Energy privacy notice

Published 25 September 2026.

Who is responsible

FeasibilityLab is a trading name operated by an individual sole trader established and operating in England and Wales. We are the controller for personal information processed for this service. Our correspondence address is 55 Percival Road, Enfield, EN1 1QS, England. Our published ICO registration reference is ZC149718.

Contact hello@feasibilitylab.co.uk, or mark a contact-form message “Data Rights Request”. This notice covers the Home Energy Optimiser free check. Planning Check has a separate notice.

Running your check

We use your postcode, selected address, EPC information and answers to produce your result. A postcode search goes through our server to MHCLG to find certificates and to postcodes.io to confirm country and local authority. We send the selected certificate reference to MHCLG to obtain its record. We do not forward your browser's IP-address headers to these lookup services.

You can enter details manually and correct them for the current visit. Property details and answers remain in the journey's browser memory. We do not create an account or save or email a customer-linked result. Restarting or closing the journey can lose these details. We do not change the public register.

We rely on our legitimate interests in providing the information service you request. We limit the use to the check rather than building a property-linked customer or marketing profile. Public EPC data may still be personal information. Hosting and security providers process connection information, including IP addresses; no saved result does not mean no server processing.

Optional emails

You can separately choose an early-access announcement or updates about HEM/EPC developments and Home Energy Optimiser assessment options. Both permissions are optional and unchecked. You can obtain a result without either.

We record your email address, chosen purpose, exact permission and collection-notice wording and versions, capture time, source form, record identifiers, review status and expiry. We keep these in Google Sheets separately from your property, EPC, result and analytics reference.

Email marketing relies on your consent to the purpose you select. Withdraw at any time by emailing hello@feasibilitylab.co.uk. Withdrawal does not affect the lawfulness of earlier use. We stop the relevant marketing use and retain a minimal suppression record so you are not contacted again for that purpose. Future marketing emails will include an unsubscribe route. A Planning subscription does not authorise energy-product marketing.

Optional analytics

We ask permission before collecting statistics to improve the free check and measure which sources and campaigns lead to completed checks and sign-ups. Allow or decline when asked, or change your choice in Analytics settings. The check and email sign-up work either way.

When allowed, events may record journey steps, broad result and rating groups, duration groups, reduced geography, allowlisted source/campaign labels, sign-up categories and official-guidance links selected. They contain no name, email address, property address, full postcode, certificate reference or raw answers. We do not send an IP address to the custom analytics Sheet. The server still processes connection information for security.

A random tab reference and event identifiers prevent duplicate counting. Session storage holds these counting details and your versioned permission choice and time for that tab's session. We only count activity after permission; earlier activity is not replayed. Declining or withdrawing stops future collection and clears the local counting reference. It does not delete statistics already received. We honour Do Not Track and Global Privacy Control for custom events.

We rely on consent for these optional statistics. They are stored through Google Apps Script in Google Sheets, separately from email permissions. There are no advertising pixels or retargeting in this feature. Custom analytics settings do not switch off essential security processing or separate hosting traffic reports.

Support, security and permission evidence

When you contact us, we process your name, email address, message and related correspondence to answer it. Contact-form submissions use Google Sheets and Apps Script and generate a notification to our Google Gmail inbox. Apple iCloud Mail receives email sent directly to our support address. We rely on legitimate interests in answering enquiries and running a secure service.

Security processing includes short-lived abuse counters derived from IP addresses using a secret-keyed hash. These identifiers are pseudonymous, not anonymous. Infrastructure providers may also process raw connection information. We rely on legitimate interests in preventing misuse and maintaining availability.

We keep necessary permission evidence and suppression information for accountability, handling complaints and respecting withdrawals. We rely on legitimate interests in demonstrating and enforcing those choices, rather than continuing withdrawn marketing consent.

Providers and international processing

Provider	What it does for this service
Netlify	Hosts the website, handles requests, supports abuse controls and provides separate hosting traffic reports.
MHCLG	Receives certificate searches and provides public EPC records.
postcodes.io	Receives postcode lookups to establish country and local authority.
Google Workspace Sheets and Apps Script	Store email-permission and contact records and optional custom statistics. These records remain separate.
Google Gmail	Receives contact-form notifications for the site operator.
Apple iCloud Mail	Receives and stores support email and related correspondence.

Provider processing may take place outside the UK. Netlify publishes a data-processing agreement with UK transfer provisions. We use a Google Workspace account for the Sheets and Apps Script records described above and have accepted its Cloud Data Processing Addendum. The relevant Google agreement includes transfer safeguards. Our separate Gmail notification inbox and Apple iCloud support inbox are not covered by that Workspace acceptance. Their provider privacy terms describe international processing and transfer arrangements. Contact us for information about the safeguards relevant to your information.

Retention

Information	How long we keep it
Property details and answers	In browser memory for the active journey; no saved customer result.
Raw analytics events	Eligible for aggregation and removal after one hour. Event processing and hourly cleanup remove them; failed or delayed jobs can delay removal.
Duplicate-event identifiers	Expire after 24 hours and are removed during processing or cleanup.
Aggregate statistics	Up to 90 days after the reporting period ends. Whole periods may be removed earlier if storage fills. This is not 90 days from each individual event.
Email permission	Usable for no more than 24 months from capture, ending earlier on withdrawal or when a one-off purpose is completed. Expiry stops eligibility; it does not itself delete the evidence.
Never-used email permission	Identifying records are removed at the first monthly review after 24 months, no later than 25 months, unless a documented dispute needs limited retention.
Evidence of permission used	Three years after the later of last send or withdrawal, then removal at the next monthly review. Any extension for an active dispute is justified and recorded.
Suppression	The minimum keyed email identifier, purpose and withdrawal time while needed to prevent unwanted marketing; necessity is reviewed annually.
Support correspondence	Normally up to 24 months after resolution, with justified exceptions recorded.
Abuse counters	Minute-long counting windows. Scheduled cleanup removes expired remote keys after a grace period; delays or backlogs can extend storage. In-memory fallback counters expire separately.

Hourly analytics totals have no geography. Some daily groups use local authority; outward-code groups are monthly. Reports withhold small groups, and cleanup reduces or removes small closed geography groups.

Monthly review handles consent and support disposal; hourly analytics cleanup does not delete these records. Provider logs, histories and backups have separate retention and deletion processes. Removing an active record does not guarantee its immediate removal from every provider copy. We handle necessary incident or dispute records separately and review their continued need.

Your rights and choices

Depending on the circumstances, you may request access, correction, deletion, restriction or portability of your personal information and object to processing based on legitimate interests. You can withdraw email permission and optional analytics consent independently. Contact us using the details above; we may need proportionate information to verify your identity or locate the relevant record.

We respond without undue delay and normally within one month, subject to the applicable legal rules for verification, clarification and extensions. We explain any justified extension or refusal. You can complain to the Information Commissioner's Office.

The check automatically applies rules to provide information. It does not decide housing eligibility, issue a certificate or make an official compliance determination. We do not need to identify you to give a result, and will not collect extra identifying information solely to re-identify statistics that no longer identify you.

We will date this notice and explain material changes.