Privacy Policy

ShiftCharge is operated by SlantForge Ltd, a company registered in England and Wales. SlantForge Ltd is the data controller for personal data you give us when using ShiftCharge.

Contact: privacy@shiftcharge.io.

Account data. Your email address, a hashed password, the time you signed up, and the time you last signed in.

Home and hardware data. The information you supply about your property (such as approximate location for solar forecasting), inverter, battery, and tariff. We treat your post-code-level location as personal data.

Integration credentials. Where you connect to a third party (Octopus Energy, Growatt, GivEnergy, etc.) we store the credentials, tokens, or API keys you give us so we can run schedules on your behalf. These are encrypted at rest using libsodium sealed-box encryption with a key that's only held in our deployment environment.

Telemetry. Half-hourly readings of generation, consumption, and battery state pulled from your inverter or supplier; the schedules we computed for you; and what your inverter actually did. We use this to optimise your battery and to show you how it has performed.

Billing data. If you take a paid plan, we use Stripe as our payment processor. Stripe handles your card details — we never see or store them. We receive a customer ID, the last four digits of your card, your billing country, and your subscription status.

Usage data. Logs of your interaction with the service: page views, actions in the app, IP address, device and browser information, and timestamps. We use Google Analytics to help us understand how the service is used, with anonymised IPs.

Communications. If you email us or fill in a form, we keep that correspondence so we can reply to you and improve the service.

Under UK GDPR we need a lawful basis for each thing we do with your data. We rely on:

• Performance of a contract with you — to run your account, fetch tariff and forecast data, compute schedules, and send them to your inverter.
• Legitimate interests — to keep the service secure and reliable, to detect and prevent abuse, to improve the optimiser using aggregated and anonymised statistics, and to send you essential service updates.
• Legal obligation — to keep records required for tax, accounting, and regulatory purposes.
• Consent — for non-essential marketing emails and for non-essential analytics cookies. You can withdraw consent at any time.

We don't sell your personal data. We share it only with the parties below:

• Hosting and infrastructure — our application and database run on infrastructure managed via Dokploy. Data is stored in the United Kingdom.
• Energy and forecast providers — Octopus Energy, your inverter vendor's cloud (e.g. Growatt, GivEnergy), and weather/solar-forecast providers (e.g. Solcast). We send only what's needed to fetch prices, forecasts, and telemetry, or to apply the schedules you've authorised.
• Stripe — for processing payments if you take a paid plan.
• Google Analytics — for aggregated usage analytics, with IP anonymisation enabled.
• Email delivery — a transactional email provider that delivers sign-up, password-reset, and notification emails on our behalf.
• Authorities — where we are legally required to disclose information (for example, in response to a valid court order).

We choose providers that offer appropriate technical and organisational safeguards, and we use them under data-processing agreements where required.

Some of our providers (notably Stripe and Google Analytics) may process data outside the UK. Where that happens, we rely on UK-recognised transfer mechanisms — typically the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or an adequacy decision — to keep your data protected to UK GDPR standards.

We keep your account, integration, and telemetry data for as long as you have an active ShiftCharge account, plus a short grace period in case you change your mind. When you delete your account we delete or anonymise your personal data within 30 days, except where we need to keep something longer for legal reasons (for example, VAT records, which we keep for six years).

Aggregated data that no longer identifies you (e.g. statistics about average optimiser performance) may be retained indefinitely.

Under UK GDPR you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased ("right to be forgotten");
• restrict or object to certain processing;
• port your data to another service in a machine-readable format;
• withdraw consent at any time, where we rely on consent;
• lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.

To exercise any of these rights, email privacy@shiftcharge.io. We aim to reply within 30 days.

We use a small number of cookies. Strictly-necessary cookies (for example, the one that keeps you signed in) are always on. Analytics cookies (used by Google Analytics) are only set with your consent. You can change your choices at any time from the cookie banner or your browser settings.

We take security seriously. Per-tenant secrets are encrypted with libsodium sealed-box encryption; passwords are stored as salted hashes; traffic to and from the service is encrypted in transit with TLS. We follow the principle of least privilege for staff and infrastructure access.

No system is perfectly secure. If we become aware of a personal-data breach that is likely to result in a risk to your rights and freedoms, we'll notify the ICO within 72 hours and let affected users know without undue delay.

ShiftCharge is not intended for children under 18. We don't knowingly collect data from children. If you believe a child has given us their personal data, please contact us and we'll delete it.

We may update this policy as the service evolves. If the changes are material we'll tell you by email or in the app before they take effect. The "last updated" date at the top of this page always reflects the current version.

For any privacy-related question, write to privacy@shiftcharge.io. See also our Terms of Service.