Privacy Policy

Who we are and how to contact us

TopGreenDeals is a trading name of FUTURE SPIN LTD (Company No. 17006460). FUTURE SPIN LTD is the controller for the personal information described in this notice.

For privacy questions or requests, use our contact form or write to:

Information we collect and where it comes from

We collect information from you when you complete a contact or company-enquiry form, including:

• your name, email address and optional phone number;
• the service, subject, postcode and message you provide; and
• calculation details, if you choose to attach a saved calculation to a company enquiry.

We also receive limited technical and usage information from your browser when pages load, when the encrypted session cookie is used, and when security, analytics or error-monitoring services run.

Why we use information

Answer and manage enquiries

We use your details to respond, keep an enquiry record and, when you contact a company, send the enquiry to the installer you selected.

Meet legal obligations

We use information where necessary to meet legal obligations, including responding to data protection rights requests.

Operate and protect the service

We use session, abuse-prevention, notification and error information to keep the service available, secure and supportable.

Measure use of the site

Google Analytics and Ahrefs Web Analytics help us understand how people use the site and improve our calculators and directory.

Our lawful basis for providing the services you request, including calculations, optional bill reading, saved accounts and installer enquiries, is our legitimate interest in delivering and supporting those services. We also rely on legitimate interests to prevent abuse, maintain an accurate business directory and deal with complaints. Optional analytics rely on your consent, which you can withdraw through “Cookie settings”. Where processing is required by law, including handling applicable data protection rights, we rely on legal obligation.

We use enquiry details to answer and manage your request. We do not add your details to a marketing list, and an enquiry response is a service communication rather than marketing.

Energy comparison and optional bill reading

You can enter your details or have a bill read without an account. If you choose “Read my bill”, we send the bill's text or page images to OpenRouter and its AI model provider to extract energy-comparison details, including the supply address. Bills may include your name, account or meter identifiers; you can cover these before uploading. Leave the supply address visible if you want it extracted, or just the supply postcode to compare tariffs. Manual entry is available without sending a bill.

We remove our temporary bill-reading files when processing finishes. The extracted suggestions appear in your browser for you to check; details you confirm can become part of your calculation. We do not save the original bill file with your calculation. Signed-out uploads are rate limited by IP address and may use a Cloudflare Turnstile security check. OpenRouter and its model provider have their own processing and retention policies.

You can compare tariffs without an account. Home-energy calculations store the household details you enter so you can return to your results. Guest calculations use a browser cookie and expire after 90 days without an update, with expired records removed by scheduled cleanup.

When signed in, “Save to my calculations” keeps the reviewed details with your account. You can keep separate calculations and manage or delete them from your dashboard. Original bill and smart-meter CSV files are not saved with these calculations. Your sign-in email is not added to a marketing list.

Cookies, analytics and security checks

The site uses an encrypted session cookie to manage and protect your session. It is sent only over encrypted connections, cannot be read by browser scripts and expires after two weeks.

Optional analytics start only after you choose “Accept analytics”. You can reject them or change your choice using “Cookie settings” in the footer. We remember your choice for six months; calculators and enquiries work without analytics. Google Analytics uses cookies to measure visits and interactions. Ahrefs Web Analytics measures usage without analytics cookies. Both receive information such as pages visited and browser and device details when their scripts load.

With analytics accepted, we also count company profile views and clicks on website, phone and email links. Installers see aggregate totals for their own listing. These counters store no IP address, contact details, referrer or persistent visitor identifier. A click does not confirm a call, message or sale. We may link these observations and a saved enquiry using a random enquiry-journey reference for one browser tab and a broad source category, such as a browser-tool path or referral. These are best-effort signals, not proof of who visited. The browser reference expires after 30 minutes and is cleared on completion or cancellation; it is not used to count people. Raw referral URLs are not stored with these observations.

Cloudflare Turnstile is used when configured to check contact and company-enquiry submissions, and signed-out energy-bill uploads, for abuse. The browser challenge response and the server-side validation request are handled by Cloudflare.

Who receives information

• The selected installer, when you send that company an enquiry.
• Resend, which delivers service and operational emails.
• AppSignal, which processes redacted error reports and application performance traces.
• Google Analytics and Ahrefs, which receive browser analytics information.
• Cloudflare, when Turnstile is configured for an enquiry form.
• OpenRouter, which routes uploaded quote documents for AI reading to a model host that offers zero data retention and does not use them for training. The host can change between requests.
• Authorised TopGreenDeals operators and Telegram, for service notifications. Telegram notifications exclude your message and mask your contact details.

Some service providers process information outside the UK, including in the United States. Google Analytics, Cloudflare, Resend and OpenRouter include safeguards for UK transfers in their data-processing terms. You can contact us for details of the safeguards relevant to your information.

Private quote projects and competing bids

When available, the quote service stores your uploaded quote privately and uses automatic analysis to help you review its specification. After you sign in and agree to processing, locally extracted text or bounded page images are sent to OpenRouter. OpenRouter routes the document to a model host that offers zero data retention and does not use it for training (the host can change). Documents can contain personal information: remove anything unnecessary before uploading, or use manual entry instead. Automatic analysis can make mistakes; you can correct the report before sharing a brief. Operators receive technical status rather than a quote-review screen.

Quote files use separate private storage and authorised application downloads. They do not use the public company-photo storage. Each AI reading request may only go to hosts that OpenRouter lists as zero data retention, with data collection denied. Under that policy, neither OpenRouter nor the model host keeps your document after answering or uses it for training. If no such host is available, automatic analysis stops and manual entry remains available. OpenRouter and its model hosts may process information outside the UK, including in the United States. OpenRouter’s data-processing agreement includes standard contractual clauses and the UK Addendum for international transfers.

You approve the exact specification, postcode and named businesses before invitations are sent. Original documents and supplier contacts are kept private. Your original price is shared only if you include it in the preview. Your full address, email and optional phone stay private until you explicitly confirm the fields to release to one named installer. Each installer sees its own thread and bids. Quote emails contain service links rather than quote text or attachments; you can turn quote service emails off in your dashboard.

Original uploads and bid attachments expire after 30 days from upload, including abandoned attachments. Structured quotes, bids and conversations are kept for no longer than 12 calendar months from project creation; edits do not extend this period. Guest drafts expire after 24 hours. Deleting a project immediately revokes application access and removes its structured private content. Storage deletion is retried if the storage provider is unavailable. Minimal content-free delivery records follow the existing notification retention period. Deleting a project leaves your account and sign-in email in place.

You can withdraw a request to stop bidding and revoke installer attachment and contact access, or delete the project in the application. Information already viewed or downloaded by a business cannot be recalled. The service does not execute a contract or take payment on your behalf.

How long we keep information and how we protect it

The encrypted session cookie expires after two weeks. Records used to deliver and audit service notifications are deleted after one year. Company enquiries and their messages are kept while needed to handle the request and related follow-up. Once that work ends, we retain personal information only where needed for an outstanding complaint, a specific legal obligation or a justified legal claim. We review continued need at least every six months and delete or anonymise information that is no longer needed, rather than keeping it indefinitely “just in case”.

Identifiers linking installer activity to an enquiry are kept only while needed to check attribution or investigate a reporting discrepancy. We review these at least every six months and remove unnecessary identifiers and links; genuinely anonymous statistical totals may be kept for longer-term comparisons. Account information and saved calculations are kept while needed to provide your account and the records you choose to keep, with unused records included in the same review. You can delete saved calculations or contact us about deleting other records.

Enquiry review receipts contain digests and lifecycle references rather than another copy of your message or contact fields. Unsubmitted receipts expire after 30 minutes; saved-enquiry receipts remain readable in the same session for 30 days after submission. An hourly cleanup removes up to 1,000 eligible receipts per run, so an expiry is not an immediate deletion promise. This cleanup does not delete the enquiry or notification record. External services have their own retention periods; our local deletion does not automatically delete a provider's copy. We include relevant service copies and backups when handling a deletion request and explain any justified limits.

We use encrypted connections and protected session cookies, validate form submissions and limit repeated requests. We remove sensitive details from logs, service notifications and error reports, and use Turnstile checks when enabled. No method of storage or transmission is completely secure.

Your data protection rights

Depending on the circumstances, UK data protection law may give you the right to:

• ask for a copy of your personal information;
• ask us to correct inaccurate or incomplete information;
• ask us to erase or restrict the use of your information;
• object to certain uses of your personal information; and
• receive information you provided in a portable form.

Your right to object: you can object to certain processing in the circumstances set out by UK data protection law. We will consider each request and explain our response.

You do not have to provide enquiry information, but we cannot answer or pass on an enquiry without the required details. We do not make decisions about you based solely on automated processing through these enquiry flows.

To exercise a right or raise a privacy concern, use our contact form or the postal address above. You can also complain to the Information Commissioner’s Office.