Sponge

Legal

Privacy Policy

Sponge Microgrids Inc.

Effective Date: Jan 29, 2026

This Privacy Policy describes how Sponge Microgrids Inc. (“Sponge,” “we,” “us,” or “our”) collects, uses, discloses, and protects your personal information when you use the Sponge Energy Management Platform (the “Platform”). This Privacy Policy applies to all users of the Platform, including visitors to our website at https://sponge.to/ (the “Website”), users of our mobile and web applications (app.sponge.to, IOS app, Android app), and customers who have our hardware installed at their premises.

By accessing or using the Platform, you agree to the collection, use, and disclosure of your information as described in this Privacy Policy. If you do not agree with or accept this Privacy Policy, you should not access or use the Platform.

1. Information We Collect

We collect several types of information from and about users of our Platform:

1.1 Information You Provide to Us

We collect information that you voluntarily provide when you:

  • Create an account or register for the Platform
  • Make purchases or submit customer service inquiries
  • Complete site commissioning and onboarding forms
  • Configure the Platform settings, including site location, equipment details, schedules, and user preferences
  • Communicate with us via email, phone, or through the Platform

This information may include your name, email address, phone number, mailing address, payment information, property location and address, equipment specifications, energy usage preferences, and any other information you choose to provide.

1.2 Information Collected Automatically

When you access or use the Platform, we automatically collect certain information, including:

  • Device and Usage Information: Information about your device, browser type, IP address, operating system, and how you interact with the Platform
  • Location Information: Your general geographic location based on your IP address or the location you provide during setup
  • Cookies and Similar Technologies: We use cookies, web beacons, and similar tracking technologies to collect information about your browsing activities. For more information, see Section 6 below.

1.3 Energy System Data

The Platform collects data from your energy systems to enable monitoring, optimization, and control functions. This includes:

  • Power Flow Data: Real-time and historical data about energy production, consumption, storage, and grid interaction from your solar inverters, battery systems, EV chargers, and other connected equipment
  • System Telemetry: Operational status, performance metrics, fault codes, and diagnostic information from connected devices
  • Digital Twin Configuration: Information about your system configuration, equipment interconnections, and control settings

Important: Data collected and interpreted by the Sponge Energy Management Controller Software, including power flow and system telemetry data, is the property of Sponge and is made available to you for viewing purposes. You may export this data for personal use only; commercial use of this data requires express written consent from Sponge.

1.4 Energy Data Ownership and Usage Rights

It is important to understand the distinction between personal information (such as your name, contact details, and account information) and energy system data(such as power flow measurements, system telemetry, and performance metrics). While you retain ownership and control over your personal information as described in this Privacy Policy, energy system data collected and interpreted by the Sponge Energy Management Controller Software is the proprietary property of Sponge. This data is made available to you through the Platform for viewing, monitoring, and personal analysis. You may export energy system data for your own personal, non-commercial use (such as for personal record-keeping or sharing with your utility company). However, any commercial use, redistribution, resale, or licensing of energy system data requires express written permission from Sponge. This ownership structure enables us to use aggregated and anonymized energy data for research, product improvement, and development of better energy management solutions while ensuring you have full access to view and use your system’s data for personal purposes.

2. How We Use Your Information

We use the information we collect for the following purposes:

  • Platform Operation and Optimization: To provide, operate, maintain, and optimize the Platform, including monitoring and controlling your energy systems, running forecasting and control algorithms, and improving system performance
  • Customer Support: To respond to your inquiries, provide technical support, and assist with system commissioning and troubleshooting
  • Account Management: To create and manage your account, process transactions, and communicate with you about your use of the Platform
  • Product Development and Improvement: To analyze usage patterns, develop new features, and improve the functionality and user experience of the Platform
  • Research and Analytics: To conduct research, create aggregated and anonymized datasets, and develop insights about energy management and system performance
  • Communications: To send you important notifications about the Platform, system alerts, software updates, and other service-related information
  • Legal Compliance and Safety: To comply with applicable laws and regulations, enforce our Terms and Conditions, protect our rights and property, and ensure the safety and security of our users

2.1 Automated Decision Making and Algorithm Control

The Platform uses automated algorithms to make decisions about energy system operation, including when to charge or discharge batteries, how to optimize solar production, and when to interact with the grid. These automated decisions are based on data collected from your system, your configured preferences, utility rate information, weather forecasts, and our proprietary optimization algorithms. While these algorithms are designed to optimize your energy usage and costs, they operate within the parameters you set through the Platform configuration. You maintain the ability to override automated decisions, adjust system settings, and disable automated control features at any time through the user interface. The accuracy and effectiveness of automated optimization depends on data quality, system configuration accuracy, and continuous connectivity to your equipment and relevant web services.

3. How We Share Your Information

We do not sell your personal information. We may share your information in the following circumstances:

3.1 With Your Consent

We may share your information when you have given us explicit consent to do so.

3.2 Service Providers and Business Partners

We may share your information with third-party service providers who perform services on our behalf, such as cloud hosting providers, payment processors, analytics services, and customer support tools. We may also share anonymized personal information (such as anonymized location data) with third-party services to support the data requirements of the Platform, including weather forecasting, utility rate databases, and grid optimization services. These third parties are contractually obligated to protect your information and use it only for the purposes for which it was disclosed.

3.3 Distribution Network and Authorized Partners

If you purchased or installed the Platform through one of our authorized distributors or installation partners, we may share relevant information with them to facilitate installation, commissioning, support, and warranty services.

3.4 Business Transfers

In the event of a merger, acquisition, reorganization, sale of assets, or bankruptcy, your information may be transferred to the successor entity or acquiring party.

3.5 Legal Requirements and Protection

We may disclose your information if required to do so by law or in response to valid requests by public authorities (such as a court or government agency). We may also disclose information when we believe in good faith that disclosure is necessary to protect our rights, your safety or the safety of others, investigate fraud, or respond to a legal request.

3.6 Aggregated and Anonymized Data

We may share aggregated or anonymized information that does not directly identify you with third parties for research, marketing, analytics, and other purposes.

3.7 API and Third-Party Developer Access

If we offer application programming interfaces (APIs) or allow third-party developers to create integrations with the Platform, any access to your data through these channels will only occur with your explicit consent. We require third-party developers who access user data through our APIs to comply with our developer terms and privacy requirements. You may review and revoke third-party access permissions at any time through your account settings. We are not responsible for the privacy practices of third-party applications or integrations that you choose to connect to your account.

4. Data Retention

We retain your personal information for as long as necessary to provide the Platform services, comply with our legal obligations, resolve disputes, and enforce our agreements. Energy system data (power flow and telemetry) may be retained indefinitely for research, product improvement, and to provide you with historical data access. When you terminate your account, we will delete or anonymize your personal information within a reasonable timeframe, unless we are required to retain it for legal, regulatory, or legitimate business purposes.

5. Data Security

We implement reasonable administrative, technical, and physical security measures designed to protect your information from unauthorized access, disclosure, alteration, and destruction. These measures include encryption of data in transit and at rest, secure authentication protocols, access controls, and regular security assessments. However, no method of transmission over the Internet or electronic storage is completely secure, and we cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials and for any activity that occurs under your account.

5.1 Data Breach Notification

In the event of a data breach that compromises your personal information, we will notify affected users and relevant authorities as required by applicable law. Notification will be provided without undue delay and will include information about the nature of the breach, the types of information affected, the measures we have taken to address the breach, and steps you can take to protect yourself. Notifications will be sent via email to the address associated with your account and/or through prominent notice on the Platform.

6. Cookies and Tracking Technologies

We use cookies, web beacons, and similar tracking technologies to collect information about your browsing activities on the Website and Platform. Cookies are small data files stored on your device that help us:

  • Remember your preferences and settings
  • Authenticate your account and maintain your session
  • Analyze how you use the Platform and improve its functionality
  • Provide personalized content and recommendations

You can control cookies through your browser settings and opt out of certain tracking technologies. However, disabling cookies may limit your ability to use some features of the Platform.

6.1 Do Not Track Signals

Some web browsers have a “Do Not Track” (DNT) feature that signals to websites that you do not want your online activities tracked. At this time, the Platform does not respond to DNT signals or similar mechanisms. We will continue to monitor developments in DNT browser technology and may implement DNT recognition in the future if industry standards are established.

6.2 Push Notifications and System Alerts

The Platform may send you push notifications, email alerts, and in-app notifications related to your energy system’s operation, including system status updates, fault alerts, optimization recommendations, and important service announcements. You can manage your notification preferences through your account settings or device settings. Please note that disabling certain notifications may affect your ability to respond to critical system events or receive important updates about the Platform.

7. Your Rights and Choices

Depending on your location, you may have certain rights regarding your personal information:

  • Access: You may request access to the personal information we hold about you
  • Correction: You may request that we correct inaccurate or incomplete information
  • Deletion: You may request that we delete your personal information, subject to certain legal exceptions
  • Portability: You may request a copy of your personal information in a structured, machine-readable format
  • Objection and Restriction: You may object to or request restriction of certain processing activities
  • Withdraw Consent: Where we rely on your consent to process your information, you may withdraw that consent at any time

To exercise any of these rights, please contact us at info@sponge.to. We will respond to your request within a reasonable timeframe and in accordance with applicable law. Please note that we may need to verify your identity before processing your request.

7.1 How to Delete Your Account

If you wish to delete your account and personal information, you may do so by:

  • Contacting us at info@sponge.to with your account deletion request
  • Accessing the account settings within the Platform and selecting the account deletion option (if available)

Upon receiving your deletion request, we will verify your identity and delete your account and associated personal information within 30 days, unless we are required to retain certain information for legal, regulatory, or legitimate business purposes (such as tax records, transaction history, or to resolve disputes). Please note that deleting your account will result in loss of access to the Platform and may affect the operation of your energy management system. Energy system data (power flow and telemetry) may be retained in anonymized form for research and product improvement purposes as described in Section 4.

8. International Data Transfers

Your information may be transferred to, stored, and processed in countries other than your country of residence, including Canada and other jurisdictions where our service providers operate. These countries may have data protection laws that differ from those in your country. By using the Platform, you consent to the transfer of your information to these jurisdictions. We take appropriate steps to ensure that your information receives an adequate level of protection in accordance with applicable data protection laws.

9. Children’s Privacy

The Platform is not intended for use by individuals under the age of 18, and we do not knowingly collect personal information from children. If we become aware that we have collected personal information from a child without parental consent, we will take steps to delete that information.

10. Third-Party Links and Services

The Platform may contain links to third-party websites or integrate with third-party services that are not owned or controlled by Sponge. This Privacy Policy does not apply to those third-party websites or services. We encourage you to review the privacy policies of any third-party sites or services before providing your information to them.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or for other operational reasons. We will notify you of any material changes by posting the updated Privacy Policy on our Website and updating the “Effective Date” at the top of this document. We may also notify you via email or through the Platform. Your continued use of the Platform after such changes constitutes your acceptance of the revised Privacy Policy.

12. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

Sponge Microgrids Inc.
2-18 Spencer Ave.
Toronto, Ontario, M6K 1J6
Canada
Email: info@sponge.to
Website: https://sponge.to/

13. Mobile Application Privacy Addendum

This section provides additional information specific to users of the Sponge mobile application available through the Apple App Store and other mobile platforms.

13.1 Device Permissions and Data Access

The mobile application may request the following permissions to provide full functionality:

  • Local Network Access: Required to communicate with your Sponge Energy Management Controller (EMC) when your mobile device is on the same local network. This enables real-time monitoring and control of your energy system. The app does not access other devices on your network.
  • Internet/Network Access: Required to connect to Sponge’s cloud services (app.sponge.to, operations.sponge.to) for remote monitoring, data synchronization, and system control when you are away from your local network.
  • Notifications: Required to send you alerts about system status, faults, optimization recommendations, and important updates. You can manage notification permissions through your device settings.
  • Background App Refresh: May be used to keep your energy system data current and deliver timely notifications even when the app is not actively open. You can disable this feature in your device settings, though it may affect the timeliness of alerts.

Important Note on Location Data:The Sponge mobile application does NOT use your device’s location services (GPS, Wi-Fi positioning, or cellular location). The Platform requires you to manually enter a fixed latitude and longitude coordinate during setup that represents the physical location of your solar panels and energy system. This fixed location is used solely for weather forecasting and solar optimization calculations. We do not track your device’s location or your movements.

13.2 Data Collection Summary for Mobile App

In accordance with Apple App Store requirements, the following summarizes data collected through the mobile application:

  • Data Linked to You: Contact information (name, email), account identifiers, system configuration data, energy usage data, user-entered location coordinates, device identifiers
  • Data Not Collected: Precise device location, health data, financial information beyond payment processing, browsing history, sensitive personal information
  • Data Used for Tracking: We may use device identifiers and usage data for analytics purposes to improve the app experience

13.3 App Store Review and Testing

Apple and other app store operators may access and review the mobile application as part of their app review process. During this process, reviewers may have access to demo accounts or test data. No personal user data or live energy system data is accessible to app store reviewers.

13.4 Mobile Operating System Privacy Controls

Your mobile device’s operating system (iOS, Android, etc.) provides privacy controls that allow you to manage app permissions, limit ad tracking, and control data sharing. We encourage you to review and configure these settings according to your preferences. You can modify the Sponge app’s permissions at any time through your device’s Settings app. Note that restricting certain permissions may limit the functionality of the Platform.

13.5 Updates and App Data

When you update the mobile application, your account data, system configuration, and preferences are preserved. App updates may introduce new features that require additional permissions; you will be prompted to grant these permissions as needed. Historical energy data and system settings are stored in Sponge’s cloud infrastructure and are not deleted when you uninstall the app, unless you separately request account deletion as described in Section 7.1.

14. Jurisdiction-Specific Provisions

14.1 Canadian Residents (PIPEDA)

If you are a resident of Canada, your personal information is subject to the Personal Information Protection and Electronic Documents Act (PIPEDA). Under PIPEDA, you have the right to access your personal information, request corrections, and file a complaint with the Privacy Commissioner of Canada if you believe your privacy rights have been violated. For more information or to exercise your rights, please contact us using the information in Section 12.

14.2 European Union Residents (GDPR)

If you are a resident of the European Union, your personal information is subject to the General Data Protection Regulation (GDPR). Under GDPR, you have additional rights including the right to lodge a complaint with a supervisory authority, the right to data portability, and the right to object to automated decision-making. The legal bases for our processing of your personal information include: (a) your consent, (b) performance of a contract, (c) compliance with legal obligations, and (d) our legitimate interests in providing and improving the Platform.

14.3 California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), including:

  • The right to know what personal information we collect, use, disclose, and sell
  • The right to request deletion of your personal information
  • The right to opt out of the sale or sharing of your personal information (note: we do not sell personal information)
  • The right to correct inaccurate personal information
  • The right to limit the use and disclosure of sensitive personal information
  • The right to non-discrimination for exercising your privacy rights

To exercise these rights, please contact us at info@sponge.to. You may also designate an authorized agent to make requests on your behalf.

BY USING THE SPONGE ENERGY MANAGEMENT PLATFORM, YOU ACKNOWLEDGE THAT YOU HAVE READ, UNDERSTOOD, AND AGREE TO BE BOUND BY THIS PRIVACY POLICY.