Privacy Policy

This policy explains how Energy Panda (“we,” “us”) collects, uses, shares, and protects personal data when you use our website and services. It applies to our own processing. It does not cover how a retail electric provider (REP), utility, or other third party handles data you provide to them directly — those companies have their own policies.

You give us:

• Identity and contact details — name, email address, phone number, service and billing address.
• Sensitive identifiers — date of birth, driver's license number, and in some cases the last four digits or full Social Security number, where a REP requires them for identity verification or a credit check.
• Service details — your ESIID (meter identifier), current provider, plan selection, usage estimates, and your electronic signature authorizing enrollment.
• Documents you upload, such as a copy of a bill.
• Support messages and correspondence.

We collect automatically: device and browser information, IP address, pages viewed, and similar log data.

Payment data: card payments are processed by Stripe. We receive confirmation and limited details such as the card brand and last four digits. We never receive or store your full card number.

A Social Security number, driver’s license number, and date of birth are sensitive personal data under the Texas Data Privacy and Security Act. We collect them because a retail electric provider must verify who is requesting service before it can enroll them, and we submit that verification on your behalf. We ask only for what is required for that purpose and a related credit check, and only with your consent, which you give when you submit your signup.

You may decline. If you do, we may be unable to complete an enrollment that requires it. We do not use sensitive data for advertising, profiling, or any purpose beyond the enrollment and verification described here.

• To compare plans and produce savings estimates.
• To select an electricity plan on your behalf and to submit and manage the enrollment request with that provider.
• To verify identity and prevent fraud.
• To bill and administer your membership.
• To provide support, send service and transactional messages, and respond to you.
• To operate, secure, debug, and improve the service.
• To comply with law and enforce our terms.

We disclose personal data only as follows:

• The retail electric provider we select on your behalf, and the transmission and distribution utility serving your address, to verify your identity and process enrollment and service.
• Service providers acting on our behalf under contract — payment processing, cloud hosting, key management, email delivery, and customer support tooling — limited to what each needs.
• Legal and safety — where required by law, subpoena, or regulator, or to protect our rights, users, or the public.
• Business transfers — in a merger, acquisition, financing, or sale of assets, subject to this policy.

We do not sell your personal data, and we do not process it for targeted advertising or for profiling that produces legal or similarly significant effects about you.

• Sensitive identifiers are encrypted at rest using envelope encryption with AES-256-GCM and keys held in a managed key service. Ciphertext and keys are stored separately.
• Data in transit is protected with TLS.
• Access to decrypted sensitive fields is restricted to authorized staff, requires a stated reason, and is recorded in an access audit log.
• Sensitive fields are stored in a schema isolated from ordinary application data and are not exposed to the public API surface.

No system is perfectly secure, and we cannot guarantee absolute security. If a breach affecting your sensitive personal information occurs, we will notify you as required by Texas Business and Commerce Code Chapter 521 — without unreasonable delay and no later than 60 days after determining the breach occurred — and will notify the Texas Attorney General where the law requires it.

We keep personal data for as long as your account is active and afterward only as needed for the purposes described here — to meet legal, tax, accounting, audit, and regulatory obligations, to resolve disputes, and to enforce our agreements. Sensitive identifiers are retained only as long as needed for enrollment and verification, or as law requires, and are then deleted or de-identified.

If you are a Texas resident, the Texas Data Privacy and Security Act gives you the right to:

• Confirm whether we process your personal data and access it.
• Correct inaccuracies in your personal data.
• Delete personal data you provided or that we obtained about you.
• Obtain a portable copy of data you provided, where processing is automated.
• Opt out of sale, targeted advertising, or certain profiling. We do not engage in these, so there is nothing to opt out of — but the right stands.

To exercise any of these, email support@energypanda.com with the subject “Privacy Request.” We will verify your identity before acting, which may require confirming information we already hold. We respond within 45 days and may extend once by another 45 days where reasonably necessary, telling you why.

Appeals.If we decline your request, we will explain why and how to appeal. You may appeal by replying to that decision or emailing the address above with the subject “Privacy Appeal.” We will respond in writing within 60 days. If the appeal is denied, you may complain to the Texas Attorney General at texasattorneygeneral.gov.

Residents of other states with comparable laws may have similar rights. Contact us and we will honor them where they apply.

We send transactional messages related to your account, enrollment, and billing; these are part of the service and are not marketing. Any marketing email includes an unsubscribe link, and we honor opt-outs promptly as required by the CAN-SPAM Act. Opting out of marketing does not stop transactional messages.

We use cookies and similar technologies that are necessary to operate the site — keeping you signed in, maintaining your session, and securing forms — along with limited analytics to understand usage. You can control cookies through your browser, though disabling necessary cookies will break sign-in and enrollment.

The service is for adults. We do not knowingly collect personal data from anyone under 18, and we do not knowingly collect data from children under 13 as defined by the Children’s Online Privacy Protection Act. If you believe a minor has given us data, contact us and we will delete it.

Our site may link to REPs and other third parties. We are not responsible for their content or privacy practices. Read their policies before providing information.

We may update this policy. Material changes will be posted here with a new effective date, and where the law requires it we will notify you directly. Continued use after a change means you accept the updated policy.

Energy Panda
Dallas, Texas
support@energypanda.com