EU & UK compliance notice
How H2Hub handles personal data, AI transparency, EU consumer rights and third-party professional introductions for users in the EEA and the UK.
Last updated 9 August 2026
Document control
- Version
- 1.1
- Last reviewed
- 9 August 2026
- Next scheduled review
- 9 February 2027
- Scope
- EU & UK compliance registers
Reviewed on change as well as on schedule: this document is re-issued whenever an AI model, AI feature, subprocessor, hosting region or transfer mechanism changes.
This notice supplements our Privacy Policy and Terms of Service for users in the European Economic Area, Switzerland and the United Kingdom. It is a description of our practices, not legal advice.
1. Controller and contact
SwitchtoSolar Online MKT, LLC (H2Hub — ReneEnergy.com) is the controller for personal data processed through https://h2hub.reneenergy.com. Privacy requests: contact@reneenergy.com. We are established in the United States and process EEA/UK personal data under Art. 3(2) GDPR where we offer the service to users in those territories.
2. What we process, why, and for how long
| Category | Data | Legal basis | Retention |
|---|---|---|---|
| Account and access | Name, email address, authentication identifiers, plan/entitlement status. | Art. 6(1)(b) — performance of the contract. | For the life of the account, then deleted within 90 days of closure. |
| Billing and subscription | Billing contact, subscription and invoice records, payment status (no card numbers). | Art. 6(1)(b) contract and Art. 6(1)(c) legal obligation (tax/accounting). | Retained for the statutory accounting period (typically 7 years). |
| Project records and uploaded documents | Project definitions, technical assumptions, scenarios and any files you upload — which may contain names, signatures or contact details of third parties. | Art. 6(1)(b) — provision of the analysis you requested. You are responsible for the lawfulness of personal data you upload. | Until you delete the project or close the account; deleted from backups within 30 days. |
| Product and security logs | IP address, device/browser information, timestamps, error and request logs. | Art. 6(1)(f) — legitimate interest in service security and reliability. | Up to 12 months. |
| Marketing email | Email address, engagement events. | Art. 6(1)(a) — consent. Withdraw at any time via the unsubscribe link or email preferences. | Until consent is withdrawn. |
| AI feature usage | Prompts and context sent to AI providers, plus generated output. | Art. 6(1)(b) — provision of the AI feature you invoked. | Prompt/response logs kept up to 30 days for abuse prevention and debugging, then deleted. |
3. Uploaded project material
Files you upload — offtake drafts, term sheets, permits, correspondence — often contain personal data such as names, roles, signatures and contact details of third parties. We process that material solely to produce the analysis you requested. You remain responsible for having a lawful basis to upload it, and for informing the individuals concerned where required.
Details of isolation, AI use, retention and deletion are set out in our project data confidentiality policy.
4. Your rights
- Access, rectification and erasure of your personal data.
- Restriction of processing and objection to processing based on legitimate interests.
- Data portability for data you provided under contract or consent.
- Withdrawal of consent at any time (marketing email, non-essential cookies).
- Complaint to your local supervisory authority, or the UK ICO.
Email contact@reneenergy.com and we will respond within one month. We do not make decisions about individuals by solely automated means with legal or similarly significant effects. H2Hub's models evaluate projects, not people.
5. Subprocessors and international transfers
Personal data is transferred to the United States for hosting and AI processing. Transfers rely on Standard Contractual Clauses (Art. 46 GDPR) in each processor's data processing agreement, supplemented by technical measures (TLS in transit, encryption at rest, row-level access control, and minimisation of what is sent to model providers). Where a US processor is additionally certified under the EU-U.S. Data Privacy Framework, that is noted below; we do not rely on the Framework alone.
| Subprocessor | Purpose | Personal data received | Location | Transfer mechanism |
|---|---|---|---|---|
| Supabase (database, authentication, storage, edge functions) | Account records, project records, uploaded files, application logs. | Name, email, auth identifiers, IP/request logs, any personal data inside uploaded project files. | United States | Standard Contractual Clauses (Art. 46 GDPR) via the provider's DPA. |
| Stripe | Subscription checkout, billing and payment records. | Billing name, email, country, subscription and invoice records. H2Hub never receives card numbers. | United States / EU | Standard Contractual Clauses; Stripe is certified under the EU-U.S. Data Privacy Framework and acts as an independent controller for payment data. |
| Brevo | Transactional and newsletter email delivery. | Email address, name, delivery and engagement events. | European Union (France) | Processing within the EEA — no transfer mechanism required. |
| Lovable AI Gateway (routing to OpenAI and Google model APIs) | AI features listed in the AI system inventory. | Normally none: prompts carry project attributes. Personal data only if a user pastes or uploads it for analysis. | United States | Standard Contractual Clauses; API-tier usage — prompts are not used to train the providers' models. |
| Google Maps Platform | Site screening maps and geocoding. | IP address and map interaction data when a map is displayed. | United States | Standard Contractual Clauses; Google LLC is certified under the EU-U.S. Data Privacy Framework. |
We do not sell personal data, and we do not disclose it to third parties other than the processors above, except where required by law. Sub-processor changes are published here before they take effect.
6. Processing chain — where your data actually goes
The map below is the end-to-end chain for an EEA/UK customer: who receives what, where they sit, and the basis or transfer mechanism at each hop.
| Step | Receives | Location | Legal basis / transfer mechanism |
|---|---|---|---|
| 1. EEA/UK user's browser | Data you enter; local session token. | Your device / EEA | No transfer — data stays on your device until you submit it. |
| 2. H2Hub application (SwitchtoSolar Online MKT, LLC) | Account details, project records, uploads, support messages. | United States (controller) | Art. 6(1)(b) contract; Art. 6(1)(f) for security logging. |
| 3. Supabase — hosting, authentication, storage, edge functions | All account and project data, files, request logs. | United States | Processor under Art. 28 DPA + Standard Contractual Clauses. |
| 4. Stripe — checkout and billing | Billing contact, subscription and payment status. No card data reaches H2Hub. | United States / EU | Independent controller for payment data; SCCs and EU-U.S. Data Privacy Framework. |
| 5. Brevo — email delivery | Email address, name, engagement events. | European Union | Processor under Art. 28 DPA; processing stays in the EEA. |
| 6. Lovable AI Gateway → OpenAI / Google model APIs | Only the prompt and context for the AI feature you invoked; normally no personal data. | United States | Processor chain under Art. 28 + SCCs; API tier, no training on your content; logs deleted within 30 days. |
| 7. Google Maps Platform — maps and geocoding | IP address and map interaction data. | United States | SCCs; Google LLC is certified under the EU-U.S. Data Privacy Framework. |
Backups: database and file backups are held by our hosting provider in the United States under the same contractual safeguards. Deleted projects clear from backups within 30 days; closed accounts within 90 days, except records retained for tax or accounting.
7. AI transparency
H2Hub uses AI to generate explanations, summaries and indicative scores. We are a deployer of third-party general-purpose models, not the developer of those models. Each AI-powered function, its intended purpose, the model behind it, the data sent to it, the human oversight point and its known limitations are documented in the AI transparency notice and system inventory.
8. Intended users and EU/UK consumer subscription rights
H2Hub is offered to business and professional users — clean energy developers, engineering and advisory firms, utilities, investors and educational institutions — and not marketed to consumers. Where a subscription is nonetheless bought by a consumer in the EEA or UK, statutory distance-contract rules apply and are not replaced by our commercial 30-day satisfaction guarantee:
- Before payment you are shown the total price including any tax, the billing interval, the renewal behaviour and how to cancel.
- You have a 14-day right of withdrawal from the day the contract is concluded.
- Because access to gated data and analysis begins immediately, at checkout you consent to immediate performance and acknowledge that the withdrawal right is lost once the digital service has been fully supplied. If you have not used gated features, request a refund within 14 days and we will refund in full.
- Our 30-day satisfaction guarantee is an additional contractual offer. It sits alongside — and never limits — your statutory 14-day withdrawal right and conformity remedies.
- Digital-content and digital-service conformity remedies (repair, replacement, price reduction or termination) apply if the service does not conform to the contract.
- Subscriptions renew automatically until cancelled. Cancellation is online and takes one step; access continues to the end of the paid period.
Refund and cancellation requests: contact@reneenergy.com.
9. ExpertConnect — directory and introduction service
ExpertConnect is a directory and introduction service. H2Hub lists independent professionals and passes on your enquiry. H2Hub is not a party to any engagement, does not act as agent for either side, does not take a commission on professional fees, does not process payment between you and a professional, and does not manage scope, deliverables, quality or disputes.
Independent professionals contract directly with you under their own terms, hold their own licences, qualifications and insurance, and are solely responsible for their advice. Listings are not an endorsement, certification or ranking of competence.
10. Scope of H2Hub outputs
H2Hub supports preliminary project development. Outputs are conceptual and decision-support in nature; they do not constitute licensed professional engineering services, investment advice, or construction, permitting or financing documentation, and require independent professional review before commercial or investment decisions.
11. Review history
These registers are maintained as living documents. Each version records what changed, so the documented controls can be checked against the production system as H2Hub evolves.
Version 1.1 — 9 August 2026
Scope: EU compliance notice, AI inventory
Added version and review metadata (last reviewed / next review) and this review log so changes to the registers are auditable over time.
Version 1.0 — 9 August 2026
Scope: EU compliance notice, AI inventory, subprocessor register, processing chain
Initial published registers: AI system inventory (purpose, model, inputs, outputs, affected users, personal data, oversight, limitations), EU→US processing-chain map, subprocessor register with transfer mechanisms, retention and backup-deletion timelines, B2B intended-user statement and statutory withdrawal-right separation.