Privacy Policy

gridIQ ("we", "us", "our") is operated by High Impact Group Pty Ltd (ABN 40 682 923 128), an Australian company. This privacy policy explains how we collect, use, disclose, and protect personal information in accordance with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

We collect the following categories of personal information:

• Account information: email address, name (if provided), and hashed password (managed by Supabase Auth).
• Usage data: pages visited, features used, alert configurations, and energy consumption data you upload.
• AI chat data: messages you send to Watt (our AI assistant) and the responses generated.
• Payment information: billing details are processed by Stripe. We store only your Stripe customer ID and subscription status — never your credit card number.
• Technical data: IP address, browser type, and device information collected automatically for security and analytics.

• Provide and improve the gridIQ platform and services.
• Process your energy alerts and deliver notifications via email or webhook.
• Generate AI-powered energy market analysis through the Watt assistant.
• Process payments and manage subscriptions.
• Send transactional emails (alert notifications, account confirmations).
• Detect and prevent security threats and abuse.

We share personal information with the following third-party service providers:

• Anthropic (Claude AI): Your Watt chat messages are sent to Anthropic's API for processing. Anthropic's data retention and usage policies apply. Messages are not used to train AI models.
• Stripe: Payment processing. Stripe receives your billing details directly. See Stripe's privacy policy.
• Resend: Transactional email delivery. Resend receives your email address for alert notifications.
• Supabase: Database and authentication hosting. Your account and application data is stored in Supabase-managed infrastructure in the Asia-Pacific region (AWS ap-southeast-1, Singapore). This means your data may be transferred to and stored outside of Australia.
• Sentry: Error monitoring. Technical error details (route names, error messages) are sent to Sentry for reliability monitoring. Technical metadata such as IP addresses and URL paths may be transmitted as part of error reports. No personal information (email, name) is intentionally included.
• Cloudflare Turnstile: Bot protection on our newsletter signup page. Turnstile may collect your IP address and browser characteristics to verify you are a human visitor. No personal information is shared with Cloudflare. See Cloudflare's privacy policy for details.
• Vercel: Application hosting, edge network, and web analytics. HTTP requests are processed through Vercel's global infrastructure, which may include servers in the United States. Vercel Analytics collects anonymised usage data (page paths, referrer URLs, device type, and country derived from IP address) to help us understand how the platform is used. No cookies are set by Vercel Analytics. See Vercel's privacy policy for details.
• Open-Meteo: Weather forecast data. Our servers request 72-hour weather forecasts from Open-Meteo (based in the European Union) to provide weather-adjusted energy market analysis. No personal information is sent — only region coordinates. Server IP addresses may be transmitted as part of standard API requests.

Your data may be transferred to and processed in countries outside Australia, including the United States and the European Union, where our third-party providers (Anthropic, Stripe, Resend, Supabase, Vercel, Open-Meteo) operate. We take reasonable steps to ensure these providers comply with privacy obligations comparable to the APPs. By creating a gridIQ account, you expressly consent to these transfers.

• Account data: retained for the life of your account. Deleted upon account deletion request.
• Chat history: retained for 90 days, then automatically purged.
• Alert history: retained for 12 months.
• Market data: aggregated public data from AEMO with no personal information.
• Payment records: retained as required by Australian tax law (typically 5 years).

Under the Australian Privacy Act, you have the right to:

• Access: Request a copy of the personal information we hold about you.
• Correction: Request correction of inaccurate or incomplete information. You can update your details directly in Account Settings, or contact us to correct information we hold.
• Deletion: Request deletion of your account and associated data via the account settings or by contacting us.
• Data export: Download your data in a machine-readable format (JSON) via the API.
• Complaint: Lodge a complaint with the Office of the Australian Information Commissioner (OAIC) if you believe we have breached your privacy.

We implement industry-standard security measures including encryption in transit (TLS), row-level security (RLS) on all database tables, HMAC-signed authentication tokens, and rate limiting on API endpoints. However, no method of transmission over the Internet is 100% secure, and we cannot guarantee absolute security.

We use essential cookies for authentication and session management. We do not use third-party tracking cookies or advertising cookies. The gate access cookie is signed with HMAC to prevent tampering.

We use Vercel Analytics to collect anonymised page-view data (page paths, referrer, device type, country). Vercel Analytics does not use cookies or track individual users across sessions. This data is processed by Vercel in the United States.

We may update this policy from time to time. Material changes will be communicated via email or a prominent notice on the platform. Continued use of gridIQ after changes constitutes acceptance of the updated policy.

For privacy inquiries, data access requests, or complaints, contact us at:

support@highimpactgroup.com.au