Privacy notice
How Helios handles your data.
The short version
Helios is designed to give you a useful plug-in solar estimate without storing your personal data. We don't set cookies, we don't create accounts, and we don't track you across the web. Your inputs are processed to produce a single calculation; the result is returned to your browser and a hashed cache key (not your address) is the only thing that touches our cache layer.
What you tell us
To produce a yield estimate, you provide:
- Postcode — required. Resolved to a lat/lon via Ordnance Survey / postcodes.io data.
- House number or flat designator — optional.
When provided, we look up the building on OpenStreetMap
(Overpass API)
using the
addr:housenumberandaddr:postcodetags. If OSM has the building, we use its centroid as the panel location for shading; if not, we fall back to the postcode centroid. We never store the house number — only an HMAC-SHA256 hash for caching repeat lookups. - Floor, balcony orientation, balcony depth — the panel-geometry inputs the shading model needs.
- Annual electricity consumption band, tariff, kit and install cost, self-consumption fraction — used to compute payback. None of these are uniquely identifying.
We don't ask for your name, your email address, or any other identifier in the calculation flow. The waitlist signup (see below) is the one place we collect an email, and only with your explicit consent.
How we process it
Your answers are sent to our server, used in a single calculation, and the result is returned to your browser. Nothing about that calculation is written to disk. A short-lived in-memory cache may be used to speed up repeated requests with identical inputs; that cache uses an HMAC-SHA256 site hash, not your raw address, and is cleared when the server restarts.
The HMAC uses a server-side secret so the hash is not reversible — anyone with the hash could not brute-force the address tuple from it. This is required by the Helios design spec (§3.6).
Third-party services
To generate your results, our server contacts the following services on your behalf. Your browser does not contact these services directly.
| Service | Data sent | Purpose |
|---|---|---|
| postcodes.io | Your postcode (only when the offline ONS index isn't loaded) | Converting postcode to lat/lon |
| PVGIS (European Commission) | Lat/lon, panel azimuth, tilt, kWp, horizon profile | Computing annual yield from solar radiation models |
| Environment Agency LIDAR Composite | Lat/lon (resolved to OS National Grid tile names) | Building-height data for shading calculation |
| OpenStreetMap (Overpass API) | Postcode and house number (only if you provide one) | Building-level lat/lon — improves shading precision |
| Brevo (Sendinblue SA) | Email address (only if you use the waitlist signup) | Holding your email for the kit-availability mailing list |
Waitlist signup
If you sign up to be notified when UK plug-in solar kits hit the market, your email address is sent to Brevo (Sendinblue SA, Paris, France) where it is stored on a Helios list. The legal basis is your consent, expressed via the tick box on the signup form.
You can unsubscribe from any email we send, or contact us to ask for your record to be deleted. We don't store your email anywhere else — South London Scientific holds no separate copy of the waitlist.
Brevo's privacy policy is at brevo.com/legal/privacypolicy.
Cookies and tracking
Helios does not set any cookies. We do not use localStorage or sessionStorage. There is no cross-site tracking, fingerprinting, or advertising.
Server logs
Our web server records standard access logs (timestamp, IP address, path requested, status code) for diagnostics. Logs are retained for up to 30 days then deleted.
Who we are
Helios is built and operated by South London Scientific. Council-branded versions of Helios remain hosted and operated by us on behalf of the partner.
Your rights
Under the UK General Data Protection Regulation (UK GDPR), you have the right to access, correct, or request deletion of any personal data we hold about you. In practice we hold very little — at most an email address on the waitlist, and short-lived access logs — but if you have any concerns or requests, please contact us.
Contact
Questions about this privacy notice or how your data is handled: ruaraidh@southlondonscientific.com.