01What this policy covers
This policy covers wattfoundry.ai, app.wattfoundry.ai, proposals.wattfoundry.ai, intake.wattfoundry.ai, the Forge referral program, and related services. It is part of our Terms of Service. Words defined in the Terms, such as "Customer Data," mean the same thing here.
02Our two roles
When we act for ourselves. For information about our own users and visitors, such as account details, billing, Forge referrers, website logs, and messages you send us, we decide how the information is used. This policy describes that use.
When we act for installers. Installers and their teams upload information about their customers, such as names, contact details, addresses, utility bills, usage, and property details, and publish proposals that their customers view and respond to. For this Customer Data, we are a service provider (sometimes called a processor) to the installer. We use it only to provide the Service to that installer, as our Terms and this policy describe. The installer decides what to collect and how to use it, and the installer's own privacy policy applies.
If your information is in a proposal. If you are a homeowner or business owner and an installer used WattFoundry to prepare your proposal, please contact that installer with questions or requests about your information. If you contact us instead, we will pass your request to the installer and help them respond.
03Information we collect
Information you give us
- Account and organization information: your name, email address, company name, password (stored only as a salted hash), role, the organizations you belong to, team members you invite, and a phone number if you verify one. We also store company settings such as your logo, brand colors, and pricing defaults.
- Billing information: your plan, billing term, and payment status. Stripe collects and stores your card or bank details. We do not receive full card numbers.
- Customer Data uploaded by installers: customer names and contact details; service and mailing addresses; utility bills and the information on them, including utility account numbers, meter numbers, rate schedules, and usage, cost, and interval data; roof, site, and satellite imagery and system designs; and proposal content such as equipment, pricing, and financing options.
- Partner intake submissions: information that reps and partners submit through intake.wattfoundry.ai, such as the rep's name and email address and the customer and project details.
- Demo requests and messages: your name, email address, company, role, and anything you write to us.
- Forge referral program: your referral code and referral activity; payout details, which you give directly to Stripe through Stripe Connect; identity verification, which Stripe performs (you give Stripe a photo of a government ID and a selfie, and we receive the result and your verified name, not the images); and tax information on Form W-9, including your taxpayer identification number, legal name, and address, which we store encrypted and use for tax reporting.
Information from proposal recipients
We don't track who opens a proposal link. If the recipient accepts the proposal, we record the acceptance, the time, and the name, email address, and note they enter, and we share it with the installer who sent the proposal. If the recipient asks for changes, their email comes to us and we pass it to the installer. If the installer has connected a CRM, we may update the matching deal in that CRM when the proposal is opened or accepted. This information is Customer Data.
Information collected automatically
- Log and device data: IP address, browser and device type (user agent), the pages and features you request, and timestamps. We use this to run, secure, and fix the Service, to prevent abuse, and to keep audit logs of sensitive actions.
- Referral clicks: when someone follows a Forge referral link, we record the click, including IP address, browser type, the page that linked to it, and any campaign (UTM) tags, to credit the right referrer and to detect fraud.
Information from other sources
- Map, satellite, and solar data for a property address, from Google.
- Identity verification results and payout account status, from Stripe.
- Data from accounts you connect, such as your CRM (for example, Zoho) or a third-party energy modeling software account.
04Cookies, local storage, and analytics
- No tracking. We don't use advertising or analytics cookies, and our sites don't run third-party analytics, advertising, or tracking scripts.
- Staying signed in. The WattFoundry app and the partner intake site keep your sign-in token in your browser's local storage so you stay signed in. The token expires after 30 days, and signing out removes it.
- Referral codes. If you arrive at the app through a referral link, the app stores the referral code in local storage so the referrer gets credit if you sign up.
- Work in progress. While you design a system, the app saves the design, including the customer's name and address, in local storage so a refresh doesn't lose your work. The app discards it after 24 hours, and signing out removes it. Bill uploads and portfolio imports in progress, which can include details read from a bill, are kept in session storage, which clears when you close the tab.
- Preferences. The app stores your display theme choice.
- Marketing site and proposal pages. wattfoundry.ai and proposals.wattfoundry.ai don't store anything in your browser.
- Google and Stripe. Our pages load fonts from Google Fonts, and the app loads Google Maps. When they load, your browser connects to Google, which receives your IP address and browser information under the Google Privacy Policy. Stripe's hosted checkout, billing, and identity verification pages may set their own cookies under Stripe's Privacy Policy.
- Opt-out signals. We don't sell or share personal information, so there is nothing to opt out of. We still treat a Global Privacy Control signal as a valid opt-out request.
05How we use information
- Provide the Service: accounts and organizations, design tools, bill extraction, production and savings modeling, proposal building and hosting, bids, and the integrations you turn on.
- Read documents with AI: when you upload bills or other documents, we send them to an AI provider to pull out the data (such as usage, rates, and account details), and we show you the results to review. Most bills are read with Google's Gemini API on Google's paid tier. Under Google's terms for that tier, Google does not use the documents we send or the results it returns to improve its products; it keeps them for a limited time only to detect abuse and meet legal requirements. Anthropic, our other AI provider, does not use the data we send it to train its models.
- Communicate with you: sign-in links and codes, verification, notifications (for example, when a customer accepts a proposal), billing notices, service and security announcements, and replies to your requests.
- Billing and payouts: process payments, run the Forge program, verify identity, prevent referral fraud, and meet tax reporting duties.
- Security: protect accounts, detect and prevent fraud and abuse, and keep audit logs.
- Support and quality: troubleshoot, fix problems, and answer questions. Authorized WattFoundry staff access Customer Data only as needed for these purposes or when you ask us to.
- Improve the Service: using usage information and de-identified, aggregated data.
- Legal: comply with the law, enforce our Terms, and protect rights and safety.
We don't use Customer Data to market to an installer's customers, and we don't contact them on our own behalf, except to deliver messages the installer sends through the Service or to respond to them.
07How long we keep information
| Information | How long |
|---|---|
| Account and organization data | While your account is active. After it closes, we delete or de-identify it within 90 days. |
| Customer Data, including uploaded bills, published proposals, and proposal responses | While the installer's account is active, or until the installer deletes it. After the account closes, the installer can request an export for 30 days, and we delete the data within 90 days. |
| Backups | Deleted data may remain in our backups until they are rotated out. We keep only a small number of recent backups. |
| Security and server logs | Up to 12 months. |
| Billing and payment records | 7 years, for tax and accounting. |
| Forge tax forms and payout records | 7 years after the last payment, for tax compliance. |
| Demo requests and support email | Up to 24 months after our last contact. |
We may keep information longer when the law requires it, or when we need it to resolve disputes or enforce our agreements.
08Security
We use administrative, technical, and physical safeguards to protect information, including:
- encryption in transit (HTTPS) and encryption at rest by our hosting and database providers;
- passwords stored only as salted hashes;
- passwords and tokens for software accounts you connect, encrypted with AES-256;
- Forge W-9 details encrypted with AES-256, and W-9 forms, which include your taxpayer ID, stored with a dedicated encryption key;
- access controls that keep each organization's data separate; and
- limited staff access to production data.
No system is perfectly secure. If a breach affects your personal information, we will notify you and the authorities as the law requires.
09Your privacy rights
You can view and update most of your account information in the app at any time. Depending on where you live, including California and other states with consumer privacy laws, you may also have the right to:
- Know and access the personal information we collect, use, and disclose about you, and get a copy in a portable format;
- Correct inaccurate personal information;
- Delete personal information;
- Opt out of the sale or sharing of personal information, targeted advertising, and profiling. We don't do any of these;
- Limit the use of sensitive personal information. We use sensitive information, such as account passwords, identity verification results, and taxpayer identification numbers, only to provide the Service, verify identity, prevent fraud, and meet legal duties; and
- Not be discriminated against for using these rights.
We honor these requests from all of our users, wherever they live.
How to make a request. Email keaton@wattfoundry.ai with "Privacy request" in the subject line. We will verify your identity, usually by confirming you control your account's email address. An authorized agent may make a request for you with your written permission, and we may ask you to confirm it. We respond within 45 days. If we need more time, we may extend that once by up to 45 more days and will tell you why.
Appeals. If we deny your request, you can appeal by replying to our decision. If you are still not satisfied, you may contact your state attorney general.
Customer Data. If your information is in an installer's workspace, we will refer your request to the installer and help them respond (see Section 2).
10California disclosures
In the past 12 months, we collected these categories of personal information:
- Identifiers: name, email address, phone number, IP address, and account IDs.
- Customer records: addresses and utility account information.
- Commercial information: plans purchased, and energy usage, cost, and proposal data.
- Internet or network activity: logs and referral link clicks.
- Geolocation data: property addresses and coordinates. We do not collect the precise location of your device.
- Professional information: company and role.
- Sensitive personal information: account login credentials, government ID and selfie images (collected and processed by Stripe for identity verification), and taxpayer identification numbers (Forge participants).
We collect this information from you, your organization, installers (for Customer Data), proposal recipients, your browser or device, our service providers, and accounts you connect. We use it for the purposes in Section 5 and disclose it for business purposes to the recipients in Section 6. We have not sold or shared personal information in the past 12 months, and we do not knowingly sell or share the personal information of anyone under 16.
11Children
The Service is for businesses. It is not directed to children under 16, and we do not knowingly collect personal information from them. If you believe a child has given us personal information, contact us and we will delete it.
12Where we process data
We are based in the United States. We and our service providers store and process information mainly in the United States. Some providers may process limited information in other countries, for example a production modeling service that receives site coordinates.
13Changes to this policy
We may update this policy. The "Last updated" date at the top shows the current version. If we make a material change, we will notify you by email or in the app before it takes effect.
14Contact
Questions or requests about privacy? Contact us:
Garner Solutions, LLC d/b/a WattFoundry
Email: keaton@wattfoundry.ai