Privacy Policy

How SecondWatt collects, uses, and protects personal information. Your rights, retention periods, and third-party processors.

Effective date: May 17, 2026 · Last updated: September 8, 2026

Plain-language summary

  • We run a B2B power-systems platform. We collect the data you submit and basic usage logs.
  • We load no analytics or marketing trackers until you accept them in the cookie banner. Necessary cookies (login, security) are always on.
  • When you opt in, we run Google Analytics 4 (via Google Tag Manager), loaded through our first-party subdomain tracking.secondwatt.com for reliability — they are still Google services and the same controls apply.
  • We do not sell your personal information.
  • You can withdraw consent any time via Cookie preferences, or use our contact form for access or deletion.

1. Introduction

SecondWatt LLC ("SecondWatt", "we", "us") operates secondwatt.com and related subdomains (the "Platform"). This Privacy Policy explains what personal information we collect, why we collect it, how long we keep it, who we share it with, and the rights you have over it. For details about cookies and similar tracking technologies specifically, see our Cookie Policy.

2. Information We Collect

  • Account data: name, email, company, job title, role, and password hash when you register.
  • Submission data: RFQs, listings, equipment specifications, financing inquiries, project parameters, and free-text notes you submit through forms or the Platform's tools.
  • Communications: messages you send through our contact form, chat transcripts with our help-center assistant, and email replies to mediated deal threads. Assistant conversations — from signed-in and anonymous visitors alike — are recorded and reviewed internally to improve the service; email addresses and phone numbers typed into the chat are masked before storage.
  • Usage & device data: IP address, user-agent, referrer, pages viewed, timestamps, and tool interactions, collected automatically in server and edge logs (always on, necessary for operating the site).
  • Cookie / tracking identifiers: as set out in section 6 and the Cookie Policy — only after you grant consent for the relevant category.

3. How We Use Your Information

  • To operate, secure, and improve the Platform and the mediated marketplace.
  • To match anonymized RFQs to qualified buyers and sellers.
  • To respond to inquiries, mediate transactions, and provide support.
  • To send transactional emails (account, RFQ status, deal updates) and — only with your consent — marketing communications.
  • To detect and prevent fraud, circumvention, abuse, or technical issues.
  • To comply with legal obligations and enforce our Terms of Service.

4. Legal Bases (EEA / UK)

Where GDPR or UK GDPR applies, we rely on: contract (to provide the Platform you signed up for), legitimate interests (security, fraud prevention, product improvement, B2B outreach), consent (analytics, marketing cookies, marketing email), and legal obligation (tax, AML/KYC, lawful requests).

5. Third-Party Services & Sub-Processors

We share limited personal data with the processors below, only as needed to operate the Platform. Each is bound by a data-processing agreement.

  • Supabase (Lovable Cloud) — database, auth, file storage; account, submission and communications data; no consent required (necessary).
  • Cloudflare — CDN, edge security, DDoS protection; IP and request metadata; no consent required (necessary).
  • Google Tag Manager — tag orchestration, loaded via first-party tracking.secondwatt.com; IP and container/event metadata; consent required (Analytics).
  • Google Analytics 4 — pseudonymous usage analytics, loaded via tracking.secondwatt.com; IP (truncated by Google), GA client ID, event and page-view data; consent required (Analytics).
  • Google Search Console — SEO performance reporting; aggregated query and click data; no consent required (server-side, aggregate).
  • Resend — transactional and deal-thread email delivery; email and message content; no consent required (necessary).
  • OpenAI / Google (via Lovable AI Gateway) — help-center assistant and editorial pipeline; prompt content with PII redacted before send; no consent required (necessary for feature).

We do not sell personal information. Consent-required processors (GTM, GA4) are not loaded until you accept the relevant cookie category in our consent banner.

6. Tracking Infrastructure & Cookies

We use a Consent Management Platform (CMP) to gate all non-essential tracking. The CMP records your choice in your browser's local storage and only loads the scripts for the categories you accept.

First-party tracking subdomain

Analytics tags load through tracking.secondwatt.com, a CNAME we operate that proxies to Google's tag-delivery endpoints. This improves measurement reliability against ad-blockers but does not change who processes the data — Google Tag Manager and Google Analytics 4 remain the processors, governed by Google's terms and our DPA with Google. We do not use this subdomain to bypass your consent choice; if you decline Analytics, no tags are fired from tracking.secondwatt.com either.

CMP-managed cookies and identifiers

  • sw_cookie_consent — SecondWatt CMP, Necessary, legacy consent flag, 12 months.
  • sw_cookie_consent_v2 — SecondWatt CMP, Necessary, per-category consent choices, 12 months.
  • Supabase auth session — secondwatt.com, Necessary, keeps you signed in, session / 30 days.
  • _ga, _ga_* — Google Analytics 4, Analytics, distinguishes users and sessions, up to 13 months.
  • _gid — Google Analytics 4, Analytics, distinguishes users, 24 hours.
  • GTM container cookies — Google Tag Manager, Analytics, tag delivery and debug, session.

Specific cookie names set by Google may change as those vendors update their SDKs. The categories and consent requirements above remain authoritative. For the full live inventory, see the Cookie Policy.

7. International Transfers

Data is processed in the United States. For transfers from the EEA, UK, or Switzerland, we rely on Standard Contractual Clauses or equivalent safeguards executed with the relevant processor.

8. Data Retention

We retain personal data only as long as needed for the purpose it was collected, then delete or anonymize it. Default retention windows:

  • Active account profile — life of account + 30 days after deletion request.
  • Inactive account (no login > 24 months) — notified, then deleted after 30 days.
  • RFQs and deal communications — 7 years (commercial recordkeeping).
  • Listings (active and expired) — 3 years from last update, then anonymized.
  • Analytics events (GA4) — 14 months.
  • Server / edge access logs — 90 days.
  • Help-center chat transcripts — retained indefinitely (deleted on request).
  • Email marketing list — until unsubscribe + 30 days.
  • Backups — rolling 35 days, then overwritten.

Longer retention may apply where required by law (tax, AML, litigation hold) or to defend legal claims.

9. Security

We use TLS in transit, encryption at rest for the application database, role-based access control, audit logging on admin actions, and least-privilege service credentials. No system is perfectly secure; if you believe your account has been compromised, contact us immediately.

10. Your Rights

Depending on your jurisdiction (GDPR, UK GDPR, CCPA/CPRA, or similar), you may have the right to:

  • Access a copy of the personal data we hold about you.
  • Correct inaccurate or incomplete data.
  • Delete your data ("right to be forgotten"), subject to legal retention exceptions.
  • Port your data to another service in a machine-readable format.
  • Restrict or object to certain processing (e.g., marketing).
  • Withdraw consent for cookies, analytics, or marketing at any time.
  • Opt out of sharing personal information for cross-context behavioral advertising (CCPA/CPRA) — we do not currently engage in this, but the right remains.
  • Lodge a complaint with a supervisory authority.

We do not discriminate against you for exercising these rights.

11. How to Submit an Access or Deletion Request

  1. Submit our contact form with the topic "Privacy request" and state whether you want access or deletion.
  2. Include the email address associated with your account and a brief description of what you want (full export, deletion, correction of a specific field, etc.).
  3. We will verify your identity by sending a confirmation link to the account email. If the request is made by an authorized agent, we may require additional proof.
  4. We respond within 30 days (extendable by 60 days for complex requests, with notice). Verified deletion requests are completed in production systems within 30 days; backups roll off within 35 days thereafter.
  5. For cookie-level controls, use the Cookie preferences modal or the "Cookie preferences" link in the site footer.
  6. To unsubscribe from marketing email, use the unsubscribe link in any marketing message or visit /unsubscribe.

Some data may be retained where we have a legal obligation, an active dispute, or a legitimate-interest basis to keep it (e.g., deal records under commercial-law retention). We will tell you what is retained and why.

12. Children

The Platform is intended for power-systems professionals and is not directed to children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will delete it.

13. Changes to This Policy

We may update this Privacy Policy as our processing changes. Material changes — including adding a new tracking vendor or sub-processor — will be reflected in the "Effective date" above and, where appropriate, by re-prompting the cookie banner or sending an email notification at least 30 days before they take effect.

Version history: v4 (September 8, 2026) — removed RB2B (Retention.com) visitor identification; the vendor is no longer used and its script no longer loads. v3 (August 31, 2026) — added RB2B's visitor-identification and email-marketing disclosure. v2 (May 17, 2026) — expanded tracking disclosure for tracking.secondwatt.com, GA4, and CMP-managed cookies. v1 (May 13, 2026) — initial release.

14. Contact

Questions, requests, or concerns: send us a message.