Who this policy applies to
This Privacy Policy describes how EnergyMap.in (operated by the non-profit entity behind the India Energy Atlas, “EnergyMap”, “we”, “our”, or “us”) handles personal information when you visit energymap.in, use our APIs, subscribe to alerts, or contact us by email. It applies to visitors and users in India, the United States, and elsewhere.
EnergyMap.in publishes public-domain grid, generation, market, and regulatory data about India. Almost everything on the site is anonymous to browse. You only share personal information when you deliberately do so — by creating an account, subscribing to a plan, setting up alerts, contacting us, or donating.
Section 1
Information we collect
a. Information you provide directly
- •Account details: name, email address, and password hash when you sign up for alerts, the API, or a paid plan.
- •Billing details: name, billing address, GSTIN (if applicable), and last-four of payment card. Full card numbers are handled only by our PCI-compliant payment processors — we never see or store them.
- •Communications: the contents of emails you send us (e.g., hello@energymap.in).
- •Alert preferences: the grid events, states, or price thresholds you ask us to notify you about.
b. Information collected automatically
- •Log data: IP address, user agent, pages requested, referrer, and timestamps. Retained for up to 90 days for security and abuse prevention.
- •Cookies & local storage: a session cookie for logged-in users, and a small number of preference keys (selected state, chart defaults, dark mode). See Section 3.
- •API usage: API key identifier, endpoint, response code, and latency — used for rate-limiting, billing, and debugging.
c. What we do not collect
- •We do not collect precise geolocation, biometric data, financial account credentials, Aadhaar numbers, or government-issued identifiers.
- •We do not sell personal information. We do not “share” personal information for cross-context behavioral advertising as those terms are defined under the CCPA/CPRA.
Section 2
How we use information
Under India's DPDP Act, 2023, we rely on your consent for account, billing, and alerts processing, and on legitimate uses for security, fraud prevention, and compliance with law. Under US state privacy laws, our processing purposes are:
- •To operate the site, APIs, and alerts you requested.
- •To process payments and issue tax receipts (including 80G receipts for eligible Indian donors).
- •To prevent abuse, rate-limit APIs, and investigate security incidents.
- •To comply with Indian, US, and other applicable legal obligations — including tax, accounting, and lawful requests from authorities.
- •To send service announcements (billing, outages, breaking changes). You may opt out of non-transactional emails at any time.
We do not use your personal information to train third-party AI models. We do not engage in automated decision-making that produces legal or similarly significant effects about you.
Section 3
Cookies and similar technologies
We use the minimum cookies and local-storage keys needed to run the site. These fall into two buckets:
- •Strictly necessary: session cookie for logged-in users, CSRF token, and a preference store for the state/chart defaults you pick. You cannot disable these without breaking the site.
- •Privacy-preserving analytics: aggregate page views via a cookie-less analytics provider. No cross-site tracking, no advertising identifiers, no third-party ad cookies.
We honor the Global Privacy Control (GPC) signal. If your browser sends GPC, we treat it as an opt-out of any sale or sharing, even though we do not sell personal information.
Section 4
Who we share data with
We share personal information only with a narrow set of service providers (called “data processors” under DPDP and “service providers” under CCPA) under written contracts that restrict them to processing on our behalf:
- •Cloud hosting and managed database providers (for site, APIs, and account data).
- •Payment processors (for subscriptions and donations).
- •Transactional email providers (for alerts and receipts).
- •Error-tracking and uptime monitoring.
We may also disclose information to comply with valid legal process (court orders, subpoenas, or lawful requests from Indian or US authorities), or to protect the rights, property, or safety of EnergyMap, our users, or the public. In a corporate transaction — such as a merger, acquisition, or sale of assets involving the non-profit entity — personal information may be transferred to the successor subject to this Policy.
Section 5
Cross-border data transfers
EnergyMap.in is operated from India. Depending on the service, personal information may be stored or processed in India, the United States, or other jurisdictions where our vendors operate. Transfers outside India are made to countries not restricted by the Central Government under Section 16 of the DPDP Act, 2023. We use contractual safeguards with all international processors.
Section 6
Your rights
If you are in India
Under the Digital Personal Data Protection Act, 2023 you have the right to:
- •Access a summary of your personal data and how it is processed.
- •Correct, complete, update, or erase your personal data.
- •Nominate another person to exercise your rights in the event of death or incapacity.
- •Grievance redressal — contact us first, and if unresolved, approach the Data Protection Board of India.
- •Withdraw consent at any time (we will stop processing on that basis going forward).
If you are in the United States
Under CCPA/CPRA (California), VCDPA (Virginia), CPA (Colorado), CTDPA (Connecticut), UCPA (Utah), and similar laws, you have the right to:
- •Know what personal information we collect and how we use it.
- •Access, correct, or delete your personal information.
- •Opt out of sale or sharing for cross-context behavioral advertising (we do not do either).
- •Limit the use of sensitive personal information (we do not collect any).
- •Non-discrimination for exercising any of these rights.
To exercise any right, email hello@energymap.in from the email on file, or from an email address you can verify control of. We will respond within 30 days (DPDP) or 45 days (US state laws), as required.
Section 7
Security and retention
We use TLS in transit, encryption at rest for managed databases, hashed passwords (bcrypt/argon2), scoped API keys, and least-privilege access for operators. No system is perfectly secure — if a breach affecting your personal data occurs, we will notify the Data Protection Board of India and affected users as required by law, and notify US users in line with applicable state breach-notification statutes.
We retain personal information only as long as needed for the purposes described here, typically: account data until you delete your account, billing records for 8 years (Indian tax law and US accounting standards), server logs for 90 days, and donation records for the period required to support 80G receipts.
Section 8
Children's privacy
EnergyMap.in is not directed to children. We do not knowingly collect personal information from children under 18 (India, under the DPDP Act) or under 13 (US, under COPPA). If you believe a child has provided us personal information, email hello@energymap.in and we will delete it.
Section 9
Data and software provided “as is” — no warranty
All data, analytics, visualizations, models, APIs, alerts, and software made available through EnergyMap.in are provided on an “AS IS” and “AS AVAILABLE” basis. To the fullest extent permitted by applicable law, EnergyMap disclaims all warranties of any kind, express or implied, including but not limited to warranties of merchantability, fitness for a particular purpose, non-infringement, accuracy, completeness, timeliness, or uninterrupted availability.
EnergyMap.in aggregates and republishes data from Indian load dispatch centers, power exchanges, regulators, and other public sources. Upstream data may be incorrect, delayed, revised, withdrawn, or reported in formats that change without notice. You should independently verify any data point before relying on it for trading, investment, engineering, legal, compliance, or policy decisions. The site is not investment advice, legal advice, or engineering certification.
To the fullest extent permitted by law, EnergyMap, its directors, trustees, staff, and contributors will not be liable for any direct, indirect, incidental, special, consequential, punitive, or exemplary damages — including lost profits, lost revenue, lost data, or business interruption — arising out of or relating to your use of the site, APIs, data, or software, whether based on warranty, contract, tort (including negligence), statute, or any other legal theory, and whether or not EnergyMap was advised of the possibility of such damages.
Some jurisdictions do not allow the exclusion of certain warranties or the limitation of certain damages; in those jurisdictions the above limitations apply to the maximum extent permitted by law. Nothing in this Policy limits rights that cannot be limited under the DPDP Act, the Consumer Protection Act, 2019, or applicable US state or federal law.
Changes to this Policy
We may update this Privacy Policy from time to time. Material changes will be announced at the top of the site and, for registered users, by email at least 15 days before they take effect. The “Effective” date at the top of this page always reflects the latest version.
Privacy questions or requests
For privacy questions, data subject requests, or grievances under the DPDP Act, 2023, write to our Grievance Officer at hello@energymap.in. For general questions, email hello@energymap.in. We respond within one business day and resolve formal requests within the statutory deadlines above.