Privacy Policy

We collect only what we need to estimate your savings and enroll you with a supplier. Some of it you type in. Some of it comes off your bill. A little comes from your browser.

• ZIP code. The first thing you enter, and the only thing we need to show you an estimate.
• Contact details. Your name, email address, mobile phone number, and service address, once you create an account or sign an agreement.
• Bill images and what is on them. The photo or PDF you upload, plus what we read from it. That means your utility, account number, supply rate, usage, and charges.
• Agreement records. Your signature, the document version and its fingerprint, the time you signed, your IP address, and your browser details. This is the evidence that makes an electronic signature valid.
• Consent records. Which boxes you checked, the exact wording you agreed to, its version, the time, and your IP address.
• Device and usage data. Browser type, device type, pages viewed, and how far you got in the flow. We use this to fix problems and to see where people get stuck.
• Hashed IP address. For abuse prevention we store a one-way hash of your IP address, not the address itself. We keep a raw IP address only on consent and agreement records, where it is legal evidence.

We use your information for these business purposes, and not for others:

• To estimate what you could save on the supply portion of your electric bill.
• To enroll you with a PUCO-certified supplier when you ask us to.
• To create and secure your account, and to show you your status and documents.
• To contact you about your enrollment. We call or text only if you gave that consent, and you can withdraw it anytime.
• To prevent fraud and abuse, including bot filtering and rate limiting.
• To keep the records the law requires, and to defend or resolve a dispute.

For most of what we do, our basis is performing the service you asked for. That means checking savings and arranging an enrollment. For security and fraud prevention, our basis is our legitimate interest in keeping the service safe. For calls and texts, our basis is your express written consent, which you can withdraw. For record keeping, our basis is complying with the law.

We do not sell your personal information. We do not share it for cross-context behavioral advertising.

We share the minimum needed, with these groups only:

• PUCO-certified electric generation suppliers and our aggregator partner. They receive your enrollment details so they can serve your account.
• Your utility, when your enrollment or usage data has to be confirmed.
• Service providers who run our systems. They are Vercel (hosting), Supabase (database, login, and file storage), Sentry (error monitoring), Cloudflare (bot protection), and Upstash (rate limiting). They may process your data only for us.
• Legal and safety recipients, when the law requires it or to protect people from harm.
• A successor, if our business is sold or merged. We would tell you first.

We do not keep data longer than we need it. Here is the schedule we actually run:

• Abandoned funnels. You may enter a ZIP or view a savings page and go no further. We then delete that lead, its events, and any bill image after 90 days.
• Bill images for enrolled customers. Kept while your enrollment is active and for the period broker rules require. [LEGAL TO SUPPLY — bill-image retention period for signed customers]
• Account deletion. When you ask us to delete your data, we mark it deleted right away. We finish removing it, including stored files, within 30 days.
• Signed agreements. Retained where the law requires it, even after you delete your account, because they are legal records. [LEGAL TO SUPPLY — signed-agreement retention period]
• Consent records. Retained as evidence of the permission you gave, for as long as the related record is kept. [LEGAL TO SUPPLY — consent-record retention period]
• Audit logs. Append-only records of sensitive actions, such as issuing a download link for a bill image. They cannot be edited and are kept for security review. [LEGAL TO SUPPLY — audit-log retention period]
• Waitlist emails. Kept until you unsubscribe or ask us to remove you. We email you only if you checked the box asking us to.

Your data is encrypted in transit and at rest. Bill images live in a private storage bucket and are never public. When you or our staff need to view one, the system issues a link that expires in about a minute. It also writes an audit record.

Your savings session is tied to a signed cookie, so nobody can guess another person's ID and see their data. Passwords are stored by our login provider using industry-standard hashing, and we require at least 10 characters.

No system is perfect. If a breach affects your information, we will notify you as the law requires.

You can ask us for a copy of your data. You can ask us to correct it or delete it. You can also withdraw a consent you gave.

• Delete your account data: sign in and use Dashboard → Delete my data. We finish within 30 days.
• No account? Email [LEGAL TO SUPPLY — privacy email] and we will handle the request by hand. This covers waitlist entries, savings checks you never finished, and any bill image you uploaded without creating an account.
• Stop calls and texts: withdraw your consent by emailing us, or reply STOP to any text.
• Stop emails: use the unsubscribe link in any marketing email.
• We will not treat you differently for exercising any of these rights.

We use only essential cookies.

• oes_lead. Remembers your savings session so your bill upload and agreement connect to the right ZIP. It is httpOnly, signed so it cannot be tampered with, and expires after 30 days.
• Login session cookies. Once you create an account and sign in, our login provider (Supabase) sets cookies that keep you signed in and let us refresh your session securely. They are removed when you sign out.
• Bot-protection cookies. Our bot check (Cloudflare Turnstile) may set a short-lived cookie to confirm you are a real person. It is used for security only.
• We use no advertising cookies and no third-party tracking cookies. Our traffic measurement, Vercel Analytics, is cookieless and does not identify you.

This service is for adults. It is not directed to anyone under 18, and we do not knowingly collect information from children. If you believe a child gave us information, email [LEGAL TO SUPPLY — privacy email] and we will delete it.

Ohio Energy Savings, [LEGAL TO SUPPLY — business address]. Privacy questions: [LEGAL TO SUPPLY — privacy email]. General support: [LEGAL TO SUPPLY — support email] or [LEGAL TO SUPPLY — support phone].

If we change this policy, we will post the new version here and update the effective date at the top. If the change is significant, we will tell account holders by email before it takes effect.

Effective date: September 2, 2026.