Privacy Policy

1. Who We Are

HeatFlow.AI ("we", "us", "our") is a trading name of Adapt Gas Ltd, registered in England and Wales. We provide smart metering, fault detection, and energy management services for commercial buildings and heat networks.

Data Controller: Adapt Gas Ltd, Unit 3, Enterprise Park, Manchester M12 4AH
Contact: privacy@heatflow.ai

2. What Data We Collect

3. How We Use Your Data

• To provide and maintain the HeatFlow platform and services
• To generate accurate consumption reports and compliance evidence
• To detect anomalies, faults, and system issues in heat networks
• To send operational alerts and service notifications
• To improve our platform through aggregated, anonymised analytics
• To comply with legal and regulatory obligations (e.g., Heat Network Regulations)

4. Legal Basis for Processing

• Contract: Processing necessary to deliver our services under your service agreement
• Legitimate Interest: Platform security, fraud prevention, and service improvement
• Legal Obligation: Compliance with energy regulations, tax, and accounting requirements
• Consent: Marketing communications (where applicable)

5. Cookies

We use essential cookies only to keep you signed in and store your preferences. We do not use third-party tracking, advertising, or analytics cookies.

6. Data Sharing

We do not sell your data. We may share data with:

• Your Organisation: Admins within your organisation can view team member profiles and operational data
• Infrastructure Providers: Cloud hosting and database services (EU-based, GDPR-compliant)
• Regulatory Bodies: Where required by law or regulation

7. Data Retention

• Meter readings and consumption data: 7 years (regulatory requirement)
• Audit logs: 10 years
• Account data: retained while your account is active, deleted within 90 days of account closure
• Usage analytics: 2 years (anonymised)

8. Your Rights (GDPR)

Under the UK GDPR, you have the right to:

To exercise any of these rights, contact privacy@heatflow.ai. We will respond within 30 days.

9. Data Security

We implement industry-standard security measures including encryption at rest and in transit, role-based access control, audit logging, and regular security assessments. All data is processed and stored within the UK/EEA.

10. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated via email or in-platform notification. Continued use of the platform after changes constitutes acceptance of the updated policy.