Effective date: August 10, 2026 · Version 1.0
This policy describes how Ecosum LLC ("Ecosum," "we") collects, uses, and protects information in connection with ecosum.io and app.ecosum.io (the "Service"). Ecosum is a business-to-business compliance platform; we collect what the Service needs to do its job, and nothing else.
We do not collect data about individuals beyond what business contact and account use require. The Service is not directed to children.
Directly from you; from Portfolio Manager and utility programs only with your authorization, which you can revoke at any time; and from public government datasets (e.g., NYC benchmarking disclosure, the DOB Covered Buildings List).
To provide the Service: computing emissions and compliance positions, generating the reports you request, sending transactional and service notifications (deadline reminders and alerts have per-category preferences and unsubscribe links; account/security emails are always sent), providing support, securing the platform, and billing. We do not sell your data. We do not use it for advertising. We do not send marketing email without separate consent.
Only as needed to run the Service:
| Recipient | Purpose | Notes |
|---|---|---|
| DigitalOcean | Cloud hosting | US data centers; disk encryption at rest |
| Backblaze | Off-site backups | Backups are encrypted before upload; Backblaze holds only ciphertext (US region) |
| Postmark | Transactional email delivery | Sees recipient address and message content |
| Stripe | Payment processing | Holds card details; PCI-DSS certified |
| Sentry | Error diagnostics | US region; configured to exclude personal data, request bodies, and credentials |
| UptimeRobot | Availability monitoring | Sees only public URLs; no customer data |
| Your designated RDP | Filing review and certification | Receives the building's filing package at your direction |
| NYC DOB / government | Filings and legal compliance | At your direction, or where the law requires |
Each provider is bound to protections consistent with this policy, and Ecosum remains responsible for your data in their hands. We will disclose data where a law, subpoena, or regulator validly requires it, and we will notify you unless prohibited.
Utility customer data retrieved under programs like Con Edison Share My Data is handled under our executed utility Data Security Agreements: processed and stored only in the United States, encrypted in transit and at rest, access-restricted on a need-to-know basis with an append-only audit log, and retrievable or destroyable on the utility's or customer's valid demand. If you revoke a data-sharing authorization, retrieval stops and associated data is destroyed on request, subject to encrypted backup cycles and legal retention.
Production systems are hardened and monitored 24/7: full-disk and volume encryption, TLS for all traffic, multi-factor authentication on administrative access, role-based access control enforced server-side, integration credentials encrypted at the application layer with rotating keys, encrypted off-site backups with quarterly tested restores, and independent security review. If a security incident affects your data, we will notify affected utilities within contractual timelines (48 hours) and affected customers without undue delay, with the facts and our remediation.
Account and building data are retained while your account is active. After termination, export tools remain available for 30 days; thereafter data is deleted from active systems, with encrypted backups aging out on our documented rotation. Compliance filings, audit provenance records, and financial records are retained up to six (6) years where professional, contractual, or legal obligations require.
You can access and export your data (CSV/JSON/PDF/XLSX) from the Service at any time; correct building data in-app; manage notification preferences and unsubscribe from non-essential email; revoke data-source authorizations; and request account deletion at umesh@ecosum.io — honored within 30 days, subject to the retention obligations above. We respond to reasonable privacy requests from any jurisdiction in the same spirit.
The Service uses session cookies strictly for authentication and security. No advertising or cross-site tracking cookies, ever.
Material changes to this policy will be announced through the Service or by email at least fourteen (14) days before taking effect.
Ecosum LLC · 213 Barton Creek Dr, Apt B, Charlotte, NC 28262 · umesh@ecosum.io · (980) 310-5484