Privacy Policy

1. Who this applies to

Most of our users are solar installation businesses (our "Customers") who use the Platform to design and stamp residential solar, storage, and generator plansets for their own customers (the "Homeowners"). This Policy describes how we handle:

• Information about you as our Customer (your account, your projects, your messages with our PE team).
• Information about Homeowners and project sites that you upload to or generate within the Platform.
• Information about visitors who use our public calculators, contact forms, or homeowner intake.

For Homeowner information uploaded by a Customer, the Customer is the data controller and we act as a processor under the Customer's instructions and our Terms of Service.

2. Information we collect

Account information

When you request access or create an account, we collect your name, work email, company name, role, residential project volume, current planset workflow, and similar vetting information.

Project information

When you create a project in the Platform, we collect or you upload:

• Site address, roof geometry, satellite imagery, and AHJ jurisdiction.
• Equipment selections (panels, inverters, batteries, generators, racking, OCPDs, conductors, and related metadata).
• Electrical topology, single-line diagrams, conductor schedules, OCPD assignments, ground paths, and other design artifacts the Platform generates from your inputs.
• Homeowner names, addresses, and other Homeowner-identifying information that appears on the planset.
• Site photos, equipment datasheets, prior plans, and other documents you upload.
• Communication threads with the reviewing PE.

Public calculator and intake submissions

When you submit a public engineering calculator, contact form, or DIY homeowner intake, we collect the form fields you provide (which can include name, email, project address, AHJ, and free-form messages) and the input values you entered into the calculator.

Usage information

We collect technical information about how the Platform is accessed, including IP address, browser type, device type, referring page, pages and features used, and timestamps. This is used for security, debugging, abuse prevention, and aggregate usage analytics.

Cookies and similar technologies

We use a small number of cookies and similar storage technologies for authentication (keeping you signed in), session management, and basic product analytics. We do not use cookies for cross-site advertising. You can disable cookies in your browser; some features may not work without them.

3. How we use your information

We use information for the following purposes:

a. Delivering the Service

To operate the Platform, route projects to PEs for review, generate stamped deliverables, communicate with you about your projects, process payments, provide customer support, and meet our obligations under your Terms of Service.

b. Improving our products

To operate, develop, evaluate, and improve the Platform's AHJ rule engine, design-check engine, equipment library, auto-string, auto-connect, auto-routing, AI-assisted design features, and related capabilities. This includes using Customer project data to refine code-compliance checks and to surface patterns that improve future designs.

c. Training AI and machine-learning models

We may use project data to train, fine-tune, evaluate, and operate machine-learning models that power features of the Platform, including AI-assisted equipment selection, electrical-design suggestions, code-compliance prediction, and natural-language interfaces. We do not sell or share identifiable project data with third-party AI vendors for their own model training.

d. Aggregated and de-identified data

We create and use aggregated and de-identified data derived from project information for analytics, industry benchmarking, research, publication of anonymized insights, and continued product development. Aggregated and de-identified data does not identify you, your company, or any Homeowner, and is no longer treated as personal information under this Policy.

e. Communications

We send service-related emails (project status, PE replies, account notices, security alerts) and, with your consent, occasional product updates. You can opt out of marketing emails at any time via the unsubscribe link or by emailing hello@solardesignlab.com. You cannot opt out of service-related emails while your account is active.

f. Legal and compliance

To comply with applicable law, respond to lawful requests from regulators and AHJs, enforce our Terms of Service, protect the security and integrity of the Platform, and meet our professional record-keeping obligations as a Florida engineering practice.

4. When we share your information

We share information only as follows:

• With the assigned PE and engineering team so they can review, stamp, and respond to your projects.
• With AHJs and permit offices to the extent the deliverables we generate are submitted by you or on your behalf to obtain a permit.
• With sub-processors that operate parts of our infrastructure on our behalf, under contractual confidentiality and data-protection obligations. Our current core sub-processors include Supabase (database, authentication, storage, edge functions), Resend (email delivery), and Netlify (web hosting). We may add or change sub-processors over time.
• In connection with a merger, acquisition, or sale of all or part of our business, with notice to affected Customers.
• When required by law, including in response to a valid subpoena, court order, or government request.

We do not sell your personal information, and we do not share identifiable project data with third-party advertisers or marketing brokers.

5. How long we keep your data

• Active accounts: we retain account and project information for as long as your account is active and as needed to provide the Platform.
• After account closure: we delete or de-identify Customer-uploaded content within 90 days following termination, except as noted below.
• Stamped deliverables and supporting records: we retain stamped plansets and the project data they were based on indefinitely, as required by Florida law and our professional record-keeping obligations under Florida Statutes Chapter 471.
• Aggregated and de-identified data: we may retain and use aggregated and de-identified data derived from your information indefinitely.
• Calculator and intake submissions: we retain these for as long as needed to follow up and for product-improvement analytics, after which they are aggregated or deleted.

6. How we protect your data

We use industry-standard administrative, technical, and physical safeguards to protect your information, including encryption in transit (HTTPS/TLS), encryption at rest for database content, role-based access control, audit logging, and least-privilege access for our team. No system is perfectly secure; we cannot guarantee that unauthorized access will never occur, and you use the Platform at your own risk to that extent.

7. Your rights and choices

Depending on where you live, you may have rights to:

• Access the personal information we hold about you.
• Correct inaccurate personal information.
• Request deletion of your personal information, subject to the carve-outs in Section 5 (notably the PE record-retention obligation).
• Opt out of marketing communications.
• Receive a portable export of your project data.

To exercise these rights, email hello@solardesignlab.com from the address associated with your account. We will respond within 30 days. We may need to verify your identity before acting on a request.

For Homeowner data uploaded by a Customer, requests should go to the Customer first; we will support the Customer in responding.

8. State privacy laws

Solar Design Lab is based in Florida and primarily serves the Florida residential solar market. We honor applicable consumer-privacy rights under state laws including the California Consumer Privacy Act (CCPA/CPRA), the Virginia Consumer Data Protection Act, the Colorado Privacy Act, the Connecticut Data Privacy Act, the Utah Consumer Privacy Act, and the Texas Data Privacy and Security Act, to the extent they apply.

We do not sell personal information or share it for cross-context behavioral advertising as those terms are defined under the CCPA. We do not knowingly process sensitive personal information as defined under those statutes; if you provide sensitive information to us, you do so voluntarily and consent to our processing it for the purposes described in this Policy.

9. International users

The Platform is operated from the United States and is intended for use by businesses operating in the United States. If you access the Platform from outside the United States, your information will be transferred to and processed in the United States. We are not currently configured to provide GDPR-grade data subject rights to residents of the European Economic Area or the United Kingdom; please do not use the Platform if that is a concern for you.

10. Children's privacy

The Platform is not directed to children under 13, and we do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a child, please contact us so we can delete it.

11. Changes to this Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date above and, for material changes, send a notice to the email associated with your account. Continued use of the Platform after a change takes effect constitutes acceptance of the revised Policy.

12. Contact

Questions about this Privacy Policy, our data practices, or your rights can be sent to hello@solardesignlab.com.