Privacy Policy

Last updated: 07 April 2026

Octary ("we", "us", "our") is committed to protecting your privacy. This policy explains what data we collect, why we collect it, how we use it, and your rights under UK GDPR and the Data Protection Act 2018.

1. Who We Are

Octary is an energy intelligence portal operated under the trading name Octary. We are not a regulated energy supplier or broker. Our contact email is energy@octary.com. You can reach our data team at the same address with the subject line "Privacy".

2. What Data We Collect

2.1 Data you provide directly

• Name and email address when you register an account
• Password (stored as a one-way bcrypt hash — we cannot read it)
• Postcode, fuel type, current supplier and annual usage when you run a comparison
• Messages you send to our AI energy advisor (Octavia)
• Professional details if you register as a broker or TPI

2.2 Data collected automatically

• IP address and browser type when you visit the site
• Pages visited and actions taken (e.g. comparisons run, tariffs viewed)
• Session identifiers stored in cookies
• API request logs if you use the Octary developer API

2.3 Data we do NOT collect

• Payment card numbers — we do not process payments directly
• Energy meter readings or smart meter data unless you explicitly provide them
• Data from third-party social networks

3. How We Use Your Data

We do not sell your data to third parties, nor do we use it for advertising profiling.

4. Cookies

We use strictly necessary session cookies to keep you logged in. These expire when you close your browser or log out. We do not use advertising cookies or third-party tracking cookies. You can disable cookies in your browser settings, but this will prevent you from logging in.

5. Data Sharing

We share data only in these limited circumstances:

• Hosting provider — your data is stored on servers provided by our hosting company, who process it on our behalf under a data processing agreement
• Anthropic (AI provider) — messages you send to the Octavia chat are processed by Anthropic's API to generate responses. Anthropic's privacy policy applies to that processing
• Octopus Energy API — your postcode is sent to the Octopus Energy public API to determine your DNO region. No personal identifying information is associated with this request
• Legal requirements — we may disclose data if required by law, court order, or to protect the safety of others

6. Data Retention

• Account data is retained for as long as your account is active, plus 12 months after deletion
• Comparison history is retained for 24 months
• AI chat messages are retained for 90 days then automatically deleted
• API request logs are retained for 12 months
• Anonymous analytics data may be retained indefinitely

7. Your Rights

Under UK GDPR you have the right to:

• Access — request a copy of the personal data we hold about you
• Rectification — ask us to correct inaccurate data
• Erasure — ask us to delete your account and associated data
• Restriction — ask us to stop processing your data in certain circumstances
• Portability — receive your data in a machine-readable format
• Objection — object to processing based on legitimate interests

To exercise any of these rights, email energy@octary.com with the subject "Data Request". We will respond within 30 days.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) if you believe we have mishandled your data.

8. Security

We take reasonable technical and organisational measures to protect your data, including encrypted HTTPS connections, hashed passwords, and restricted database access. No system is completely secure; if you believe your account has been compromised, contact us immediately at energy@octary.com.

9. Children

Octary is not directed at children under 13. We do not knowingly collect data from anyone under 13. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

10. Changes to This Policy

We may update this policy from time to time. The "last updated" date at the top of this page will reflect any changes. Continued use of Octary after a policy change constitutes acceptance of the updated terms.

11. Contact