Privacy Policy

This Privacy Policy explains how Gridline AI, PBC. ("we", "us") collects, uses, and protects personal data when you use the Gridline operations portal, the member portal, and related services (together, the "Services"). We process personal data in accordance with the Swiss Federal Act on Data Protection (FADP) and, where applicable, the EU General Data Protection Regulation (GDPR).

1. Who is responsible

Gridline AI, PBC., 16908 SE 34th St, Bellevue, WA 98008, USA, is the controller for personal data processed through the Services, except where we process data on behalf of an energy operator or organization using the Services — in that case the organization is the controller and we act as processor under our agreement with them.

2. Data we process

• Account data — name, email address, role, and authentication identifiers for portal users and administrators.
• Member and billing data — names, contact details, tariff parameters, invoice line items, and payment references of energy community members, as provided by the operator organization.
• Energy data — meter readings, production and consumption data imported from connected systems (for example SolarManager or Zevvy) for the purpose of billing.
• Usage and log data — sign-in events, audit trail entries, approvals, and technical logs needed to operate and secure the Services.

3. Purposes and legal bases

• Providing and operating the Services, including automated billing workflows (performance of a contract).
• Generating, delivering, and tracking invoices and statements on behalf of operator organizations (performance of a contract, legitimate interests).
• Securing the Services, preventing abuse, and maintaining audit trails (legitimate interests, legal obligations).
• Communicating with you about the Services, including operational notifications (performance of a contract, legitimate interests).

4. Third-party services

We share personal data only where necessary to provide the Services, with providers acting under data processing agreements:

• Hosting and database infrastructure (including Supabase).
• Accounting and invoicing integrations (Bexio), where enabled by your organization.
• Energy data platforms (SolarManager, Zevvy), where enabled by your organization.
• Email delivery and document generation services (including Google Workspace APIs).
• Payment providers (for example PayPal), where payment links are enabled.

Where providers process data outside Switzerland or the EEA, we rely on adequacy decisions or standard contractual clauses.

5. Security

We apply technical and organizational measures appropriate to the risk, including encryption in transit, encrypted storage of integration credentials, role-based access controls, row-level security on tenant data, and audit logging of administrative actions.

6. Retention

We retain personal data for as long as needed to provide the Services and to meet legal retention obligations (for example, accounting records connected to invoices). Data processed on behalf of an operator organization is retained or deleted according to their instructions and our agreement with them.

7. Your rights

Subject to applicable law, you may request access to, correction of, or deletion of your personal data, object to or restrict certain processing, and request data portability. If we process your data on behalf of an operator organization, we may refer your request to them. You can also lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC) or your local supervisory authority.

8. Cookies

The Services use strictly necessary cookies and similar storage for authentication, session management, and remembering interface preferences. We do not use advertising or cross-site tracking cookies.

9. Changes

We may update this policy from time to time. Material changes will be announced in the Services or by email. The "Last updated" date above reflects the most recent revision.

10. Contact

For privacy questions or to exercise your rights, contact us at support@gridline.ai.