Privacy Policy

XESS Cloud is operated by AERL Pty Ltd (“AERL”, “we”, “us”), based in Australia. This policy explains what personal information the XESS Cloud platform collects, why we collect it, and who we share it with.

The same platform is made available under other brands on their own domains. Whichever brand you see, it is operated by AERL and this policy applies to it.

Account information. Your name and email address, and your profile picture where your identity provider supplies one. You provide this by registering with an email address, or it is supplied by Google or Microsoft if you choose to sign in with one of those accounts.

Authentication data. A securely hashed password if you register with one, and a phone number if you choose to enable multi-factor authentication.

Organisation membership. The organisation you belong to, your role within it, and any restriction limiting you to particular locations.

Activity records. Records of significant actions taken in the platform, retained so organisation administrators can audit changes to their own account.

Equipment telemetry. Measurements reported by gateways and energy equipment at your sites — for example state of charge, voltage, current, power, temperature and fault status — together with the location and identity of that equipment. This is data about equipment rather than about you, but it may be associated with the organisation that operates it.

Technical and diagnostic data. IP address, browser type and error diagnostics, collected so we can keep the service secure and working.

If you sign in with Google, we request only your basic profile: your name, email address and profile picture. We use them solely to create and authenticate your account, to identify you to others in your organisation, and to send notifications you have configured.

We do not request access to your Gmail, Google Drive, Calendar or Contacts. We do not sell this information, use it for advertising, or use it to train generalised artificial-intelligence models.

XESS Cloud’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

You can revoke XESS Cloud’s access to your Google account at any time from your Google account permissions page. The equivalent applies to Microsoft accounts, from which we request only your email address.

We use the information described above to:

• create your account and sign you in;
• show you the sites and equipment your organisation has given you access to;
• send the alerts and notifications you or your administrators configure;
• provide support when you contact us;
• keep the platform secure, diagnose faults, and improve reliability.

We do not sell your personal information.

We share personal information with service providers who help us run the platform, and only to the extent they need it to perform that role:

We also share information where we are required to by law, and with your organisation’s administrators, who can see the members of their own organisation and their activity within it.

Platform data is hosted in Sydney, Australia. Some of the service providers listed above operate globally, which means limited categories of data — such as error diagnostics and email delivery — may be processed outside Australia.

We retain your account information for as long as your account remains active. If your account is deleted, we remove or de-identify the personal information associated with it, except where we are required to retain records by law.

Equipment telemetry is retained for as long as the organisation maintains its account with us. Note that retention and access are not the same thing: stored telemetry is kept indefinitely, but the platform serves queries over a rolling 90-day window, so history older than that is retained rather than routinely readable.

Access to the platform requires authentication, and multi-factor authentication is available. Data is encrypted in transit using TLS. Organisation data is isolated so that members of one organisation cannot access another’s. Access to production systems by AERL staff is restricted and logged.

You can ask us to access, correct or delete the personal information we hold about you, and you can object to or restrict certain processing. You can update most of your account details yourself from your account settings.

To make a request, or to raise a privacy concern, email us at [email protected]. If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner.

XESS Cloud is a tool for energy professionals. It is not directed at children, and we do not knowingly collect personal information from them.

We may update this policy as the platform changes. When we do, we will revise the “last updated” date above, and we will tell you directly if the change materially affects how we handle your personal information.

AERL Pty Ltd
Email: [email protected]