Privacy Policy

This policy explains what personal data Voltstack collects when you visit https://voltstack.energy, sign up for early access, use the platform at https://app.voltstack.energy, or receive a business email from us, why we collect it, which providers handle it, how long we keep it, and the rights you have over it.

1. Who we are

Voltstack is operated by Voltstack Limited, a company registered in Ireland (company no. 827208) ("we", "us"). We run the public website at https://voltstack.energy and the Voltstack Platform at https://app.voltstack.energy (together, the "Service"), a workspace product for European energy-market analysis. Until 30 September 2026 the Service was provided by Rock Salt Consulting Ltd, trading as Voltstack. From 1 October 2026 it is provided by Voltstack Limited.

For your own account, early-access signups, billing, website visits and our business outreach email, Voltstack Limited is the data controller. For personal data inside a customer organisation's workspace on the Platform (member lists, workspace content, audit trails), the customer organisation is the controller and we act as its processor. This policy covers both and says which is which.

Contact for anything in this policy: hello@voltstack.energy. Our postal address is our registered office: Voltstack Limited, Office 104, Unit 9, 71 Amiens Street, Dublin 1, D01 X6T8, Ireland.

2. What we collect

Website visits (we are controller)

• Standard server logs: IP address, browser type, pages requested and timestamps, kept by our hosting provider for security and troubleshooting.
• Aggregate page-view statistics through Vercel Web Analytics. It sets no cookies and does not build a profile of individual visitors.
• How the public website is used: page views, which sections of a page came into view, clicks on buttons and links, and whether the early-access form was started, failed validation or was sent (never what was typed into it). We use PostHog for this, processed in the European Union, with no cookies, no browser storage and no session recording. Nothing ties these events to you: there is no identifier that outlives the page you are on, so a later visit cannot be linked to an earlier one.
• The public website may show different versions of a page, chosen at random each time a page loads, and the version you were shown is recorded with these anonymous events and with any early-access request you send.
• Alert and briefing settings you configure on the public dashboard (thresholds, an optional delivery webhook URL) are stored in your own browser. When an alert fires, the Service forwards the alert text to the webhook you supplied and stores nothing.

Early-access signups (we are controller)

• What you enter in the early-access form: email address, company, role, markets of interest, location, and your consent tick.
• Context we attach: the time of signup, the page you came from and any campaign tag in its URL.
• Where it goes: a signup spreadsheet in our Google Workspace, and a confirmation email to you sent through Resend. The form is rate limited by IP address; those counters live in memory and are not written anywhere.

Platform accounts and organisations (we are controller)

• Name, email address and, where provided, a profile picture, collected at sign-up through our authentication provider, Clerk. If you sign in with Google or Microsoft, we receive the basic profile those providers release (name, email address, avatar) and nothing else. We never see your Google or Microsoft password.
• Your organisation's name and identifier, and your role in it (admin, editor, viewer).
• Billing linkage: a Stripe customer identifier and your plan and subscription status. Card details go directly to Stripe and never reach our systems.
• Service emails about your account, trial or subscription, sent through Resend.

Workspace data (your organisation is controller, we are processor)

• Workspace names, layouts, widget configurations and their version history, attributed to the user who created or saved them.
• Your organisation's member list: user identifier, email address and role.
• An append-only audit trail of actions inside your organisation (who did what and when), including the IP address each request came from.

Product usage measures (we are controller)

We compute a small set of usage measures per customer organisation from its own activity on the Platform: number of seats, number of workspaces and widgets, how recently the organisation was active, and which plan-gated features it has tried to use. We use these to run trials, decide what to build, and shape pricing and account conversations. They are derived from the organisation's activity as a whole, are never sold, and are not shared with other customers.

What we do not collect

The market data shown in the Service (prices, flows, outages, storage levels, forecasts) is public infrastructure data and contains no personal data. We serve no advertising and use no advertising trackers.

Product analytics and error reporting on the Platform

When you are signed in to the Platform we record which pages and features you use (page views and clicks on the interface, never the contents of your workspaces or the data you upload), tied to your user identifier, your email address and your organisation. We use PostHog for this, processed in the European Union, with no cookies, no browser storage and no session recording. When something in the Platform fails we send the error, the route it happened on and technical details of that request to Sentry so we can fix it; this does not include your name, email, which organisation the request belonged to, or the contents of your workspaces. Sentry does not run on the public website; PostHog runs there only in the anonymous, cookieless form described under Website visits. Organisations that use the Platform under a signed evaluation or enterprise agreement have product analytics switched off unless that agreement says otherwise; their usage stays inside the Platform and is used only to provide the Service.

3. Business outreach by email

We send a few plain-text emails from andreas@voltstackenergy.com to people whose job is trading or analysing European gas or power, to introduce Voltstack and offer free sample data or a short call. Voltstack Limited is the controller, and the contact details in section 1 apply.

• What we keep: your name, the email address you use for work, your employer and role, where and when we found you, and the emails between us.
• Where it comes from: public pages such as conference speaker lists, company websites, hire announcements and the trade press, our earlier business correspondence with you, or a colleague of yours who named you in a reply to one of our emails. Some addresses are inferred from the format your employer uses, so they may be wrong.
• Who we write to: people at the work address of a firm in the United Kingdom, Ireland, Sweden or France, and only about their work.
• Why: our legitimate interest in telling people in your role about a product built for it (Article 6(1)(f) GDPR). The first email names where we found you.
• No tracking: the emails are plain text, with no tracking of opens or clicks.
• How to stop: reply to any email, or write to hello@voltstack.energy. We stop, and add your email address to a do-not-contact list so we never write to you again.
• How long: we delete outreach records 12 months after the last email between us, or within one month if you ask.

You have the rights in section 10, and you can complain to the Data Protection Commission in Ireland or to your local data protection authority.

4. Cookies

The Platform sets only the session cookies Clerk needs to keep you signed in. These are strictly necessary and cannot be switched off while using the Platform. The public website sets no cookies of its own. Analytics on the public website and product analytics on the Platform both run without cookies or browser storage. If we ever add analytics cookies we will update this section and ask for consent where the law requires it.

5. Why we process it (legal bases)

• To provide the Service you or your organisation signed up for: performance of a contract (GDPR Art. 6(1)(b)).
• To bill for paid plans and keep the records tax law requires: performance of a contract and legal obligation (Art. 6(1)(b) and (c)).
• To keep a multi-tenant system secure (audit trails, rate limiting, abuse prevention): our legitimate interest (Art. 6(1)(f)).
• To see which parts of the Platform signed-in users actually use, and to find and fix errors: our legitimate interest in improving the Service (Art. 6(1)(f)). This is never used for advertising. You can object by emailing us.
• To send early-access communications after you sign up for them: your consent (Art. 6(1)(a)), which you can withdraw at any time by emailing us.
• To send service emails about your account, trial or subscription: performance of a contract. These are not marketing emails.
• To send business outreach email to people whose job is European gas or power trading or analysis: our legitimate interest in telling them about the Service (Art. 6(1)(f)), explained in section 3. You can object at any time and we will stop.

6. Providers we use

We use the following providers to run the Service and our business outreach, and share with each only what it needs.

We do not sell personal data and do not share it with anyone else, except where the law requires it or to protect the Service and its users.

7. International transfers

Several of the providers above are United States companies. Where personal data goes to one of them from the EEA or the United Kingdom, we rely on the provider's certification under the EU-US Data Privacy Framework (and its UK extension) where it holds one, and otherwise on Standard Contractual Clauses in our agreement with that provider; copies of those safeguards are available on request.

8. How long we keep it

• Early-access signups: until you ask us to delete them or until we close the early-access programme, whichever comes first.
• Account and organisation data: for the life of the account or organisation.
• Workspace data, member lists and the audit trail: for the life of the organisation's tenancy. The audit trail is append-only by design while the tenancy is active.
• Billing records: for as long as tax and accounting law requires.
• Business outreach records: deleted 12 months after the last email between us, or within one month of a request to delete them. Do-not-contact entries: for as long as we send outreach email.
• Deletion: when an organisation is deleted its tenancy is suspended and cut off from access immediately, and its database is permanently deleted within 30 days of a written request from an organisation admin. Backup copies may persist for a short period after deletion and are then overwritten.

9. Security

Tenant isolation is structural: each customer organisation gets its own PostgreSQL database with its own credentials, cross-tenant access is blocked at the database permission layer and covered by automated tests, and stored database credentials are encrypted. Connections use TLS. Access inside an organisation is role-based and every change is written to an append-only audit trail. API routes are rate limited.

No system is perfectly secure. If we learn of a personal data breach affecting you, we will notify affected customers without undue delay and, where we act as processor, within the window agreed in the customer's data processing terms.

10. Your rights

If you are in the EEA or the UK you can ask us for access to, correction of, deletion of, or a copy of your personal data, ask us to restrict or object to its processing, withdraw consent where consent is the basis, and complain to a supervisory authority. Write to hello@voltstack.energy. Our lead supervisory authority is the Data Protection Commission (Ireland). You may also complain to the authority in the country where you live or work; in the UK that is the Information Commissioner's Office (ICO). If your data sits inside a customer organisation's workspace, we may redirect the request to that organisation, since it is the controller, and we will help it answer.

11. Changes

We will post changes here with a new effective date. For material changes we will email account owners before they take effect.