Privacy Policy

Last updated: 11 October 2026

This policy explains how The Superpower Institute Limited (ABN 52 663 577 142, ACN 663 577 142) (Superpower Institute, we, us) handles personal information when you use the Open Electricity API, Platform and Energy Agent (the Service).

We are a small organisation that may fall outside the Privacy Act 1988 (Cth) (the Privacy Act). We nonetheless handle personal information in line with the Australian Privacy Principles (APPs) and, for users in the EU and UK, with the rights described in section 10.

1. What we collect

Account information. When you sign up, our authentication provider collects your name, email address, sign-in method (password, or a social login such as Google or GitHub) and the company or organisation name you give us. We record when you agreed to our Terms and Privacy Policy.

Usage and API data. We record your API keys (stored hashed by our key provider), plan, request counts, endpoints called, parameters, response codes, timestamps, IP addresses and user agent, for rate limiting, billing and plan enforcement, security, abuse prevention and analytics.

Energy Agent data. We log and retain your prompts, the Agent's responses, tool calls and data it fetched, generated charts and documents, token usage and costs, and any rating or comment you give. Conversations you share are accessible to anyone with the link until you revoke it.

Support data. Messages, attachments and email addresses in support tickets and replies.

Derived and enrichment data. From your email domain and company name we may infer your organisation, sector and size, to assign the right plan, prevent abuse and understand our user base.

Technical data. Device, browser and network information, and logs recorded by our hosting and authentication providers.

Communications. Records of the emails we send you and whether you have opted in or out of marketing.

We do not knowingly collect personal information from anyone under 18.

2. How we use it

• to provide, secure and operate the Service, including authentication, API keys, plans, limits and support
• to run the Energy Agent and to log, evaluate, debug and improve its quality and safety
• to detect and prevent abuse, fraud, multiple accounts and breaches of our Terms
• to communicate with you about your account, security, changes to the Service and support requests
• to send you product news and marketing, where you have agreed or where the law allows, with an unsubscribe in every message
• to understand usage, plan the service and report in aggregate on how the data is used
• to comply with legal obligations and establish or defend legal claims

We do not sell your personal information. We do not use third-party advertising cookies or trackers.

3. Marketing emails

We send marketing emails about Open Electricity and related products from Superpower Institute. You can unsubscribe at any time through the link in any email or by emailing [email protected]. We will still send transactional messages (such as security, account, billing or support emails). We comply with the Spam Act 2003 (Cth).

4. Energy Agent and AI providers

Agent prompts and the context we send with them (such as conversation history and fetched data) are processed by third-party AI providers. We use a language model from OpenAI, accessed through OpenRouter. Our code-execution sandbox for analysis runs on Vercel Sandbox.

• Prompts and responses are logged and retained in our database for as long as your account exists, unless you delete a conversation, we delete it in the ordinary course, or you request deletion. Do not enter information you would not want stored.
• Enterprise customers can request zero data retention (ZDR). With ZDR enabled, we do not store your prompts and responses and we use provider settings that opt out of provider retention and training where the provider supports it. Basic usage metadata (for example, token counts and timestamps) is still kept for billing and rate limiting.
• We do not use your prompts to train our own models. Our AI providers' terms and settings, which we configure to limit retention and training use, govern what they do.

5. Who we share it with

We disclose personal information to service providers who help us run the Service, under confidentiality and data-protection obligations:

We may also disclose information:

• to our related entities and professional advisers
• to authorities where required or authorised by law
• to a successor in a merger, acquisition or restructure
• to anyone else, with your consent

6. Where your information is stored

Our application and database are hosted in Sydney, Australia. Some of our providers, including Clerk, Unkey, Resend, OpenRouter, OpenAI and Vercel Sandbox, process data outside Australia, mainly in the United States. By using the Service you consent to this. We take reasonable steps, such as contractual protections, to ensure overseas recipients handle your information consistently with the APPs, but we are not accountable under APP 8.1 for their handling once you have consented.

7. Security and retention

We use industry-standard technical and organisational safeguards: encryption in transit, access controls, hashed API keys and least-privilege access to production systems. No system is perfectly secure.

We keep personal information for as long as we need it for the purposes above or as the law requires, then delete or de-identify it. In general:

• account and usage data is kept while your account is active and for a reasonable period afterwards
• Energy Agent conversations are kept while your account exists, unless you or we delete them earlier
• support tickets are kept for as long as needed to resolve and for our records
• aggregated and de-identified data may be kept indefinitely

If there is an eligible data breach, we will notify affected people and the Office of the Australian Information Commissioner (OAIC) as required by law.

8. Cookies

We use cookies and similar technologies that are necessary for the Service, such as the session and security cookies set by our authentication provider and cookies that remember your preferences (for example light or dark theme). We do not use advertising cookies. You can block cookies in your browser, but sign-in will not work without the essential ones.

9. Your rights

You may ask us to:

• give you access to the personal information we hold about you
• correct information that is inaccurate, out of date or incomplete
• delete your account and personal information, subject to legal and operational limits
• stop sending you marketing

Email [email protected]. We may need to verify your identity. We will respond within a reasonable time, usually 30 days.

If you are unhappy with how we handled a privacy matter, contact us first. If you are not satisfied, you may complain to the Office of the Australian Information Commissioner at oaic.gov.au or 1300 363 992.

10. Users in the EU and UK (GDPR)

If you are in the European Economic Area or the United Kingdom, we process your personal data as a controller on these legal bases:

• contract: to provide the Service you requested
• legitimate interests: to secure and improve the Service and prevent abuse, and to market to business users, balanced against your rights
• consent: for marketing where required, and for overseas transfers where relevant. You may withdraw consent at any time.
• legal obligation: to comply with the law

In addition to the rights in section 9, you may object to or ask us to restrict processing, ask for a portable copy of data you gave us, and withdraw consent. You may also lodge a complaint with your local data protection authority. Because we process data in Australia and the United States, transfers of your data out of the EEA or UK rely on contractual safeguards (such as standard contractual clauses) with our providers, where applicable.

11. Third-party sites and the open data

The Service links to other sites that have their own privacy practices. The energy data we publish is about the electricity system and does not generally contain personal information.

12. Changes

We may update this policy. We will post the new version here with an updated date and, for material changes, notify you by email or in the Platform.

13. Contact

Privacy contact: [email protected] The Superpower Institute Limited, ABN 52 663 577 142 General support: [email protected]