Privacy notice
Last updated: 15 October 2026
This notice explains how NRB Tech Ltd (“we”, “us”) collects and uses personal information when you use wiggle.energy (the “site”), including when you register interest in Wiggle, ask for home-energy help, answer a Wiggle beta survey, or send us an enquiry.
For information about your Wiggle app account and connected energy data, read the Wiggle App Privacy Notice. You can request account deletion, erasure of specific data, or a copy of your personal data without the app.
Who is responsible
The data controller is NRB Tech Ltd, a company registered in England and Wales (company number 11590173). Registered office: Fairleigh, Coldhill Lane, New Mill, Holmfirth, West Yorkshire, HD9 7JX.
We are registered with the Information Commissioner’s Office as a data controller, reference ZC196238.
Questions about this notice or your data: support@wiggle.energy.
What we collect
Almost everything we hold is what you chose to send us through a form on the site.
Interest form
- Name and email address (required)
- Why you are getting in touch (required)
- If you say you are interested for your home or an early pilot: electricity tariff, whether you have a smart meter, home equipment (for example EV, charger, solar, battery, heat pump), postcode, and any free-text notes you leave
- Whether you ticked the optional box asking for Wiggle updates, which version of its wording you were shown, and when
Help request form
- Name and email address (required)
- Phone number (optional, only if you want a call)
- Tariff, home equipment, your message, and which help page you came from
- Whether you ticked the optional box asking for Wiggle updates, which version of its wording you were shown, and when
Beta surveys
If you own a home taking part in the Wiggle beta, we may email you a link to a short survey on this site about two weeks after your home's first full import, with one reminder if you do not answer. If you answer, we may ask three of its questions again about eight weeks after the import. Answering is optional, you can leave any question blank, and choosing “Not now, thanks” stops any further survey emails. Each link works once, for 28 days. The survey collects:
- Your answers: mostly choices from a list, plus an optional line on what would stop you letting Wiggle run something in your home, and an optional note on what would make Wiggle more useful
- The random code in your survey link, which we use to match your answers to your Wiggle participant reference. The link does not contain your name or email address.
- When you answered
- Whether you ticked the optional box letting us contact you about research into how people use Wiggle, the wording of that box as you saw it, and when
Your answers do not change any setting in the Wiggle app and do not give anyone permission to control your devices.
Earlier professional enquiry form
This form is no longer on the site. We keep enquiries already sent through it for the period set out below. Each one contains:
- Name and email address
- Organisation and message, if given
- The type of enquiry chosen, such as prospective investor, adviser or potential commercial partner
Account and data requests
We collect your email address and request type, plus any name or message you choose to provide. We email a one-use confirmation link before the request becomes ready for staff review. We record its expiry and whether it was used. This confirms access to the mailbox; we may need further checks before deleting or releasing personal data, particularly information shared with another household member.
Technical data
Our server uses your network address briefly to deliver the site and limit repeated form submissions. The form receiver stores only a keyed, one-way digest for that abuse check, not the address itself, and deletes those markers after 48 hours. It does not store your browser user-agent alongside your submission or use technical data to build a profile of you.
We use Cloudflare to deliver and protect the website, and its Turnstile security check on our forms. Cloudflare decrypts the website connection on our behalf, so it handles everything you send through a form, as well as your network address and browser information. It uses this to deliver the site and to distinguish ordinary visitors from automated abuse, and may set necessary security cookies. Cloudflare acts as our processor under its data processing addendum. We do not use advertising cookies or marketing analytics, and we do not sell your information.
How we collect it
You submit the information yourself by filling in a form. It passes through Cloudflare's security proxy to NRB Tech's dedicated form service on our operations server. We may read and reply to your message by email or phone using the contact details you gave.
Why we use it (purposes and lawful basis)
We rely on consent under UK GDPR — given only by ticking the optional updates box on the interest or help form — to send you occasional updates about Wiggle. Submitting a form without ticking the box does not sign you up.
If you tick the research box in a beta survey, we rely on your consent to contact you about research into how people use Wiggle, such as a short call or another survey. Leaving it unticked changes nothing else.
You can withdraw consent at any time (see Your rights). Withdrawing consent does not affect processing already carried out.
We rely on our legitimate interests — in answering people who contact us, and in keeping the site working and free of spam — to:
- reply to interest submissions, help requests, and partnership, professional and other enquiries
- consider people who asked about Wiggle for their home, or about an early pilot, for a pilot invitation, using the home details they share
- keep hosting logs and screen form submissions for spam
- learn from beta survey answers how people use Wiggle, whether they find it useful, what to improve, what people would pay for it and whether they would let it control a home battery for the grid, including by comparing your answers with how your home uses the Wiggle app
If you do not tick the updates box, we will use your details to reply to you and, where you asked about your home or a pilot, to consider you for one, and nothing else. You can object to processing based on legitimate interests (see Your rights).
We use account and data request details to meet our legal obligations under data protection law. We use proportionate verification and abuse prevention to protect people against unauthorised deletion or disclosure.
How we store it and who can access it
Each complete form submission is encrypted before it is written to the dedicated form database on our operations server, hosted by OVHcloud in London, UK. The encryption key is held in a separate, access-restricted file and only authorised NRB Tech personnel can use it. Backups of the form database, and a separately encrypted copy of its key, are encrypted before they leave that server, stored by Scaleway in Paris, France, and deleted 31 days after they are made. We do not share your details with third parties for their own marketing.
A private staff alert tells us only that a form type and random reference are ready for review. It contains no name, contact detail, home information or free text. Our form receiver retains its own spam and rate-limit checks. It sends only the Turnstile challenge token to Cloudflare for verification, not your form fields. Cloudflare also handles the website connection, including form submissions, as our security and delivery provider.
Cloudflare operates a global network, so website traffic, including form submissions in transit, may be processed outside the UK and EEA. Where UK transfer rules apply, Cloudflare's data processing addendum provides the safeguard. See Cloudflare's privacy policy and Turnstile privacy information for how it handles that information. Our stored form submissions and their encryption key are held on our operations server in London, UK, and in the encrypted backups in Paris, France, described above.
Mailjet delivers the requested verification email. It receives the destination email address and the one-use link; tracking of opens and clicks is disabled for these messages. The token is encrypted while awaiting delivery and the verification store retains a keyed hash, expiry and confirmation time. Staff notifications are sent only after email confirmation and contain no submission contents.
Beta survey answers are stored in the same encrypted form database as other submissions. Only NRB Tech staff who run the beta can read them, in our staff tools, and any summary we write for wider use inside NRB Tech leaves out names and contact details. We send the survey email and its reminder to your Wiggle account's email address through Mailjet, which delivers our account email as our processor. The link holds a random code, not your name or email address, and the survey form never receives your email address.
We use Google Workspace for email. Messages you send to support@wiggle.energy or to another Wiggle or NRB Tech address, and our replies to your form or request, are held in our Google Workspace mailboxes. Google acts as our processor and may process email outside the UK; where UK transfer rules apply, Google's data processing terms provide the safeguard. Staff alerts about new submissions contain only a form type and reference.
Google API data
Wiggle's use and transfer of information received from Google APIs, including Google Nest data, will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. We use Nest data only to show and control your own thermostat in Wiggle. We do not sell it, use it for advertising or share it with third parties.
How long we keep it
We keep interest-form submissions, including any home details, for up to 24 months after you send them, then delete them, unless you ask us to remove them sooner. Help-request submissions are also kept for up to 24 months after submission, then deleted. Separate correspondence needed for an ongoing follow-up may be retained for that purpose.
Enquiries sent through our earlier professional enquiry form are kept for up to 24 months after submission. Separate correspondence needed for an active discussion or legal record-keeping requirement may be retained for that purpose.
We keep beta survey answers for up to 24 months after you answer, then delete them, unless you ask us to remove them sooner. If you delete your Wiggle account, we delete your answers too. If you ticked the research box, we keep that choice until you withdraw it or your answers are deleted, whichever comes first.
One-way form rate-limit markers are deleted after 48 hours. Operational logs on our operations server contain no form contents, contact details or raw network address. Cloudflare processes network information separately for security and delivery.
Every marketing-style update we send will include a way to opt out. You can also email us at any time to be removed.
Unconfirmed account and data requests are removed after seven days. Confirmation links expire after 24 hours; pending encrypted delivery tokens are removed after delivery, confirmation or expiry. Confirmed request records are retained for up to 24 months after confirmation to document how we handled the request. Necessary correspondence or a legal hold may need separate retention, which we will explain.
How we dispose of it
When retention ends, or when you ask us to delete your data, we delete your form submission from the form database and remove related copies from our email and working files where reasonably practical. Encrypted backups clear within 33 days under their retention schedule.
Your rights
Under UK data protection law you can ask us to:
- access the personal data we hold about you
- correct inaccurate data
- erase your data
- restrict or object to how we use it
- receive a copy in a portable format (where applicable)
- withdraw consent to marketing or other consent-based processing
Use our account and data request form, or email support@wiggle.energy, and we will respond without undue delay, and within one month where the law requires it.
Complaints
If you are unhappy with how we have handled your data, please contact us first so we can put it right. You also have the right to complain to the Information Commissioner’s Office (ICO).
Changes
We may update this notice as the site or product develops. The “Last updated” date at the top will change when we do. Continued use of the site after a change means you should read the updated notice.