For managed charging, demand response, storage and virtual power plant enrollment · Last updated: 25 August 2026 · Version 1.0
This notice explains what information we collect when you enrol a site, home or piece of equipment — an EV charger, battery, solar system, HVAC unit or other flexible load — into an energy program delivered through GravOS, and what we do with it.
Graviti AI operates GravOS in two ways, and which applies determines who is legally responsible:
Controller: Graviti AI. Data protection contact: privacy@gravitienergy.ai. Postal correspondence address available on request.
| Category | Examples | Source |
|---|---|---|
| Enrollment & contact | Name, service address, email, phone, business name and role where applicable | You |
| Utility account | Utility name, account number, meter or service point identifier, rate schedule or tariff, service territory | You, or your utility with your authorisation |
| Energy usage data | Interval consumption and export data from your meter (typically 15-minute, 30-minute or hourly), historical billing usage, peak demand | Your utility, with your authorisation |
| Equipment & asset data | Make, model, serial number, firmware version, rated power and capacity, installation date, configuration and limits | You, your installer, or the manufacturer |
| Device telemetry | State of charge, power flow, energy throughput, voltage, temperature, availability, fault and alarm codes, connectivity status | Your equipment |
| Control & event data | Dispatch signals sent, your settings and limits, opt-outs and overrides, event participation and delivered response | Platform |
| Incentive & payment | Measured performance, incentive calculations, payment details, and tax identifiers where payments must be reported | You / platform |
| Support & communications | Messages, call notes, photographs of equipment or installation | You |
| Technical | IP address, portal or app device information, logs | Automatically |
A note on energy usage data. Interval meter data can reveal patterns about activity at a premises. We treat it as sensitive, restrict internal access to those who need it, and use it only for the purposes set out below.
Most programs require access to your utility account and interval usage data. We obtain it only after you authorise it — through your utility's data-sharing mechanism, a signed authorisation form, or an approved data platform, depending on your territory.
| Purpose | Legal basis (UK/EU GDPR) |
|---|---|
| Verify eligibility and enrol you in a program | Performance of a contract |
| Connect to and monitor your equipment | Performance of a contract |
| Forecast, optimise and dispatch your equipment within your settings | Performance of a contract |
| Measure and verify your performance in program events | Performance of a contract; regulatory obligation of the program |
| Calculate and pay incentives; meet tax reporting duties | Performance of a contract; legal obligation |
| Report aggregate capacity and performance to a utility, ISO/RTO or program administrator | Performance of a contract; legitimate interests |
| Maintain safety, protect equipment and diagnose faults | Legitimate interests; vital interests where safety is at stake |
| Improve forecasting and optimisation models | Legitimate interests, using aggregated or de-identified data wherever possible |
| Support, service messages and event notifications | Performance of a contract |
| Marketing about other GravOS services | Consent |
Participation means GravOS may send automated control signals to your equipment — for example to shift charging, discharge a battery during a peak, or curtail a flexible load. This is the service you enrolled in. Importantly:
These are operational decisions about equipment. They are not automated decisions about you that produce legal or similarly significant effects, and we do not carry out profiling of that kind. Incentive calculations follow the published program formula and can be reviewed by a person on request.
A current list of the service providers who process personal information on our behalf is available on request from privacy@gravitienergy.ai.
We do not sell your personal information and we do not share it for cross-context behavioural advertising.
We keep operational records for 24 months by default. Historical records that support settlement, audit, dispute resolution and long-term performance analysis are kept for three to five years, with the exact period set according to the requirements of the utility, program administrator or customer. Financial records are kept for longer because tax law requires it.
| Record | Retention |
|---|---|
| Enrollment and account records | While enrolled, then 24 months |
| Interval usage and device telemetry (operational) | 24 months |
| Event, dispatch and performance records | 3–5 years, as required for settlement and audit |
| Historical usage retained for program analysis | 3–5 years, depending on program and customer requirements |
| Incentive payment and tax records | 7 years, as required by tax law |
| Support correspondence | 24 months |
Program and regulatory retention rules may oblige us to keep certain records even after you withdraw. Beyond these periods we aggregate or de-identify the data.
Access, rectification, erasure, restriction, objection, portability, and withdrawal of consent at any time. You may complain to your supervisory authority — in the UK, the Information Commissioner's Office (ICO); elsewhere, your national data protection authority.
Depending on your state: to know, access, delete and correct your information; to opt out of sale, sharing and targeted advertising; to limit use of sensitive personal information; and not to be discriminated against for exercising these rights. We honour Global Privacy Control signals where required. Authorised agents may act for you with proof of authorisation.
Some rights are limited where we must retain records for program settlement, audit or legal compliance. Where we cannot fully honour a request we will explain why.
To exercise your rights, email privacy@gravitienergy.ai.
You may withdraw at any time as set out in the Program Enrollment Terms. On withdrawal we stop sending control signals and stop collecting new telemetry. We retain historical records where program rules, audit or law require, and any incentives already earned are settled under the program's terms.
We use encryption in transit and at rest, per-device credentials and identity, role-based access control, network segmentation, signed firmware and software updates, audit logging of every control action, and outbound-only device connectivity so equipment need not be exposed to the internet. If a breach affects your personal information we will notify you and the relevant regulator where the law requires it.
Energy programs are for adults who can contract for utility service. We do not knowingly collect information from children.
We may update this notice. Material changes will be notified before they take effect, and where a change affects the basis on which your data is used we will seek fresh authorisation where required.
Privacy and rights requests: privacy@gravitienergy.ai
Program support: support@gravitienergy.ai
General enquiries: info@gravitienergy.ai
Postal correspondence address available on request.