Privacy Policy

1. Who we are

Norexis is an energy identity platform for consumers in Kerala, India. We provide tools for managing home electricity, solar systems, battery storage and electric vehicles from a single account. References to "Norexis", "we", "us" or "our" in this policy refer to the Norexis platform and its operators.

2. Data we collect and why

We collect personal data only when it is necessary to provide the service you have asked for. The categories of data we may collect include:

• Account information: Your name, email address and mobile number — to create and manage your account.
• Energy asset details: Consumer numbers, asset identifiers, installation dates and system specifications — to build and manage your energy profile.
• Documents: Warranty certificates, ownership documents and installation records you choose to upload — stored in your private vault.
• Usage data: How you use the platform — to improve the service and fix issues.
• Communications: Messages you send to our support team — to respond to you.

We do not collect financial payment data, government identity numbers or biometric data at this time.

3. How we store your data

Your data is stored on infrastructure provided by Cloudflare, Inc. Documents are stored in Cloudflare R2 object storage and are accessed only via time-limited signed URLs. All data in transit is encrypted using TLS. All data at rest is encrypted by the storage provider.

We do not transfer your personal data outside India except where necessary to provide the service (such as the use of Cloudflare's global infrastructure). Where such transfers occur, appropriate safeguards are in place.

4. Your rights under DPDP Act 2023

As a data principal under the Digital Personal Data Protection Act 2023, you have the following rights:

• Right to access: You can request a copy of all personal data we hold about you.
• Right to correction: You can request correction of inaccurate or incomplete personal data.
• Right to erasure: You can request deletion of your personal data and account at any time.
• Right to portability: You can request your data in a portable, machine-readable format.
• Right to withdraw consent: You can withdraw consent for any processing at any time.
• Right to grievance redressal: You can lodge a formal grievance if you believe we have not complied with the Act.

5. Consent management

When you create a Norexis account, you provide consent for us to process your personal data as described in this policy. You may withdraw consent at any time by contacting us at privacy@norexis.ai. Withdrawing consent may affect your ability to use some features of the service.

6. Data sharing

We do not sell, rent or trade your personal data to any third party. We do not use your data for advertising. We may share data with service providers who help us operate the platform (such as infrastructure providers) under strict data processing agreements. We will only share your data with others if required by law or with your explicit consent.

7. Retention

We retain your personal data for as long as your account is active or as long as needed to provide you with the service. When you delete your account, we will delete or anonymise your personal data within 30 days, except where we are required to retain it by law.

8. Contact for privacy queries

For any privacy-related requests or questions, contact us at privacy@norexis.ai.

To lodge a formal grievance, contact our Grievance Officer at grievance@norexis.ai. Grievances will be acknowledged within 3 working days and resolved within 30 days.

9. Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via email or a notice in the platform. Continued use of the service after changes constitutes acceptance of the updated policy.