-day grace period before history is reduced to the latest 100 days. Free accounts are limited to 100 days.
• Inactivity: a standard customer account is disabled after 12 months without a successful sign-in and permanently deleted after 24 months. The account creation date is used if there has never been a sign-in. This automatic rule does not apply to protected Admin or Developer operator accounts.
• Visitor statistics: 90 days. Operational job history: 180 days. Server and security logs: normally up to 30 days.
• Contact messages and replies: up to 12 months after the last substantive exchange, unless needed longer for a legal obligation or claim.
• Database backups: encrypted backups for up to 60 days.

Account Deletion and Rights Requests

A standard customer can delete their own account in Account Options after confirming their password. This immediately deletes the live account, preferences, subscription records, Octopus connection details, meter details, and usage data. You can also make a request through [email protected], the contact form, or the postal address above. We normally respond within one month and may ask for reasonable information to confirm your identity.

Deleted data may remain beyond use in encrypted backups until the backup is removed by the 60-day rotation. Backup data is not used for ordinary operations and may be restored only when needed for disaster recovery; deletion requests must be considered as part of any such recovery.

Your Rights

Subject to the circumstances and applicable law, you have rights to be informed, access your information, correct inaccurate information, erase information, restrict processing, receive portable data, and withdraw consent. Not every right applies in every case. You can use the contact details above to make a request.

Your Right to Object

You have the right to object to processing based on our legitimate interests. Tell us what you object to and why. We will stop processing unless we can show compelling legitimate grounds that override your rights, or the processing is needed for legal claims. The right to object to direct marketing is absolute; we do not currently send direct marketing.

Automated Decisions

We do not make decisions based solely on automated processing that have a legal or similarly significant effect on you. Automated operational rules, such as usage retention, trial expiry, and inactive-account disabling or deletion, implement the service terms and do not profile people.

Security

We use reasonable technical and organisational measures, including password hashing, encryption of Octopus API keys, encrypted backups, access controls, and Cloudflare security services. No online service can be guaranteed to be completely secure.

Contact and Complaints

If you have a concern, please contact us first so we can investigate. This does not affect your right to complain at any time to the Information Commissioner's Office (ICO):

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Telephone: 0303 123 1113
Online: make a complaint to the ICO