Security
How we handle your data
Most of what this site does happens in your browser, and nothing you type into a calculator is sent to us. This page says what is kept, where, and what we do not do.
The calculators, the estimator and the bill check run in your browser, so the numbers you type are never sent to us. The Power Desk saves to your own browser only. If you choose to send us a request, we receive only the fields you type, and we ask you not to include account numbers or meter identifiers.
What stays in your browser
- The tools. The bill check, the cost estimator, the rate checker, the calculators, the ZIP lookup and the site search work out their answers on your device from data already in the page. Nothing you type into them is transmitted.
- The Power Desk. The sites you add are saved in this browser's local storage and nowhere else. We never receive them. Exporting is yours to do, and clearing this site's data in your browser deletes them.
- No accounts. There is no sign-in. We do not hold a profile of you.
What we receive if you send us a request
Only what you type into the form and choose to submit: your name, work email, business name, optionally a phone number, your state, the service address, an approximate monthly spend band and a message, with the permission you ticked and the exact wording shown beside it. We also record the page you were on, the site you came from (its address up to the path, never the query) and any campaign tags in the address.
This site does not accept bill documents or file uploads. Please do not type account numbers, meter identifiers or ESI IDs into a form or an email: we do not need them to start, and a form is not the right channel for them.
Controls in place today
| Control | What it means |
|---|---|
| Encryption in transit | Every page and every request uses HTTPS, and browsers are told to insist on it. |
| No third-party scripts | The pages load no advertising, analytics or tracking scripts. The one script that is not our own is the Ask HAUSE chat, served by HAUSE; a content security policy blocks every other. |
| No personal data in addresses | Page addresses carry only public choices such as a state or a building type. Nothing you type, such as a name, an email or a number from a bill, is ever put in an address. |
| Permission asked in plain words | The permission is a separate box, unticked, with its own wording. The wording and its version are saved with your request, so what you agreed to can be shown later. |
| Requests held by named providers | A request is stored with Cloudflare, recorded in our customer system, GoHighLevel, and announced to us by email through Resend. The privacy policy says what each does. |
| Deletion on request | Contact HAUSE to delete or correct what you sent and a person deals with it. How to ask is on the contact page. |
We describe the controls we operate, not certifications we do not hold. This site holds no security certification and claims none. If one is obtained it will be named here with its scope, its auditor and its date.
Permissions are separate
A request needs one permission, to use your details to review and respond to it, and you can withdraw it. There is no marketing permission: a request does not subscribe you to email, and no confirmation email is sent. Sharing anything about you with a supplier would need its own permission, for one specific event, and no supplier receives anything about you today because supplier comparison is not open.
When comparison does open, a supplier will receive an anonymised load packet (utility territory, customer class, consumption history, demand profile, requested term and start date) and not your name, address or contact details unless and until you choose that supplier's offer.
More detail on what we collect and who handles it is in the privacy policy.