Energy Incident Register

Privacy policy

Last updated 23 October 2026.

This page says what personal data we collect, why, how long we keep it, and what your rights are. We collect as little as we can.

1. Who is responsible

The Energy Incident Register is the data controller. Contact: privacy@energyincidentregister.com or info@energyincidentregister.com.

2. What we collect and why

  1. Incident submissions. Your name, email address and role, plus the incident text. We use them to review the submission, ask follow-up questions, and tell you the outcome. Legal basis: our legitimate interest in running the register, and your consent when you submit. Submitter details are never published and are separated from the published entry by database access rules.
  2. Accounts. Email address, password (stored as a hash by Supabase), sign-in times, and your plan status. We use them to run your account and provide what you paid for. Legal basis: contract.
  3. Your activity as a member. If you have an account, or you get our alerts, we keep a short note of what you use on the register: the entries and pages you open, how long you spend on a page (to the nearest fifteen seconds, capped), when you sign in, the price boxes you open and the pay buttons you press, the filters you pick (such as a technology, a country or a company), exports, questions to Ask the register (which records were cited, not the words you typed), training lessons and quizzes, crew briefings you open, certificate downloads, edits you propose, and changes to your watchlist. For an account it is linked to the account; for alerts it is linked to your subscription, through a code in the links in our emails that this browser remembers. We never keep what you type into search. We use it to make our emails to you more useful, for example tips on parts of the register you have not tried yet, and to improve the product and our plans. If a writing service helps word those tips, it gets only counts and filter names, never your name or email address. It is kept for 90 days, then deleted, and sooner if you unsubscribe or close your account. Visitors who have not signed up are only ever counted. Legal basis: legitimate interest.
  4. Incident alerts. Email address, the page you signed up on, confirmation and unsubscribe times. We use them to send the alerts you asked for. Legal basis: consent. We also email alert readers about the register's paid records and plans, at most once a week and three times in all, as the sign-up form says (see emails about the paid plans below). The stop link in each of those emails ends them and your alerts carry on. Every email has an unsubscribe link. If you give your job title after confirming, we keep it with your subscription. When you sign up with a work address, we read the public website of that organisation to see what it does and whether the register names it, so that what we send you is relevant. We look up the organisation only, never you. Legal basis: legitimate interests.
  5. Emails about the paid plans. If you get our alerts, have an account, or confirmed a free answer by email from Ask the register, the editor may send you short emails about the register's paid records and plans: at most once a week and three times in all. If you signed up for alerts before 20 October 2026, it stays at most once a month, as the form said then. Reminders about your own unfinished order or a pass that is ending are not counted. A work address also gets a short welcome note after you confirm and, about a week later, one follow-up; no two of these emails come in the same week. Each one has a one-click link that stops them (your alerts carry on), and a reply stops them too. They end as soon as you buy a plan. To choose what to write about, we use your activity on the register (the pages and records you open and the price boxes you look at, as described above) and, for a work address, the public website of your organisation: what it does and where. We look up the organisation, never you, and the emails never say what you opened. Legal basis: legitimate interests, for similar services from the register.
  6. Email opens. When our mail provider tells us that one of our emails was opened or that a link in it was clicked (welcome, briefing, digest and other mail we send), we keep the time with the send id and your address, and for a click the page path only, so we can see which emails are useful and improve them. We do not store your IP address or browser string from that event. Kept for 90 days, then deleted. Legal basis: legitimate interest.
  7. Payments. Stripe collects your card details and billing address. We never see the full card number. We store the Stripe customer and subscription identifiers and your plan status. If the link that brought you to the site carried a campaign tag (for example the name of an event), or another website referred you, we record that tag or that website name with the subscription, so we know which channels work. It is carried in the page address, nothing is stored on your device to do it, and it does not identify you. Legal basis: contract, and legal obligation for tax records; legitimate interest for the campaign tag.
  8. Checkouts you start. When you start a checkout, we keep the email you give (on the card page, or one you gave the register before) with what you were buying, the Stripe session and the last few pages you opened on the register (page addresses only), for 90 days. We use them for your receipt and, if you do not finish, up to two short reminders from the editor, the first about an hour later and the second about a day later, then nothing more. They stop as soon as you pay, reply or opt out. Every reminder has a link that stops them, or reply and say so. Legal basis: the soft opt-in under the Privacy and Electronic Communications Regulations (you gave the address while starting a purchase; the card page says so, with the link to opt out, and so does every email).
  9. "What stopped you?" If you answer this one question, on the site or from the link in a reminder, we keep your answer and any note you add (with any email address, link or phone number taken out), what you were buying and, if it came with a checkout, your email address in masked form only. We use it to learn what to fix. We do not store your IP address with it. Legal basis: legitimate interest.
  10. Business outreach. We write to organisations whose work the register is relevant to: companies, and parish, town and community councils about planning applications in their area. We use the contact address the organisation itself publishes (for a council, its clerk's address as shown on the council's or the district council's website), its name, and where we found the address. Every email says how to stop further emails, and a "no thanks" is kept on a do-not-contact list so we never write again. Legal basis: legitimate interest.
  11. Questions asked on the site. If you ask the register a question without a membership, we keep the question and the page, with no name or address. If you ask for that answer by email, we keep your email address with the question and the time the answer was sent, and use it to confirm your address, send that answer, make sure the free answer is given once, and (from 23 October 2026) to send you the same short emails about the register’s paid records and plans that alert readers get (see emails about the paid plans), at most once a week and three times in all. The Ask form says so before you give your address. You are not signed up for incident alerts. To keep it to one free answer, asking also keeps a random ID in your browser (in local storage, only once you ask) and a scrambled, one-way version of your IP address, never the address itself. Legal basis: our legitimate interest in answering you and improving the register; for the plan emails, the soft opt-in under the Privacy and Electronic Communications Regulations (you gave the address while asking for a free answer; the form says so, and so does every email).
  12. Correspondence. Emails you send us, so we can reply and keep a record. Legal basis: legitimate interest.
  13. Site analytics. We count visits on our own systems: how many times each page was opened per day, which website sent the visit (the site's name only, never the full address), and steps such as opening the prices, starting a checkout or making a free account (those steps are also counted per hour). Only the counts are kept. Our counter sets no cookie, keeps no ID in your browser, and does not store your IP address, your browser or your device. Your IP address is used for a moment, in memory, to stop floods of requests, and is not written down. Legal basis: legitimate interest. To leave your own visits out of the counts, open this link once in your browser; it keeps a single setting with no ID in it. This link turns counting back on.
  14. Google Analytics and Google Ads. These Google services set cookies, so they never load unless you press Allow on a notice at the bottom of the page. With your Allow, Google Ads may tell us that a visit which came from one of our adverts went on to sign up for alerts or buy, with the amount paid, so we can see which adverts are useful. No name or email address is sent to Google. If you have not seen that notice, they are not in use and no Google script loads. Press No thanks and they stay off. Legal basis: your consent. You can change your choice at any time: .
  15. Organisation of a visit. When a page loads, we look up which network the visit came from in a public table of networks, and if that network belongs to an organisation (a company, a university, a public body) rather than a home broadband, mobile, hosting or cloud provider, we record the organisation's name, the page and the website that referred you. Your IP address is used only for the lookup and is not stored. We do not identify individuals and set no cookie to do it. We use it to know which kinds of organisations read the register. Legal basis: legitimate interest.
  16. Server logs. Netlify and Supabase keep short-lived technical logs (IP address, request, time) for security and reliability. Legal basis: legitimate interest.

3. What we do not do

4. Who we share data with

Only the providers we need to run the service, each under their own data protection terms: Supabase (database and accounts, hosted in the EU), Netlify (hosting and functions), GitHub (code hosting and the scheduled jobs that update the register), Stripe (payments), Resend (email delivery), Instantly (business outreach email: the work email addresses and names of the business contacts it holds), xAI (text processing and review support) and Anthropic (text processing and review support, as a backup and for web search). xAI and Anthropic receive the text of public sources, and for direct submissions the incident description and the submitter's stated role, never a name or an email address. Pages also load code libraries from jsDelivr and cdnjs, map tiles from OpenStreetMap, and postcode lookups from postcodes.io; these see your IP address when they answer. Google Analytics and Google Ads load only if you press Allow (section 2). We will disclose data if the law requires it.

5. International transfers

Some providers process data outside the UK and EU. Where they do, transfers rely on the UK and EU standard contractual clauses or an adequacy decision.

6. How long we keep data

7. Your rights

You can ask for a copy of your data, ask us to correct or delete it, object to or restrict processing, and withdraw consent at any time. Email privacy@energyincidentregister.com. We reply within 30 days. You can complain to the Information Commissioner's Office (ico.org.uk) if you are unhappy with our answer.

8. Security

Data is encrypted in transit and at rest. Database access is restricted by row level security so that private columns cannot be read through the public website. Administrative access requires a separate admin role. Secret keys are held in the hosting provider's environment settings, not in code.

9. Children

The service is for professionals. We do not knowingly collect data from anyone under 16.

10. Changes

We will update this page when our practices change and note the date at the top.