EcoMonitor AI LLC (“EcoMonitor AI,” “we,” “our,” or “us”) operates ecomonitorai.com and the EcoMonitor AI compliance platform, including the customer dashboard (together, the “Service”). This Privacy Policy explains what information we collect, how we store and use it, and the choices you have.
1. Information We Collect
Information you provide. Account information: name, email address, and company name. Billing information: when you subscribe, your payment is processed by our payment processor (Stripe), which collects and holds your payment details. Our sign-in and billing platform (Outseta) is connected to our Stripe account. We do not store full card numbers. We receive and keep billing details such as your name, email address, business name, phone number, billing address, plan, payment status, and transaction history. Card details are held by Stripe, not by us. Building information: building name or identifier, address, gross floor area, building type, CBPS tier, whether the building is multifamily residential, and your ENERGY STAR Portfolio Manager (ESPM) property ID. Utility and energy data: the readings you enter, such as fuel type, billing period, and usage. Uploaded files: utility bills you upload as PDF, PNG, or JPG files. Communications: messages you send us by email or through our support channels.
Information collected automatically. Usage data: pages visited and features used. Technical data: IP address, browser type, device type, and operating system. Sign-in and account activity records: timestamps. Service logs: errors and operational events.
Information from third parties. With your explicit authorization, utility consumption data and official energy metrics received through the ESPM data exchange. We receive only the data you authorize and do not access your utility accounts directly. Our sign-in provider tells us which account a request belongs to, so that we show you only your own data.
2. How We Use Your Information
We use the information we collect to provide, operate, and maintain the Service; calculate preliminary energy use intensity estimates; retrieve official figures from ESPM as you authorize; store the files and records you add to your account; send compliance deadline reminders and account notices; respond to support requests; improve and secure the Service; and meet our legal obligations. We do not sell your personal information or energy data, and we do not use your data for advertising. We do not use your building data, utility readings, or uploaded bills to train artificial intelligence or machine-learning models, and we do not provide your data to any third party for that purpose.
3. How We Store Your Data and Uploaded Bills
Our application database and uploaded files are stored with Amazon Web Services (AWS) in the United States, in the US West (Oregon) region. Other providers we use for sign-in, billing, payments, website forms, and email and support may process limited information in locations they control, as described in the Data Sharing and Service Providers section. Service logs and database backups are held in the same AWS region.
Uploaded bills. Bills are stored in a private AWS storage bucket with public access blocked. Each file is placed in a folder that belongs to your account, and the Service shows you only the files in your own folder. Files are encrypted at rest with AWS-managed encryption keys (AES-256) and transferred over encrypted HTTPS connections.
How uploads and downloads work. After we confirm you are signed in, the Service issues a short-lived permission that lets your browser send one file directly to private storage. That permission expires after five minutes. Download links for files and reports are created when you ask for them and expire after five minutes.
Bills are stored, not read. Uploaded bills are stored only. The Service does not currently read, extract data from, or analyze them automatically. A bill is used only when you, or our support team at your request, enter its readings. If we add automated reading, we will update this Privacy Policy before it begins and tell you how it handles your files.
Calculation records. When you run a calculation, we save the building details and readings you submitted, the result, a unique calculation ID, a timestamp, and a SHA-256 fingerprint of the submitted inputs. These records are stored in an AWS database in the same region, encrypted at rest, and filed under your account. Each record states whether the result is a preliminary estimate or an official ESPM figure, and official figures are saved exactly as ESPM returns them.
Who can see stored files and records. You can see your files and records through your signed-in account. Our personnel can access them only through restricted administrative access, and only when needed to support you, keep the Service running, or comply with the law.
4. ENERGY STAR Portfolio Manager
When you use the official compliance features, we connect to EPA’s ENERGY STAR Portfolio Manager through its data exchange, using access you authorize. We retrieve data on your behalf. We do not file reports with the State or any agency for you, and you remain responsible for your own compliance and for the data in your ESPM account, as our Terms of Service explain. Data shared with ESPM is also governed by EPA’s own terms. You keep ownership of your ESPM property record at all times.
5. Data Sharing and Service Providers
We do not sell, rent, or share your personal information or energy data with third parties for their own marketing or commercial purposes. We share information only as described here. We share data with infrastructure providers (such as AWS) to host the Service, with our payment processor (Stripe) to securely process fees, with Outseta, our sign-in and billing provider, which is connected to our Stripe account, to manage sign-in, billing, onboarding, and customer relationship records, with Framer to host our website and measure how it is used, and with Google to receive early-access requests submitted through our website form and to handle support email.
These providers handle information only to perform services for us, under their own terms and privacy commitments. We may also disclose information if required by law, court order, or government request; in connection with a merger, acquisition, or sale of assets, with notice to you; or to protect the rights, safety, or property of EcoMonitor AI, our customers, or others.
6. Security
We protect your information with encryption at rest and in transit, private storage with public access blocked, separation of each customer’s files and records by account, sign-in requirements on every request for account data, and monitoring that alerts us to service failures. Sign-in tokens are kept in your browser’s memory while you use the dashboard and are not placed in web addresses. Each saved calculation includes a timestamp and a SHA-256 fingerprint of its inputs, which helps show whether those inputs were changed after the fact. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we learn that your personal information was accessed without authorization, we will notify affected customers promptly and notify affected individuals or regulatory authorities as required by applicable breach notification laws.
7. Data Retention and Deletion
We keep your account information, saved calculation records, and uploaded bills and documents for as long as your account is active. When your account is cancelled, we delete your uploaded bills and documents from our live systems within 90 days. We delete saved calculation records and account details from our live systems within 90 days of account cancellation, except for legally required billing records. You may ask us to delete your account and data at any time by emailing us. After we verify the request, we will delete your account and data from our live systems within 30 days, including if you make the request when cancelling your account. We may keep certain records, such as billing and tax records, for as long as the law requires.
Data deleted from our live systems can remain in system backups until the backups expire; the 30-day and 90-day deadlines do not apply to backup expiration. Our database backups expire after 35 days. We do not keep older versions of uploaded files, so when we delete a file it is removed from storage. Service logs, which record errors and operational events, are kept for 90 days and then expire. If we ever restore data from a backup, we will delete again anything you had asked us to delete.
8. Your Choices and Rights
For the personal information we hold about you, you may ask us to tell you what we hold; correct inaccurate information; delete your information, subject to legal retention requirements; and give you a copy in a commonly used format. You may also ask us to stop any optional use, such as non-essential messages. Some uses are necessary to provide the Service, such as signing you in and storing the records you create. If you ask us to stop a necessary use, we may be unable to provide the Service, and you may close your account. To make a request, email us at the address in the Contact section. We may need to confirm your identity first.
9. Cookies
We use session cookies for authentication and do not use analytics cookies. Our website uses Framer’s built-in analytics to count visits, page views, and button clicks, which works without cookies. We use this only to see how the website performs, and we do not sell this information or use it for advertising. You can manage or block cookies in your browser settings. Our sign-in and billing providers, including Outseta and Stripe, may also use cookies or similar technologies to keep you signed in. We do not use third-party advertising cookies. Disabling session cookies will prevent you from signing in.
10. Children’s Privacy
The Service is not directed at anyone under 18. We do not knowingly collect personal information from minors. If we learn that a minor has given us information, we will delete it promptly.
11. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by email or by a notice in the Service at least 30 days before they take effect. If a change requires your consent under applicable law, we will ask for it separately and will not treat continued use of the Service as consent. Where consent is not required, continued use of the Service after the effective date means you accept the updated policy.
12. Contact
EcoMonitor AI LLC, Vancouver, Washington. Email: ecomonitorai.support@gmail.com