What we do with your bill
A utility bill carries your name, your address and your account number, and it describes when you are at home. It is worth being specific about what happens to it.
The bill you upload
- Why
- To read the charges off it.
- How long
- Deleted after extraction by default. You can choose to keep it.
- Handling
- Stored in a private bucket, encrypted, never publicly addressable. Deleting it removes it from live storage immediately; a copy can persist in encrypted backups until they age out.
Your account number
- Why
- To match a new bill to the right account.
- How long
- Stored as a one-way hash. At most the last four digits are kept for display.
- Handling
- Never shown in full, and never written to a log.
The charges and usage we extract
- Why
- To explain the bill and compare it with your others.
- How long
- Until you delete the bill or the account, then until backups age out.
- Handling
- Readable only by you.
A record of what you consented to
- Why
- It is the evidence that a disclosure or deletion was authorised.
- How long
- Retained after deletion, with identifiers tombstoned.
- Handling
- Append-only. Never edited in place.
Connecting a utility account
No utility connection is live.
Ongoing access to a utility account — Green Button Connect My Data — is the most powerful thing this product could hold and the most sensitive. It is not enabled. When it is, the authorisation will be per-utility, revocable from your account page, and the credentials will live in a separate store from your bill data. Until an actual authorisation flow exists and has been tested, this product will not display it as an option.
The other sites in the network
GetEnergyRebates and CalculateEnergySavings are operated by the same company. That does not give them your bill. If a rebate or calculator is relevant, we pass only the specific detail you approve, at the moment you approve it, and record that you did. Nothing moves between sites merely because the companies are related.
Your controls
- Export everything held about you, in a readable format.
- Delete a single bill, or the whole account.
- See exactly which data any connected service can reach, and revoke it.
- Read the history of what you have consented to, and when.
Deleting removes your data from live storage straight away. Encrypted backups are kept for a short period so the service can be restored after a failure, and your data ages out of those on the same schedule as everything else — we do not reach into a backup to bring it back. Saying otherwise would be easier to read and untrue.