Privacy Policy — PowerView UK
Last updated 16 May 2026
1. Controller
Controller: Annalu Pomarico, Sole Trader, trading as PowerView UK, Saint Helens, Merseyside, UK. Email: annalupomarico@powerviewuk.co.uk
2. Data we process
- Account data: email, name, org name (lawful basis: contract)
- Billing data: processed by Stripe (sub-processor). We store stripe_customer_id, subscription status, current_period_end. No card numbers stored by us.
- Usage data: supplier names, REGO references, MWh volumes you upload — you are controller, we are processor
- Technical: IP (for rate limit cf-connecting-ip), user-agent, stripe_events idempotency logs retained 7 years for audit trail
3. Sub-processors
Complete register, last reviewed 17 August 2026:
- Supabase — Stores compliance data, user accounts, uploaded CSV files and the audit trail. Region: United Kingdom (London, eu-west-2). Safeguard: UK hosting — no international transfer for stored data.
- Resend — Delivers report notifications, deadline alerts and account emails from @powerviewuk.co.uk. Region: European Union (Ireland, eu-west-1). Safeguard: UK GDPR adequacy decision for the EEA; DPA in place.
- Stripe — Subscription checkout, invoicing and payment records. Card data never reaches our systems. Region: European Union / United States. Safeguard: Stripe DPA with UK IDTA and Standard Contractual Clauses.
- Cloudflare — Serves the application and API endpoints; provides the caller IP used for rate limiting. Region: Global edge network, UK/EU points of presence. Safeguard: Cloudflare DPA with UK IDTA and Standard Contractual Clauses.
4. Retention
- stripe_events: 7 years (legal obligation audit)
- subscriptions: duration of contract + 6 years
- REGO uploads: until you delete or contract ends
5. Your rights
access, deletion (except audit logs required by law), portability. Contact annalupomarico@powerviewuk.co.uk.
6. No marketing emails without consent
Transactional billing emails only.
7. Cookies
strictly necessary only — Stripe checkout, Supabase auth. No tracking. Cookie banner required.
8. Complaints
ICO — ico.org.uk