Privacy Policy

Account information: Your email address and authentication provider (e.g., Google). We do not collect passwords directly; OTP-based authentication is used for email login.

House and region information: Address (optional), state/region code, and utility types you track.

Bill data: Information parsed from utility bills you upload or email-sync, including usage (kWh, therms, gallons), charges, fees, provider name, plan type, and billing period.

Usage data: How you interact with the Service, including pages visited, recommendations viewed, and feature usage patterns. We do not sell this data to third parties.

We use your information to: (a) provide, operate, and maintain the Service; (b) process and structure your utility bill data via OCR; (c) generate personalized plan recommendations based on your actual usage; (d) communicate with you about your account, billing, and service updates; (e) detect, prevent, and address fraud or abuse; and (f) comply with legal obligations.

We do not sell your personal information to third parties. We do not share your utility bill data with Retail Electric Providers or utility companies without your explicit consent.

We share information with third-party service providers who help us operate the Service: cloud hosting (PostgreSQL, Redis, MinIO object storage), email delivery (SMTP providers), and OCR processing (Volcano Engine ARK API). These providers are bound by confidentiality obligations and process data only on our instructions.

We may disclose information when required by law, court order, or governmental authority, or when we believe in good faith that disclosure is necessary to protect the rights, property, or safety of UtilitySmart, our users, or others.

We do not share your data with utility providers or third-party marketers for promotional purposes.

We implement bank-grade security measures to protect your data: AES-256-GCM encryption for OAuth tokens at rest, TLS encryption for data in transit, isolated database access controls, and regular security reviews.

OAuth tokens (e.g., Gmail, Outlook) used for email-sync are encrypted with a dedicated encryption key and never exposed to client-side code. Access to production data is restricted to authorized personnel with audit logging.

Despite these measures, no system is 100% secure. We will notify affected users of any confirmed data breach within 72 hours in accordance with GDPR Article 34.

If you are a resident of the European Economic Area (EEA), the United Kingdom, or California (CCPA), you have specific rights regarding your personal data:

Access: You can request a copy of your personal data via the Export My Data feature in Settings.

Deletion: You can delete your account and all associated data at any time from Settings. Deletion is irreversible and triggers our GDPR data erasure pipeline.

Opt-out: You can opt out of the sale or sharing of your personal information (we do not sell data, but you can still opt out of analytics tracking via cookie settings).

To exercise these rights, email privacy@utilitysmart.app. We respond to verified requests within 30 days.

We use essential cookies for authentication and session management. We use analytics cookies (if enabled) to understand aggregate usage patterns and improve the Service.

You can control cookies via your browser settings. Disabling essential cookies may prevent you from logging in or using certain features.

The Service is not directed to children under 13 (COPPA) or under 16 (GDPR). We do not knowingly collect personal information from children.

If you believe we have collected information from a child, please contact privacy@utilitysmart.app and we will delete it promptly.

We may update this Privacy Policy from time to time. Material changes will be communicated via email or a prominent notice on the Service at least 30 days before they take effect.

Your continued use of the Service after the effective date constitutes acceptance of the updated policy.

If you have questions about this Privacy Policy or your data, contact us at privacy@utilitysmart.app.