Privacy notice

This notice explains how Helix8 Ltd (“we”, “us”), which provides Jouleo, uses personal data about people who visit this website, apply for the pilot, or sign in to Jouleo. It is written to meet the UK GDPR and the Data Protection Act 2018.

Who we are

Helix8 Ltd is a company registered in Northern Ireland (company number NI658912). Registered office: 52 The Beeches, Larne, BT40 2DW, Northern Ireland. We are registered with the Information Commissioner's Office. For anything about your data, email hello@jouleo.co.uk.

Two roles

For the people this notice covers (website visitors, pilot applicants and Jouleo users) we are the controller. Installer companies that use Jouleo decide how their own customers' data is used: for that data the installer is the controller and we are their processor, acting only on their instructions under a data processing agreement. If you are an installer's customer, contact the installer first; we will help them answer you.

What we collect and why

• Pilot applications: your name, company, work email, phone number if you give it, and what you tell us about your business. We use it to reply, assess the application and run the pilot with you. Lawful basis: our legitimate interests in responding to businesses that contact us, and taking steps at your request before entering a contract.
• Jouleo accounts: your name, email address, role, company, sign-in details, and a record of what you do in the product (kept in an audit trail). We use it to provide Jouleo under our contract with your company, keep it secure, and give support. Lawful basis: performance of a contract and our legitimate interests in running a secure service. Passwords are handled by Amazon Cognito; we never see them.
• Service and security logs: IP address, browser details and the time of requests, used to keep Jouleo secure and working. Lawful basis: legitimate interests.
• Emails with us: what you send us, used to answer you. Lawful basis: legitimate interests.

We don't sell personal data, use it for advertising, or make decisions about you by automated means that have legal or similarly significant effects.

Cookies

This website sets no cookies and uses no analytics or tracking. The Jouleo app uses only cookies that are strictly necessary to keep you signed in and protect your session, so it doesn't ask for consent.

Who we share it with

We use these service providers, each under a contract that protects your data:

• Amazon Web Services: hosting, storage, sign-in, malware scanning of uploads, and AI document reading (Amazon Bedrock). Data is stored in London (eu-west-2); AI requests are handled within EU regions.
• Resend: sending Jouleo's emails, such as invitations and notifications.
• Google: maps and roof imagery, when the designer is used.
• OpenStreetMap Foundation (Nominatim) and postcodes.io: address search, which receives the address or postcode being looked up.
• Microsoft or Google: file storage, only if your company connects its own drive.
• Stripe: billing, once paid plans start. Card details go straight to Stripe.

We may also share data where the law requires it, or with professional advisers under a duty of confidence.

Transfers outside the UK

Your data is stored in the UK. Some providers above (Resend, Google, Microsoft, Stripe) may process data in the US or EU. Where they do, the transfer is protected by UK adequacy regulations (including the UK Extension to the EU–US Data Privacy Framework) or the ICO's International Data Transfer Addendum. Email us for details.

How long we keep it

• Pilot applications that don't go ahead: 12 months after our last contact.
• Account data: while your company uses Jouleo. When a company leaves, compliance records it holds (documents, signatures and the audit trail) are kept, closed to everyone, until 6 years after its last record, then deleted. This covers MCS and consumer-code record keeping and the time limit for contract claims.
• Service and security logs: up to 12 months.

How we protect it

Data is encrypted in transit and at rest, each company's data is kept separate, staff access is limited and logged, and uploads are scanned for malware.

Your rights

You can ask us to give you a copy of your data, correct it, delete it, restrict how we use it, or send it to you or another organisation in a portable format. You can object to us using it on the basis of legitimate interests. Email hello@jouleo.co.uk; we'll reply within one month. Some rights don't apply in every case, for example where we must keep records by law, and we'll explain if so.

If you're unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We'd appreciate the chance to put things right first.

Changes

We'll update this notice when how we use data changes, and change the date at the top. If a change matters to you, we'll tell you before it takes effect.