Privacy Policy
Last updated 4 July 2026
This policy explains how [CubeEnergies Ltd](“CubeEnergies”, “we”, “us”) collects and uses your personal data when you use the IMES Benefit Evaluator and related services (the “Service”). We are the data controllerfor that data. We are registered with the UK Information Commissioner’s Office (ICO) under registration [ICO reference].
Contact us about privacy at [privacy@cubeenergies.com], or by post at [registered address].
1. The data we collect
- Account data — your email address and a securely hashed password. We never see your password in plain text.
- Property & system data — the details you enter to run an evaluation: postcode and approximate location (latitude/longitude), roof characteristics, existing solar/battery/EV/heat-pump details, and your chosen tariff.
- Energy consumption data — either an annual figure you enter, or, if you connect your Octopus Energy account, your half-hourly electricity consumption imported via the Octopus API with your authorisation.
- Results & run history — the evaluations and solar designs you generate and save.
- Technical data — limited log and session data needed to keep you signed in and to operate the Service securely.
2. How we use it, and our lawful basis
| Purpose | Lawful basis (UK GDPR) |
|---|---|
| Create and manage your account | Performance of a contract |
| Run and save energy/solar evaluations for you | Performance of a contract |
| Import your Octopus consumption data | Consent (you choose to connect it; you can disconnect) |
| Keep the Service secure and working | Legitimate interests |
| Respond to your enquiries | Legitimate interests / contract |
The evaluations we produce are estimates to help you make decisions; they are not a guarantee of savings. See our Terms of Use.
3. Who we share it with (processors)
We do not sell your data. We use the following trusted service providers to run the Service, each acting on our instructions under a data-processing agreement:
- Supabase — authentication and database hosting (your account and saved data).
- Vercel — hosting of the web application.
- Railway — hosting of the calculation engine.
- Octopus Energy — only where you connect your account, to retrieve your consumption data.
- Mapbox — satellite map imagery in the Solar Studio (receives the map location you view).
- PVGIS (European Commission Joint Research Centre) — solar-yield lookups by location coordinates.
Some providers may process data outside the UK/EEA. Where they do, transfers are covered by an adequacy decision or appropriate safeguards (such as the UK International Data Transfer Agreement).
4. How long we keep it
We keep your account and evaluation data for as long as your account is active. If you delete your account, or ask us to erase your data, we remove it within [30] days except where we must retain limited records to meet a legal obligation.
5. Your rights
Under UK data protection law you have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected;
- have your data erased;
- restrict or object to our processing;
- data portability (receive your data in a usable format); and
- withdraw consent at any time (e.g. disconnect your Octopus account).
To exercise any of these, email [privacy@cubeenergies.com]. You also have the right to complain to the ICO (ico.org.uk), though we’d appreciate the chance to help first.
6. Security
Access is protected by authentication, data is encrypted in transit, and stored data is isolated per user by database row-level security. No system is perfectly secure, but we take reasonable technical and organisational measures to protect your data.
7. Cookies
We use only the cookies and local storage needed to sign you in and run the Service. See our Cookies notice for detail.
8. Changes
We may update this policy; we’ll change the “last updated” date above and, for material changes, tell you within the Service.