Privacy Policy

Thola Energy Inc.
Effective Date: October 28, 2026
Website: https://getthola.com

Thola Energy Inc. (“Thola Energy,” “Thola,” “we,” “our,” or “us”) respects the privacy and confidentiality of the people and organizations that use our services. This Privacy Policy explains how we collect, use, protect, retain, and disclose information through our website, applications, and energy management platform (collectively, the “Services”).

1. Scope

This Privacy Policy applies to Thola Energy Inc. and the Services available through getthola.com, including facility modeling, equipment and energy records, Load Planner, AREM, Energy Log, contract-related features, and any available utility integrations, including Connect Utility. It also applies to information you provide when contacting us or participating in a pilot.

The Services are used by businesses, facility owners, operators, authorized personnel, and, where offered, individual household users. If an organization provides you access to its Thola account, it may determine which facilities and records you can use. Our processing of that organization's information may also be governed by its agreement with Thola and its instructions.

This Policy does not govern independently operated third-party websites or utilities, which may have their own privacy notices.

2. Information We Collect

The information we process depends on the features used. It may include:

• Identity and account information: names, email addresses, organization membership, roles, account settings, authentication identifiers, and records needed to manage access.
• Organization and facility information: business names, service or facility addresses, equipment inventories and specifications, electrical panels, energy sources, operating hours, and facility assignments.
• Operations and energy information: equipment schedules, Load Planner jobs, operating sessions, calculated or estimated consumption and costs, energy history, utility bills, rate and tariff information, energy contracts, and related documents.
• Authorized utility information: identifiers for the authorized utility account or service agreement, meter readings, interval usage, billing-period information, and corrections or updates made available by the utility within the approved scope.
• AREM interactions: questions, messages, selected facility context necessary to answer them, and resulting responses.
• Commercial and support information: subscription plans, payment or invoice status, customer inquiries, correspondence, and support records. Where a third-party payment service is used, its own privacy terms may also apply.
• Technical information: IP addresses, browser and device information, login and access events, diagnostic logs, and website usage information, including analytics where enabled.

We do not collect every type of information from every customer. The categories above describe information relevant to the Services, not a request for customers to provide unnecessary personal information.

3. Sources of Information

We obtain information from you; authorized organization administrators and users; your use of the Services; uploaded files; and utility or other providers that you authorize to share data with us. Limited technical information may be generated automatically through our website and systems.

You and your organization are responsible for providing information you are authorized to submit and for keeping facility and account records reasonably accurate.

4. How We Use Information

We use information as reasonably necessary to:

1. Create and maintain accounts, organizations, facilities, and authorized user access.
2. Model facility equipment and energy operations and provide usage, cost, planning, and reporting features.
3. Operate Load Planner, Energy Log, AREM, contract-related tools, and other requested functionality.
4. Retrieve and reconcile utility information when the customer has authorized a supported connection.
5. Provide support, deliver operational notifications, manage subscriptions, and communicate changes to the Services.
6. Authenticate users, secure our systems, detect errors or misuse, maintain audit records, and investigate incidents.
7. Maintain and improve the reliability and usability of the Services using information we are permitted to process.
8. Comply with legal obligations and enforce applicable agreements.

We do not treat a customer's permission to connect a utility account as unrestricted permission for unrelated uses of that information.

5. Facility-Level Privacy and Data Isolation

Each facility's information is handled within its own authorized facility context. AREM uses information associated with the specific facility selected for the user's request. It does not retrieve data from a different facility to answer that request, even if another facility is also represented in the platform.

We do not share one facility's confidential data with another facility, another customer, or unauthorized users. We do not combine unrelated facilities' records into an AREM response or expose another facility's energy, equipment, contract, or operating information to the person asking the question.

Authorized users may access only the organizations and facilities for which they have been granted permission. Limited processing by our service providers, including hosting and the OpenAI reasoning service described below, is not a disclosure to other Thola customers and remains subject to the purposes and safeguards in this Policy. We may also disclose information where required by law, as described in Section 9.

6. AREM, OpenAI, and Thola's In-House Energy Models

AREM is Thola Energy's facility assistant. It provides explanations and responses using the selected facility's authorized information and Thola's energy intelligence.

Thola builds its core energy and equipment models in-house. Our underlying energy calculations and operating models use deterministic methods based on facility configuration, equipment characteristics, operating inputs, tariffs, and other relevant data. OpenAI foundation models are used for reasoning and language assistance in AREM—not as a replacement for Thola's proprietary deterministic energy models.

When AREM needs language-model reasoning, we may transmit the user's question and the minimum relevant context from that selected facility to OpenAI through its services so that AREM can produce a response. This can include facility information necessary to address the question. We do not send data from other facilities as context for that request. OpenAI acts as a third-party technology provider for the requested reasoning function; its processing is subject to the applicable service arrangements and policies.

Thola does not use another facility's confidential information to produce your facility's answers. We do not make another customer's facility records available for your use, and we do not use OpenAI to operate or train Thola's in-house deterministic energy models. Utility information subject to additional provider restrictions will be processed for AREM only where the customer's authorization and applicable provider terms permit it.

AREM responses are decision-support information, not guaranteed measurements or professional engineering, legal, or financial advice. Users should verify material decisions against reliable records and applicable professional or safety requirements.

7. Utility Connections and Customer Authorization

Where Connect Utility or another integration is available, a customer may choose to authorize Thola to obtain specified information from a supported utility or energy provider. A connection may require verifying the utility account, service agreement, facility, authorized individual, and permitted data categories.

We request and process only the information authorized for the applicable connection and purpose. Data availability, historical periods, authorization duration, and refresh frequency depend on the utility and its rules. A utility connection is not automatic merely because a facility has been modeled in Thola.

For PG&E Share My Data, access is subject to PG&E's registration, technical approval, and the customer's own authorization. Availability of a registration page does not mean customer connections are active.

Customers may withdraw authorization through the available provider or Thola process. We will cease new processing based on a withdrawn authorization as required and coordinate any applicable upstream revocation. Processing at the utility may not stop instantaneously. Previously obtained information may remain subject to lawful retention, security, and recordkeeping needs.

Connecting a utility does not, by itself, authorize Thola to change electricity contracts, tariffs, meters, operating schedules, or equipment controls.

8. Cookies, Analytics, and Website Technologies

We use technologies necessary to support account sessions, security, preferences, and website functionality. We may use analytics to understand website performance and usage. Our application includes Vercel Analytics; its operation and any related data processing are subject to our configuration and the provider's terms.

Browser settings may allow you to restrict certain cookies or similar technologies, although doing so may affect service functionality. Where required by applicable law, we will provide additional choices for nonessential technologies.

9. When Information Is Disclosed

We may disclose information in the following limited circumstances:

• To authorized members of your organization, within their assigned access rights and facility permissions.
• To service providers that help us operate the Services, such as Google Firebase and related cloud infrastructure, Vercel, email-delivery providers such as SendGrid, and OpenAI for AREM reasoning. Such processing is limited to the services they perform for Thola.
• To utilities or other connected providers when necessary to establish, maintain, or revoke a connection you have authorized.
• To comply with law or protect rights and security, including valid legal requests, investigations of misuse, or threats to people, systems, and property.
• In a corporate transaction, such as a merger or asset transfer, subject to appropriate confidentiality obligations and applicable law.
• With your separate direction or authorization, for another disclosed purpose.

We do not sell identifiable facility or utility data, disclose one customer's facility information to another customer, or share unrelated facilities' data through AREM. We do not regard a customer-authorized utility connection as consent to sell utility information or provide it to unrelated recipients.

10. Confidentiality and Security

We use administrative and technical measures intended to protect information, including authenticated access, facility- and organization-based authorization, and protections appropriate to the systems and information involved. Sensitive utility-connection credentials and related data require additional access controls and protection before any live integration is activated.

No internet-connected service can guarantee absolute security. Users are responsible for safeguarding their credentials, limiting access to authorized personnel, and notifying us promptly of suspected misuse. Security concerns may be reported to team@getthola.com.

11. Data Retention, Account Closure, and Deletion

We retain information for as long as reasonably necessary to provide the Services, meet the purposes described in this Policy, comply with legal or contractual obligations, protect security and integrity, resolve disputes, and maintain appropriate records. Different information categories may have different retention requirements.

You may request access, correction, or deletion of information by contacting team@getthola.com. We will review requests in light of applicable law, organization administration rights, technical feasibility, security needs, and contractual requirements. Closing an account or disconnecting a utility does not necessarily delete historical information immediately; limited records may remain in protected backups, security logs, or legally required archives until their applicable retention period ends.

12. Your Choices and Privacy Rights

Depending on applicable law and your relationship to the Services, you may have rights to request access to, correction of, deletion of, or a copy of certain personal information, and to object to or restrict certain processing. You may also withdraw consent where consent is the basis for processing, subject to legal and operational limitations.

Requests can be sent to team@getthola.com. We may need to verify your identity or refer requests concerning organization-controlled data to the organization that administers the account. We will honor applicable rights and appeal or response procedures where required by law. You may also unsubscribe from optional marketing communications through the mechanism provided in those messages.

13. International Processing

Thola and its service providers may process information in the United States or other locations where they operate. If information is transferred across borders, we will apply safeguards required by applicable law or contractual commitments.

14. Children's Privacy

The Services are not directed to children under 18. We do not knowingly solicit personal information from children for independent accounts. If you believe a child has provided personal information improperly, contact team@getthola.com.

15. Third-Party Websites and Services

Links to independent websites and the services of utilities, suppliers, or other providers are governed by those parties' own practices. Thola is not responsible for their independent privacy policies. Authorization through a utility may also involve that utility's own login and consent experience.

16. Changes to This Policy

We may update this Privacy Policy as our Services, practices, or legal obligations change. We will post the updated version with its effective date and give additional notice when required by law or an applicable agreement. Changes do not retroactively create utility authorization that a customer has not granted.

17. Contact Information

Thola Energy Inc.
444 Somerville Avenue
Somerville, Massachusetts 02143
United States
Email: team@getthola.com
Website: https://getthola.com

Please include enough information in your inquiry for us to understand and respond to your request, but do not send passwords, private keys, or sensitive utility credentials by email.