PowerPlot Privacy Policy

1. Who we are

PowerPlot is a software platform operated by Maison Labs Ltd, a company registered in England and Wales with company number 17318993. Our registered office is 168 Church Road, Hove, United Kingdom, BN3 2DL. In this policy, "we", "us" and "our" mean Maison Labs Ltd.

PowerPlot helps businesses capture enquiries, identify commercial opportunities, prepare indicative solar pricing and proposals, and manage related communications. PowerPlot Scout provides additional prospecting and contact-information functionality. This policy covers invitation-only evaluations, previews of new features and paid use, to the extent the relevant functions are enabled. Our service is intended for UK business use, not consumer or children's use.

For privacy questions, requests or complaints, email hello@powerplot.app, or write to our registered office marked "Privacy". We provide links to this policy and the Terms during account setup. Providing or acknowledging this policy is not a request for blanket consent to processing or marketing.

2. When we are responsible for your information

Our own business activities. We are a controller of personal information we use to manage PowerPlot accounts and customer relationships, administer subscriptions and invoices, respond to business enquiries, and protect and administer our service. Being a controller means we decide the purposes and essential means of that processing.

Our customers' enquiries and proposals. Each customer organisation has its own PowerPlot workspace, also called a tenant. The organisation collecting your enquiry or contacting you normally decides how to use your information. Where we host or manage its enquiry, contact, consumption and proposal records solely on its instructions, we process that information on its behalf under our Data Processing Schedule. A consultant may instead be acting on another organisation's behalf; its own privacy information should explain the arrangement.

Scout contact sourcing and supply. Maison Labs acts as a controller for sourcing and supplying licensed third-party contact information through Scout where we independently determine the purposes and essential means of that processing. This is distinct from storing records or sending communications solely on a customer's instructions. The customer remains responsible for its selection and use of contacts and its prospecting and outreach, including its own lawful basis and privacy information. Each party remains responsible for its own controller activities. This does not authorise us to sell tenant enquiry data, share it across tenants or use it for unrelated marketing.

The relevant organisation's privacy notice governs its purposes, lawful bases, follow-up communications and any onward sharing. This policy explains PowerPlot's involvement but does not replace that notice. Submitting an enquiry does not make you a subscriber to PowerPlot's paid SaaS service.

For requests about a particular enquiry or proposal, contact the organisation shown on the form or proposal. You can also contact us; where we are its processor, we will refer your request to the relevant organisation and help it respond. We remain responsible for complying with our own applicable legal obligations.

3. Information we process

Depending on how you use PowerPlot, we process the following information where it relates to an identifiable person:

Account and business-contact information: names, work email addresses, telephone numbers where supplied, business or organisation details, user roles, account identifiers, authentication information and account status.

Enquiry and site information: contact details, property or site addresses, enquiry details, meter readings, electricity consumption information and information supplied to prepare or assess a proposal. Business or property information can be personal information when it identifies an individual, including a sole trader.

Proposal and communication information: proposal contents and references, messages sent through the service, relevant delivery or failure information, and records of access to hosted proposals. Access records can be associated with the relevant proposal or enquiry and, where supplied, a named contact.

Scout information: names, job titles, employer names and associations, LinkedIn profile links and available work email addresses supplied by People Data Labs, Inc. (PDL), alongside business and property context. We search PDL using the company a customer is seeking to contact. We also retain a seniority classification derived from the highest supplied job-title level, employment start dates, dates when employment details were last verified or changed, and a flag indicating whether a work email address is available. The email address itself is retained only where PDL returns an actual address and the reveal setting is enabled; otherwise that address field is empty.

Scout source and processing records: PDL person and company identifiers, employer website details, search fingerprints, processing-strategy and job references, first-discovered and last-seen timestamps, stale-record reasons, and a status indicating whether contact information is revealed, obscured by the plan or withheld by policy. We use these records to avoid duplicates, match a contact to a company, explain the source and age of information, and administer access and data quality. The selected contact fields and source records are stored in our database, not in application logs. Personal information present in relevant public records may also be processed.

Support, account administration and technical information: information in support requests, administrative actions, subscription and invoice records, IP addresses, browser or device information, timestamps, service activity, error reports and security records, to the extent generated by the service.

PowerPlot does not require special-category information, criminal-offence information, payment-card details or finance applications. Please do not include unnecessary personal information in an enquiry or support request. There is currently no payment-processing or AI feature within PowerPlot.

Where a form identifies information as required, we need it to provide the requested function or the customer needs it to respond to your enquiry. Without it, the requested service or response may not be possible. Optional fields are not compulsory.

4. Where information comes from

We receive information directly from you, from the customer organisation or its authorised users, and from your use of the service. An organisation may supply your contact information when inviting you to its workspace or managing a commercial enquiry.

Depending on the feature used, business, address and property information can come from Postcoder, Ordnance Survey OpenData, local-authority business-rates or ratepayer records, the EPC Register and Companies House. These sources do not necessarily contain personal information, and being publicly available does not remove any applicable privacy obligations.

Scout contact information comes from People Data Labs, Inc. (PDL), which maintains its own contact database using public and third-party sources. PDL is a source of contact information, not the organisation receiving your enquiry. Its Privacy Policy explains its own processing and rights-request routes. A customer's privacy notice must explain its own use of externally sourced contacts and identify relevant sources where required.

Scout supports customer-directed contact lookup, workspace storage and outreach, together with the limited sourcing and supply activities described in section 2. We do not use a customer's contacts to create a separately marketed, cross-customer contact database. A supplied email address, profile or data-quality indicator is not evidence that the person has consented to marketing from a particular customer.

5. Why we use information and our lawful bases

For activities where Maison Labs Ltd is the controller, our purposes and lawful bases are set out below. We assess whether our legitimate interests are outweighed by the rights and interests of the people concerned.

For activities performed solely on a customer's instructions, including enquiry handling, proposal creation, workspace record management and customer outreach, the customer determines the purposes and lawful bases. Maison Labs is separately responsible for the sourcing and supply activities for which it acts as controller, as described above. We do not claim a separate right to use tenant content for our own marketing merely because it is stored in PowerPlot.

Service communications, such as invitations, verification messages and requested proposals, are distinct from optional marketing. We do not add an enquiry submitter to a Maison Labs marketing list simply because they use a customer's PowerPlot form. Any future marketing by us will have its own appropriate information and lawful basis, including consent where required.

6. Enquiries, proposal views and Scout outreach

An enquiry submitted through a customer's form is made available to that customer and its authorised users, not distributed by PowerPlot to unrelated tenants. The customer may use the information to contact you, assess the site and prepare or follow up an indicative proposal.

When a hosted proposal is accessed, our server records the request and can show the activity to the customer, linked to the relevant proposal or enquiry and, where provided, a contact. This enables the customer to understand engagement and follow up. These view records are not generated by tracking pixels. A shared link can be opened by someone else, so an access record does not necessarily prove that a particular named person viewed it.

Scout outreach emails sent through PowerPlot include an explanation of why you are receiving the email and where the contact information came from, together with an opt-out link. This information is controlled by the platform and cannot be removed through a customer's drafting or administration controls. You may use that link to object to further prospecting contact through PowerPlot, or contact us using section 1. The explanation and opt-out route do not themselves establish that you consented to marketing. Each organisation remains responsible for providing the privacy information required for its activities, including where information must be provided before an outreach email is sent.

A consultant may independently pass an enquiry to an installer or another business outside PowerPlot. It is responsible for explaining and lawfully arranging that sharing. That is different from PowerPlot distributing leads across customer workspaces.

PowerPlot produces indicative calculations, not binding installation offers or finance decisions. We do not use personal information to make solely automated decisions producing legal or similarly significant effects on individuals. A customer's own decisions and activities remain subject to its separate privacy information and responsibilities.

7. Support access and use of service information

Authorised Maison Labs personnel may access relevant tenant information where necessary to administer the service, resolve a support issue, investigate a fault or security incident, or meet a legal obligation. Access is limited to the purpose and information reasonably needed and is subject to confidentiality and access controls.

Routine support and administration of tenant content take place under the customer's instructions, including the standing instructions in our Data Processing Schedule. We do not treat acceptance of this policy as unlimited permission to browse tenant records or use their content for unrelated purposes.

We may use necessary service diagnostics and usage counts to operate, secure and improve the technical service. Where those records identify people, they remain subject to this policy and the relevant lawful basis. We may also use genuinely anonymised statistics that no longer identify individuals or reveal a customer's confidential content. We do not use identifiable tenant leads or proposals for model training, sell them, or share them with other tenants.

8. Who can receive information

Relevant information may be available to the customer organisation and its authorised users; to authorised Maison Labs personnel; and to service providers needed to operate the requested functions.

Our core infrastructure uses Amazon Web Services EMEA SARL (AWS), including application hosting and storage, Amazon SES for email delivery, and CloudWatch for monitoring. Allies Computing Ltd, trading as Postcoder, supplies address lookup. Our server sends Postcoder the postcode query, the referring-page address where provided, and ordinary service-connection information. People Data Labs, Inc. supplies Scout contact information following company-based searches. These services do not receive an unrestricted copy of a tenant's records.

Messages to hello@powerplot.app are received and forwarded using Plus Five Five, Inc., trading as Resend, to a Microsoft 365 / Exchange Online mailbox controlled by Maison Labs Ltd. These services handle sender and recipient details, message content, attachments and delivery information to route correspondence, store support cases and enable replies. Access is limited to authorised Maison Labs personnel and the service providers operating that route. This arrangement is separate from Amazon SES application-email delivery.

The current supplier and processing-location details are recorded in the supplier register accompanying our SaaS Terms and Data Processing Schedule. Public-data publishers are sources of data; they are not automatically processors of our customers' information. The role of each external service depends on the actual arrangement.

We may also disclose limited information to professional advisers, insurers, courts, regulators or public authorities where necessary and lawful. If our business or relevant assets are transferred, information may be disclosed to an appropriately bound adviser or prospective or actual successor, subject to confidentiality, necessity and applicable law. The receiving operator must honour the applicable privacy and contractual protections.

We do not sell tenant enquiry data or distribute it to unrelated installers. Intentional communications or proposal sharing requested by a customer are carried out on that customer's behalf.

9. Hosting and international access

Our core application infrastructure and tenant data are hosted in the AWS London region. A UK hosting location is not, by itself, a guarantee that every supplier, support activity or recipient processes all information exclusively in the UK.

AWS processes relevant personal data under its standard Data Processing Addendum, including the AWS UK GDPR Addendum and applicable international-transfer safeguards. These contractual protections do not, by themselves, mean that the London-hosted tenant database is moved overseas.

PDL is a United States-based provider. Relevant lookup-request information and associated service data may be processed in the United States, separately from PowerPlot's London-hosted workspace. Where legally required, our PDL arrangements use the EU Standard Contractual Clauses supplemented by the UK International Data Transfer Addendum, with any additional safeguards and assessment required by law. PDL's independent source database is governed by its own privacy and contractual arrangements.

Postcoder states that its API is hosted in the United Kingdom and Ireland. Its sub-processor register also identifies Axiom Inc., United States, for API traffic analysis. To the extent relevant request information is personal data, processing in Ireland can rely on the applicable UK adequacy regulations. Any onward restricted transfer must be covered by a valid UK transfer arrangement. The fact that PowerPlot looks up UK addresses does not mean that every supplier activity occurs in the UK.

Resend stores email-service data in the United States, as explained in its data-protection information. Its Data Processing Addendum incorporates the EU Standard Contractual Clauses supplemented by the UK Addendum for relevant UK transfers. This concerns correspondence routed through Resend, not the location of PowerPlot's tenant database.

Microsoft 365 mailbox storage is subject to the regional commitments applicable to our tenant; this policy does not represent the mailbox or every associated service operation as exclusively UK-based. Microsoft's service operations can involve processing in other countries, including the United States. The Microsoft Products and Services Data Protection Addendum and the safeguards applicable to UK data govern that processing. Further information on relevant safeguards is available from us.

Where a restricted international transfer is necessary, we use a lawful transfer arrangement, such as applicable UK adequacy regulations or appropriate contractual safeguards, and complete any required assessment. You may contact us for relevant information about the safeguards, including a copy where appropriate with confidential material removed.

The service is intended for UK business use, but it is not represented as technically blocking access from every other country. An overseas visitor or user is not, on that fact alone, proof of a restricted transfer; the actual data flow and recipient matter.

10. How long we keep information

We retain personal information only for as long as needed for the applicable purpose and any legal obligations. A customer's decision to keep a workspace active does not remove its responsibility to review and delete records it no longer needs.

PowerPlot records platform-wide opt-outs to restrict further prospecting use within the Service. Archived contacts remain personal information while retained; an archive status does not remove a person's rights or override a required erasure. Applicable corrections, objections, suppression and deletion requirements must also be applied to retained PDL response information. Deleting a contact from PowerPlot does not itself delete the underlying record from PDL's independently maintained database. Requests about that database may also be made to PDL through the privacy information linked in section 4; this does not remove our responsibility to address requests about our own processing.

Copies independently exported or retained by a customer or another authorised recipient are subject to that organisation's arrangements, not our deletion process. Our customer terms require notified restrictions and applicable privacy requests to be applied to affected exported copies, without authorising the circumvention of an objection by reimporting the information. Records retained for a specific legal requirement are restricted and deleted when that requirement ends.

11. Cookies, browser storage and tracking

PowerPlot uses an authentication cookie to keep authorised users signed in to the administration panel and to provide the authenticated service they request.

You can manage or delete cookies through your browser. Blocking the authentication cookie prevents the signed-in service from working. This necessary authentication storage is not used for advertising.

Proposal views are recorded from requests received by our server, without tracking pixels or a separate cookie for proposal-view tracking. These events remain subject to this policy where they relate to an identifiable person. We do not currently use advertising trackers, session replay or optional marketing analytics, or provide email-open or click-tracking features.

Before introducing non-exempt optional storage or access technologies, we will provide appropriate information and obtain consent where required. This policy and acceptance of the SaaS Terms do not themselves constitute cookie or marketing consent. We will update the cookie description when the implemented settings change.

12. Your rights

Depending on the processing and applicable law, you can ask to access your personal information, correct inaccurate information, erase information, restrict processing, or receive certain information in a portable format. You can object to processing based on legitimate interests, and you have an absolute right to object to processing for direct marketing. Where processing relies on consent, you can withdraw it at any time without affecting earlier lawful processing.

These rights are not all unconditional. For example, some information may need to be retained to meet a legal obligation. We will explain any applicable restriction rather than treat it as a blanket refusal.

Contact us using section 1. We may need reasonable information to verify your identity or understand the request. We respond without undue delay and normally within one calendar month of receiving a rights request, subject to extensions or adjustments permitted by law, which we will explain where relevant. Requests are normally free of charge.

Where the request concerns information held solely on behalf of a customer, we will promptly refer it to the customer and assist it. Where it concerns our own Scout sourcing or supply, we will address our controller obligations and reasonably cooperate with the customer or relevant source provider as needed. This does not prevent you from exercising rights directly against Maison Labs in relation to processing for which we are responsible.

13. Complaints and changes to this policy

You can complain about our handling of personal information using the email or postal address in section 1. We will acknowledge a data protection complaint within 30 days, investigate and respond without undue delay, and keep you informed. You also have the right to complain to the Information Commissioner's Office, the UK's data protection regulator; information about making a complaint is available on its website.

We may update this policy to reflect changes in the service or our legal responsibilities. We will update its effective date and bring material changes to affected people as appropriate. A revised notice does not, by itself, provide a new lawful basis or authorise an incompatible use of information.