Privacy

Who we are

Nulhus Ltd is the data controller for the personal data described here. Registered in England and Wales, company number 15747694. Registered office 231 Hinton Way, Great Shelford, Cambridge, CB22 5AN. Data protection enquiries go to contact at lupa dot energy. ICO registration: C2027145.

What we collect

Account details, being a name, a work email address and a password held only as a hash.

The company name and its email domain, which is how the system knows which company a new person belongs to.

Uploaded interval data, being half-hourly meter readings for a building.

Uploaded invoices, read once and not stored.

Analysis inputs and results.

The name, email address and any notes given to book a Lupa Live onboarding call, which Calendly collects on our behalf.

Records of usage, being counts of analyses and parses against a trial allowance.

Whether any of it is personal data

Most of it is not: meter readings describe a building's electricity use, not a person. Account details and the name attached to them are personal data, as are the details given to book an onboarding call. Interval data for a very small site can in principle say something about an individual's occupancy pattern, and it is treated with the same care regardless.

Why we hold it, and on what basis

To provide the service under the contract with the customer's company.

To keep the service secure and working, and to enforce trial allowances, which is our legitimate interest.

To arrange an onboarding call that a person has asked for, which is a step taken at their request before any contract.

To meet legal obligations such as keeping accounting records.

Where it is held

In the European Union. The database, the account records and stored files are held by Supabase in its West EU region in Ireland. The contents of an uploaded invoice are an exception: they are sent to Anthropic in the United States for parsing. The details given to book a Lupa Live onboarding call are a second exception: they are held by Calendly in the United States. The full list of processors is on the security page.

Who else processes it

The list is on the security page and is kept in one place so it cannot drift.

We do not use your data to improve our product

Customer data is never used to train or improve any model, including the AI used to read invoices. Anthropic, whose API performs that reading, does not train on data sent through its API.

How long we keep it

While the account is active. After an account closes, sixty days during which a copy can be requested, then deletion within thirty days of the end of that period, with backups aging out within a further thirty days.

Uploaded invoice files are not retained beyond the request that reads them.

Accounting records are kept for six years, as required.

Your rights

Access, correction, deletion, restriction, portability, and objection to processing based on legitimate interests. Write to contact at lupa dot energy.

You can also complain to the Information Commissioner's Office at ico.org.uk, and we would rather you raised it with us first.

Cookies

This site sets none of its own. It carries no analytics and no advertising. The application at app.lupa.energy sets a session cookie, which keeps you signed in, and it is set on that address rather than this one. The Lupa Live booking page shows Calendly's scheduling page in a frame, and Calendly sets its own cookies inside that frame and shows its own cookie notice there.

Changes

Material changes will be notified to account holders by email. The date of the last change is shown at the foot of the page.

Last updated 8 October 2026.