DISTRICT OF
COLUMBIA
SUSTAINABLE
ENERGY UTILITY
COLUMBIA
SUSTAINABLE
ENERGY UTILITY
“CarbonSmart Affordability Operations” Privacy Policy
Last Updated: July 22, 2026
1. Introduction
This Privacy Policy explains how Post Road Foundation (“we,” “us,” or “our”) collects, uses,
shares, and protects information when you participate in the CarbonSmart Affordability
Operations (“CSAO”) or use the CarbonSmart Affordability Operations App (the “CSAO
App”), the CSAO website at dcseu.com/csao-homes, or other applications (collectively
called our “Services”).
CSAO is a research project of the Post Road Foundation to study electric load flexibility. By
participating in CSAO and using the CSAO App and/or CSAO website, you agree to the
collection and use of information in accordance with this Privacy Policy.
2. Contact
For questions about this Privacy Policy or our data practices, or if you would like to make a
complaint, please contact:
Post Road Foundation
1999 Harrison St. STE 1800
Oakland, CA 94612
Email: privacy@postroadfoundation.org
Phone: 901-213-6196
3. Information We Collect
We collect information in several ways to operate CSAO and provide our Services to you.
This includes information you provide directly, information collected automatically through
our equipment and systems, and information from third parties.
3.1 Personal information that you provide directly via our website, by e-mail, text,
phone, or in person:
• Enrollment Information: Information you provide when applying to participate in
CSAO through our website enrollment form.
• Contact Information: Name, email address, mailing and service address, and
phone number.
• Utility Account Information: Utility account numbers, meter numbers, tariff rate
structure, and utility bills.
• Secondary User Information: Names, email addresses, and phone numbers of
additional household members you authorize to access your CSAO account. By
adding secondary users, you are granting them access to view energy data and
modify energy device settings and participation settings. You are responsible for
informing secondary users that their information will be collected and used as
described in this Privacy Policy.
• Content You Choose to Share: Text, images, audio, video, digital signatures, and
metadata associated with the files you share via e-mail, text, or upload.
• Energy Device Information: Information about your participating energy devices,
such as make, model, serial number, and location.
• Energy Device Vendor Account Information: Authorization to access energy
device data through their manufacturer’s systems, including any tokens and
identifiers needed to retrieve your data from manufacturer cloud systems.
• Building Information: Information about your home or business, such as location
(service address), square footage, year built, number of floors, number of rooms,
weatherization state, occupancy, whether it has solar power, and electrical panel
details.
• Phone or Tablet Information: The make and model of your smartphone or tablet.
• Correspondence: Any communication with us via phone, text, or email.
• Contact or Other Form Submission: Information you provide when contacting us
through our website or the CSAO app.
• Surveys: Any response to survey questions that we may send from time-to-time via
e-mail or text. Surveys may include demographic questions.
3.2 Information collected automatically by our systems
From enabling equipment that we install:
• Electricity Usage Data: Real-time and historical usage data from submetering,
gateway, and other enabling communication equipment in your building or home.
• Enabling Equipment Diagnostics: Performance and status data from the enabling
equipment, including communication status and signal strength.
• Energy Device Data: Data from energy devices other than electricity usage, such as
operational status, state-of-charge, and building temperature and humidity.
Note that the CSAO App retrieves the above data from our cloud servers and displays it
in the CSAO App but does not store this data on your mobile device.
From the CSAO App on your mobile device:
• Account Information: Email address, mailing and service address, and phone
number for you and any secondary users you designate to use the CSAO App.
• Participation Preferences: Your preferences with regard to how you would like your
energy devices to respond to grid conditions (“responsiveness choices”), whether
you would like to pause participation temporarily, and goals for the program.
• Energy Device Operating Parameters: Certain energy device settings, such as
water heater power; and/or battery preferred state of charge.
• Energy Device Identifiers: Photos of QR codes, serial numbers, and other
hardware identifiers that are used to pair your energy devices with your CSAO
account.
• App Usage Analytics: Information about how you interact with app features.
• App Performance Data: App crashes, errors, and response times.
• Survey questions: Answers to survey questions that we may present to you in
email, text or from the CSAO App regarding your participation in CSAO and use of
the CSAO App.
• Technical and App Performance Monitoring Data: Technical and app performance
monitoring data are automatically collected through the CSAO App and third-party
analytics SDKs. This data includes, but is not limited to:
o Mobile device(s): Make, model, unique resettable device ID (the CSAO App
does not collect persistent device identifiers, e.g., IMEI, IMSI, or SIM Serial
number), IP address, Wi-Fi network information, operating system version,
and network carrier information.
o Error & Crash Data: Stack traces, error messages, and app version and build
information.
o Performance Metrics: App launch times, network requests, memory usage,
battery impact, and screen load times.
o User Context: User IDs and session duration and frequency.
• Location Data (to enable location-based features):
o Collecting location data requires your explicit permission on your mobile
device and is not required to participate in CSAO.
o You can choose between precise or approximate location.
o Background location enables some automated features.
o We will not share your current location with third parties.
o If you do not want us to use your location, you can turn off the location
services for the CSAO App (located in your mobile device settings). Disabling
location services may reduce the CSAO App’s functionality.
From our website:
• Website Analytics: We use Google Analytics to understand how visitors use our
website. This includes information such as pages visited, time spent, referral
sources, and general geographic location (city/state level).
• Technical Information: We also collect technical data, including browser type,
device type, and IP address (which Google Analytics may use to determine
approximate location).
• Google Analytics uses cookies to collect this information. You can opt out of Google
Analytics by installing the Google Analytics Opt-out Browser Add-on.
3.3 Information we receive from third parties
From energy device manufacturers (through authorized API connections):
When you authorize API connections to your participating energy devices, data flows from
each energy device to the energy device manufacturer's systems, and then to our system.
Each energy device manufacturer's privacy policy also applies to your device data. We use
manufacturer APIs to collect the following from your participating energy devices:
• Energy Device Usage/Production Data: Electricity usage and production data.
• Energy Device Operational Data: Battery charge levels, water heater power draw,
charging status, and other operational parameters.
• Energy Device Status: System health, error codes, and operational state.
From utilities and grid operators:
• Building Energy Usage Data: Real-time and historical electricity consumption data
for your entire building collected from your utility.
From our service providers:
• Installation and Maintenance Records: Information from contracted electricians
about enabling equipment installation, configuration, and maintenance.
• Third-Party Survey Responses: Responses to survey questions through external
survey platforms that we may send from time-to-time via e-mail, text, or CSAO app.
Survey questions may include demographics.
• Support Interactions: Records from customer support tools.
From social media:
Information provided when you interact with us on social platforms (governed by each
platform's privacy policy).
4. How We Use Your Information
We use the information we collect for the purposes described below. We do not share
information with or sell information to third-party advertisers.
4.1 Primary Functions
• Operate CSAO: Manage your participation in CSAO, coordinate enabling equipment
installation, maintain your account, pair your energy devices with your CSAO
account, connect to energy device manufacturer APIs, and send dispatch signals to
your energy devices via enabling equipment or manufacturer APIs.
• Security: Send security codes via email or text, remember mobile / tablet devices
you've logged in from, and detect and prevent fraud and abuse.
• Improve Services: Monitor and improve CSAO operations, app performance, and
user experience; fix bugs and develop new features.
• Communication: Send notifications to the primary account holder and secondary
users about CSAO operations, energy device operation, program updates,
participant surveys, energy consumption reports, demand response or other load
flexibility events, announcements, policy changes, security alerts, and support
messages.
• Participant Support: Provide support for your participation, respond to questions
and feedback, and coordinate qualified installers to troubleshoot enabling
equipment or energy device connections.
• Display Your Data: Display, via the CSAO App, your electrical usage and production
data, energy device parameters, participation preferences, and program
performance.
• Calculate Incentives: Determine enrollment, participation, and performance-
based incentive payments using data from enabling equipment and energy devices.
• Comply With the Law: Use your personal information as necessary to comply with
applicable laws, lawful requests, and legal processes, such as responding to
subpoenas or requests from government authorities, or to investigate or defend
legal claims.
4.2 Research and Program Evaluation
• Research Analysis: Analyze load flexibility effectiveness, grid impact, and energy
device performance to advance understanding of transactive energy systems.
• Program Evaluation: Assess grid and participant benefits.
• Research Publications: Publish research findings in scientific journals,
conferences, and reports
• Prepare Anonymous, Aggregated, or De-Identified Data for Research Purposes:
We create anonymous, aggregated, or de-identified data from your information and
from other individuals whose information we collect by removing information that
makes the data personally identifiable to you. We may use this anonymous,
aggregated, or de-identified data to analyze and improve load flexibility services and
share such data and any analyses with our research partners.
• Research Collaboration: Use your anonymous, aggregated, or de-identified data to
analyze the performance of CSAO in cooperation with research partners.
5. How We Share Your Information
We do not sell, rent, or trade your personal information to third parties. We share data only
as described below, as required by law, or with your explicit consent.
5.1 CSAO Operations and Analysis
As part of CSAO operations and analysis, we share your data with the following entities:
Program Partners
• DCSEU: We may share energy usage data with DCSEU, in compliance with their
privacy policies, to calculate and pay incentive payments and assess the
performance of CSAO.
Research Partners
• Academic and Other Partners: We may share aggregated or de-identified data with
research partners. We only share data that has been stripped of personal identifiers.
Publication Channels
Analysis of anonymized data may be published in scientific journals, research reports, and
other academic channels.
Service Providers
We may share your information with trusted service providers who work on our behalf,
including, but not limited to:
• Installation Contractors: Contact and site information for equipment installation,
maintenance, and support.
• Cloud Infrastructure: Secure computing, data storage, and backup services.
• Analytics Providers: Performance monitoring and usage analysis.
• Customer Support Tools: Technical support and customer service platforms.
• Communication Servicers: E-mail, phone, and text services for program
notifications.
5.2 Legal Requirements
We may disclose your personal information to law enforcement, government authorities,
and private parties, as necessary, to:
• Protect our, your or others’ rights, privacy, safety, or property (including by making
and defending legal claims).
• Enforce the terms and conditions that govern our Services.
• Protect, investigate, and deter against fraudulent, harmful, unauthorized, unethical
or illegal activity.
• As required by law, such as to comply with a subpoena, or similar legal process.
5.3 Business Transfer
In the event that Post Road Foundation is involved in a merger, acquisition, or sale of all or a
portion of its assets or transfer of its grant funding to another entity, your information may
be transferred to the new entity, subject to this same Privacy Policy. You will be notified via
email and/or a prominent notice on the CSAO website of any choices you may have
regarding this information.
5.4 With your consent
We may share your information for other purposes with your explicit consent, such as
featuring your success story or sharing testimonials.
6. Data Security
Post Road Foundation implements best-practice technical, administrative, physical, and
cybersecurity safeguards to protect your personal information from loss, unauthorized
access, destruction, misuse, modification, and improper disclosure. While no system can
guarantee absolute security, Post Road Foundation is committed to minimizing security
risk. Users are warned, however, that no system can ever be fully protected against every
possible hazard. Comprehensive security measures include:
• Encryption: Data at rest is encrypted. Data in transit is secured using TLS 1.2 or
higher.
• Access Control: Strict access control is implemented based on the principle of
least privilege. Access to your information is limited to employees, affiliates, and
contractors who need the information to operate or improve our Services. These
individuals must comply with this Privacy Policy. Access is audited on a regular
basis.
• Network Security: CSAO databases reside in a private subnet within a virtual
private cloud, protected by security groups and network access control lists.
• Monitoring and Logging: Continuous monitoring is conducted to detect and
respond to suspicious activity in real time.
• Backups: Regular backups are performed with tested disaster recovery procedures.
• Security Updates: Systems are regularly updated and patched to address security
vulnerabilities.
• Third-Party Validation: Regular penetration testing and third-party security audits
are conducted.
7. Data Retention
We retain your information for as long as necessary to fulfill the purposes we collected it
for, including legal, accounting, and research purposes.
• Account Information: Your name, contact information, and account details are
retained while you participate in CSAO and for up to 3 years after your participation
ends.
• Energy Device Specifications and Identifiers: Your energy device specification
(make and model) and identifiers (serial number and other identifiers, and photos of
QR codes and bar codes) are retained while you participate in CSAO and for up to 3
years after your participation in CSAO ends.
• Energy Device Data: Data from energy devices, whether conveyed via enabling
equipment or energy device APIs, is retained for up to 5 years after CSAO ends, to
complete research analysis and meet regulatory requirements.
• Building Information: Your building information is retained while you participate in
CSAO and for up to 3 years after your participation in CSAO ends.
• Anonymized data: We retain anonymized, aggregated, and de-identified data
indefinitely for ongoing research purposes. This data cannot be linked back to you.
• App Performance Data: Log files and app analytics are retained while you
participate in CSAO and for up to 2 years after your participation ends.
• Incentive payments: Incentive payment records are retained while you participate
in CSAO and for up to 7 years after your participation ends.
8. Your Privacy Rights and Controls
8.1 Rights for all participants
You have the following rights under this Privacy Policy and applicable data protection laws:
• Right to Be Informed: You have the right to know how your personal information is
collected, used, and shared. This information is provided in this Privacy Policy.
• Right of Access: You can request confirmation of whether we are processing your
personal information and access a copy of that information.
• Right to Rectification/Correction: You can request that we correct inaccurate or
incomplete personal information.
• Right to Data Portability: You can request a copy of your information in a structured
electronic format.
• Right to Erasure/Delete, Restrict Processing or Object: You can request that we
delete your information, limit processing or analysis of your information, or object to
the processing or analysis of your information. Note that some data may be retained
as required, e.g., financial records and de-identified data already used in research.
Data deletion requires ending your participation in CSAO.
• Right to Withdraw: You can withdraw from CSAO at any time without penalty by
emailing CSAO@postroadfoundation.org. You will receive confirmation within 30
days. Upon withdrawal:
o Future incentive payments will stop.
o New data collection will stop immediately.
o Previously collected de-identified data may be retained for research.
• Right to Manage Energy Device Connections: You have the right to revoke access
to any or all of your energy devices at any time, whether those devices are
connected via CSAO-provided enabling equipment or manufacturer API. Please
contact us to revoke connection. Revoking connections will affect incentive
calculations and program features.
• Right to Opt Out of Optional Communications: You can opt out of program
communications, except essential operational messages.
8.2 Additional Privacy Rights
If you are a resident of certain U.S. states, you may have additional privacy rights.
• California Residents: You may have additional rights under the California
Consumer Privacy Act (CCPA), including the right to know what personal
information we collect, the right to request deletion of your personal information,
the right to opt-out (we do not sell personal information, but you can opt-out if our
practices change), and the right to non-discrimination.
• Other States: Residents of Tennessee, Colorado, Connecticut, Utah, Virginia, and
other states with privacy laws may have similar rights. Contact us to learn about
your state-specific rights.
To exercise these rights, contact us as described in Section 2. We will respond to your
request within 30 days, or the timeframe required by applicable law, whichever is shorter.
9. Children's Privacy
• CSAO is not intended for children under 13.
• CSAO participants must be 18 or older
• We do not knowingly collect personal or other information from anyone under the
age of 13. If we discover a child under 13 has provided information, we will delete
the information promptly.
• If you become aware that any child that you are responsible for has provided us with
information without your consent, you should contact us. We will delete such
information from our files as soon as reasonably practicable.
10. Data Storage and Transfers
Primary Storage: Your personal information and energy consumption data is stored on
secure servers located within the United States.
Third-Party Services: Some third-party services we use (such as software development,
analytics, or customer support) operate globally and may process data outside of the U.S.
These services are bound by strict data protection agreements and use appropriate
safeguards to protect your information.
11. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices,
technology, legal requirements, or for other operational reasons. Most changes are
effective when posted.
We will notify you of changes by:
• Posting the updated policy in the CSAO App and on the CSAO website.
• Sending an email notification to the primary account holder's email address (for
material changes).
• Updating the “Last Updated" date at the top of this policy.
Your continued participation in CSAO after such modifications constitutes acceptance of
the updated Privacy Policy.