Energicore Privacy Notice
Last updated: 8 August 2026
1. Who we are
Energicore is a home energy advice platform operated by Energicore Limited, registered office Pipers End, 79a Main Street, Fulford, York, YO10 4PN, United Kingdom. We are registered with the Information Commissioner's Office under number ZB909895, and we process personal data in accordance with UK data protection law (UK GDPR and the Data Protection Act 2018).
For anything in this notice, contact us at hello@energicore.app or by post to the registered office above.
If you use Energicore through an organisation (for example a council, housing association or advice service that manages your property on the platform, sometimes under their own branding), that organisation is the data controller for the information it holds about you, and we process it on their behalf. Their privacy notice applies alongside this one, and requests about that data are best directed to them. Where you use Energicore directly, we are the controller and this notice is the complete picture.
2. Information we collect
- Contact and account details: Your name, email address and sign-in credentials. If you sign in with a Google, Microsoft or Facebook account, that provider confirms your identity to us; we do not receive your password.
- Property information: The address and characteristics of a property you add, such as its age, construction, insulation and heating system, together with data we retrieve for it from the official Energy Performance Certificate register.
- Household details: Occupancy, room counts and general heating habits, where you provide them to improve the accuracy of the advice.
- Usage and technical data: How the platform is used and where it fails: error reports, and, only with your consent, analytics events. Our Cookie Policy covers this in full.
- Billing details: For organisational subscriptions, billing contact and transaction records. Card details are entered directly with Stripe and never reach our systems.
Some technical data about a property's energy performance is not personal data at all once it is not connected to an identifiable person; where it is connected to you, we treat all of it as personal data.
3. How we use it, and our lawful basis
- Providing the service (contract): Generating energy assessments, improvement plans and grant eligibility checks for your property, operating your account, and responding to your requests.
- Improving the platform (legitimate interests): Understanding how the platform is used, diagnosing faults, and keeping the service secure and available. Where this relies on analytics cookies, it happens only with your consent.
- Marketing (consent): We send marketing email only if you have explicitly opted in, and you can withdraw that consent at any time using the link in any message or by contacting us.
- Legal obligations: Keeping the records that tax, accounting and regulatory rules require us to keep.
We do not make decisions about you by wholly automated means that have legal or similarly significant effects. The platform's recommendations are advice for you to consider, not decisions made about you.
4. Who we share it with
We do not sell personal data. It is shared in three situations only.
- Our subprocessors: The specialist providers that run parts of the platform (hosting, payments, error monitoring, analytics), each named in full, with what they do and where they process, on our Subprocessors page. Each is engaged under a written contract imposing data protection obligations no weaker than our own.
- Organisations you are connected to: If your property is managed on the platform by an organisation, or you share a plan with one, that organisation sees the data involved; that is the purpose of the connection.
- Public bodies and funding organisations: Where necessary to support an energy efficiency scheme you take part in, or where the law requires disclosure. Where a scheme involves sharing, you will know from the scheme itself.
5. Where your data is processed
Property records, account details and everything you enter about your home are processed only in the United Kingdom or the European Economic Area. The limited exceptions, billing infrastructure and public-page analytics, are set out on the Subprocessors page, and every transfer outside the UK or EEA is covered by an approved safeguard such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.
6. How long we keep it
| Data category | Retention | Notes |
|---|---|---|
| Contact and account details | Up to 2 years after your last active contact | Then confidentially destroyed. Deleted earlier on request (see your rights below). |
| Property data | For the life of the property record | Buildings outlast accounts. Once no longer connected to an identifiable person, it ceases to be personal data; it is never shared alongside your contact details. |
| Billing records | 6 years | The period UK tax and accounting rules require. |
7. Your rights
Under UK data protection law you have the right to:
- be informed, and to access a copy of the personal data we hold about you;
- have inaccurate data corrected, and in many circumstances have data erased;
- restrict or object to certain processing, including any processing based on legitimate interests;
- receive data you provided to us in a portable format;
- withdraw any consent you have given, at any time, without affecting what was done before.
To exercise any of these, email hello@energicore.app. We may need to verify your identity before releasing or changing personal records, and we respond within one month.
You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would welcome the chance to address any concern first, but you do not need our permission to go to the ICO.
8. Cookies, changes and related documents
The cookies we set, and how to give or withdraw consent for the optional ones, are covered by our Cookie Policy. Our security measures and compliance posture are on the Security and Compliance page.
When our practices change, this notice changes with them and the date at the top is updated. Material changes affecting signed-in users are also announced in the product or by email.