Privacy Policy

Last updated: October 18, 2026

1. Who We Are

PowerDiligence Inc. ("PowerDiligence," "we," "us," or "our") provides an AI-powered due-diligence platform for energy assets. This Privacy Policy describes how we collect, use, share, and protect personal data when you visit powerdiligence.com (the "Site") or use our platform (the "Service").

We are the controller of the personal data we collect through the Site, enquiries and demo bookings, and for administering customer accounts (sign-in, security, support, invoicing). For documents and data that customers upload to or create in the Service, and for their users' activity within it, the customer is the controller and we act as its processor under a data processing agreement (see Section 6).

For privacy-related questions, contact us at privacy@powerdiligence.com.

2. Data We Collect

2.1 Information You Provide

• Contact & lead forms — name, work email address, phone number, company, and job title when you request information or download resources.
• Account data — name, email, role, and authentication credentials when you use the platform.
• Documents & files — contracts, permits, reports, and financial models you upload or connect for analysis. These documents may contain personal data of third parties, such as signatories, contact persons, and landowners.

2.2 Information Collected Automatically

• Analytics — page-view and performance data collected by Vercel Analytics and Vercel Speed Insights. These tools use privacy-friendly, cookie-less measurement by default and do not track individuals across sites.
• Log data — IP address, browser type, and timestamps generated by our hosting infrastructure, and an audit log of actions taken in the platform.

3. How We Use Your Data

• To respond to information requests and deliver resources you ask for.
• To provide, maintain, and improve the Service.
• To run AI-powered analysis on the documents you upload — solely within the scope of your project.
• To send transactional emails (e.g., account invitations, notifications).
• To provide support.
• To monitor performance, security, and uptime of the Site and Service.
• To comply with legal obligations.

Documents you upload, and their contents, are processed only on our customer's behalf to deliver the Service to that customer. We do not use them to improve the Service for others.

4. Legal Bases for Processing (GDPR)

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, we process your personal data on the following legal bases:

• Contract — processing necessary to provide the Service you signed up for.
• Consent — when you voluntarily submit your details through a lead form or download a resource.
• Legitimate interest — analytics, security monitoring, support, and improving the product, balanced against your rights.
• Legal obligation — where required by applicable law.

For documents uploaded by customers, the customer determines the legal basis as controller; we process them only on the customer's instructions.

5. Where Your Data Is Stored

Platform data and uploaded documents are stored in Europe:

The United Kingdom benefits from an adequacy decision of the European Commission, renewed in December 2025. Some of the service providers listed below process data in the United States to deliver the Service (see Section 6).

6. Data Sharing & Sub-Processors

We do not sell your personal data. We share data only with the following service providers, each bound by a data-processing agreement:

Where personal data is transferred to the United States or another country without an adequacy decision, we rely on the EU-U.S. Data Privacy Framework (and its UK and Swiss extensions) where the provider is certified, or on Standard Contractual Clauses as required by GDPR Chapter V.

Maps in the Service use OpenStreetMap data. Map tiles are loaded through our own server, so OpenStreetMap does not receive your IP address. Project locations are looked up by place name only, never by street address.

If you connect your own Microsoft SharePoint, documents are read from your Microsoft 365 tenant with the permissions you grant. Business customers can request our Data Processing Agreement, including the full list of sub-processors and our technical and organisational measures, at privacy@powerdiligence.com. We give customers at least 30 days' notice before adding or replacing a sub-processor.

7. AI & Your Documents

• Documents you upload are processed solely to deliver analysis results to you.
• Your documents are never used to train AI models — neither ours nor any third-party provider's.
• Document text is sent to AI providers (OpenAI, Anthropic) through their business APIs, which do not use it for training. These providers may keep request data for a limited period (typically up to 30 days) for abuse monitoring under their API terms.
• Files are stored in a private, encrypted storage bucket. Access is limited to your organisation's users and, where needed for support or operations, named PowerDiligence personnel.
• Your documents and analysis are never used for, or shown to, other customers.

8. Data Retention

• Lead form data — retained for up to 24 months from submission, or until you request deletion.
• Account data — retained for the duration of your active account, plus 30 days after account closure for recovery purposes.
• Uploaded documents & platform data — retained while the customer's agreement is active. Files and deals deleted in the platform are permanently deleted within 30 days. All customer data is permanently deleted within 30 days of the end of the agreement; copies in backups expire with the backup cycle.
• Analytics data — aggregated and non-identifiable; retained indefinitely.
• Server logs — kept by our hosting provider for a limited period for security and troubleshooting.

9. Cookies & Tracking

The platform uses essential cookies required for authentication and session management. Our analytics provider (Vercel Analytics) does not use cookies; it counts visits using a short-lived anonymised identifier and does not track users across websites.

We do not use advertising cookies or pixel trackers.

10. Your Rights

10.1 GDPR (EEA / UK / Switzerland)

You have the right to access, rectify, erase, restrict processing, data portability, and object to processing of your personal data. You may also withdraw consent at any time. To exercise these rights, email privacy@powerdiligence.com. We will respond within one month. If your personal data appears in documents a customer uploaded, we will forward your request to that customer, who decides on it as controller.

Right to object: where we process your data on the basis of legitimate interest, you may object at any time on grounds relating to your particular situation.

You have the right to lodge a complaint with your local data-protection supervisory authority.

10.2 CCPA / US State Privacy Laws

If you are a California resident (or a resident of another US state with applicable privacy legislation), you have the right to:

• Know what personal information we collect, use, and disclose.
• Request deletion of your personal information.
• Opt out of the "sale" or "sharing" of personal information — we do not sell or share your data for advertising purposes.
• Not be discriminated against for exercising your privacy rights.

To submit a request, email privacy@powerdiligence.com.

11. Security

We implement industry-standard security measures including encryption at rest and in transit, tenant isolation enforced in the database, role-based access controls, optional two-factor authentication, audit logging, and regular security reviews. Our infrastructure providers hold SOC 2 Type II and ISO 27001 certifications.

12. Children's Privacy

The Service is designed for business professionals and is not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If you believe we have inadvertently collected such data, please contact us and we will promptly delete it.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page. For material changes, we will make reasonable efforts to notify you (e.g., via email or a notice on the Site).

14. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us at:

PowerDiligence Inc.
447 Broadway, 2nd Floor #3520, New York, NY 10013, USA
Email: privacy@powerdiligence.com
EU contact point: our team in Madrid, Spain, at the same email address.