Privacy Policy

Ndili Technologies, Inc. · Effective date: October 13, 2026 · Last updated: October 13, 2026

This policy covers two things: the PG&E Toolkit - Pro app (and our other apps), and our website for the app, myutilitytoolkit.com. It explains what we collect, why we collect it, who else sees it, how long we keep it, and what you can ask us to do. It replaces our earlier privacy policy.

1. Who we are

Ndili Technologies, Inc. ("Ndili," "we," "us") is a company based in San Jose, California. Our mailing address is 333 Hegenberger Rd, Suite 503, Oakland, CA 94621. To reach us about privacy, email support@ndilitechnologies.com.

Ndili Technologies, Inc. receives PG&E customer data through PG&E's Share My Data (Green Button Connect) program, only with each customer's authorization. Ndili Technologies is independent and is not affiliated with or sponsored by PG&E.

2. The app: what we collect and why

Your PG&E data

When you connect your PG&E account, PG&E asks you to authorize Ndili through its Share My Data program. Once you do, we request from PG&E:

• your electric meter data (interval usage, which shows how much electricity you used at each time of day), and
• your PG&E billing data,

for up to the past four years, and then once a day after that. New data usually arrives one to two days behind the current date. The information PG&E sends with it can include details of your service account, such as your service account number, service address, and rate schedule. We also keep the authorization that PG&E gives us so the app can keep refreshing your data until you withdraw it.

Settings you enter

If you enter settings the app needs to price your plans correctly, such as your baseline territory, heat source, Medical Baseline setting, or whether to use historic rates, the app uses them for that purpose only.

Your account, notifications, and diagnostics

If you authorize access to your electric meter usage data, this app uses it to calculate and display energy usage costs across available rate tariffs. If you authorize access to billing data, the app stores and displays that. The app does not have or need a user name, email or password. It does not store such. It stores a push notification token if you authorize push notifications.

You can turn off the daily "New Data Available" notification and the monthly "Rate Comparison Check and Recommendation" notification separately in the app.

Your subscription

Subscriptions are handled by Apple or Google. They process your payment, and we never see your card number. We receive whether you are subscribed or in your free trial.

Why we use it

• To show you what your past electricity use would have cost on each PG&E residential rate plan.
• To run the automatic monthly check on our servers (it works even when you do not open the app) and tell you which plan would have cost the least over the last 365 days, or that your plan already did.
• To keep your data up to date, send the notifications you have turned on, and answer your support requests.
• To keep the service secure and fix problems.

We do not use your PG&E data for advertising, we do not sell it, and we do not use it to make decisions about you other than showing you these comparisons.

3. How long we keep your data

While you subscribe, we keep your PG&E data on our servers so the app and the monthly check can work. After you cancel your subscription, we keep your data until you ask us to delete it. We delete your data as soon as you ask, whether you have cancelled or have deleted your account.

If you withdraw your authorization at PG&E's Share My Data portal, we stop collecting new data from PG&E. Withdrawing at PG&E does not by itself delete what we already hold. To have that deleted, ask us (section 8).

When we delete your data, we delete it from the systems we use every day. Copies in routine backups are removed when those backups expire. We may keep a short record that you made a request, and the minimum information the law requires us to keep.

4. The website (myutilitytoolkit.com)

The contact form

If you use the contact form on the Support page, we collect your name, your email address, your message, and the page of our website you sent it from. Your browser sends them to Ndili's own contact service, which notifies us and emails us the message. We use them to read and reply to your message. Please do not put your PG&E account number, passwords, or payment details in your message. We will not ask for them.

We keep support messages as long as we need them to help you and keep a record of the conversation, and we delete them when you ask. To protect the form from spam we use a hidden field that people do not see and automated bots usually fill in. We do not use a CAPTCHA service.

Visit statistics (Google Analytics)

The website uses Google Analytics 4 to count visits and see which pages people read. Google Analytics sets cookies in your browser (named like _ga and _ga_ followed by letters and numbers) and receives information about your visit: the pages you view, how you arrived, your approximate location (city or region), your browser and device type, and your language. Your browser sends your IP address to Google as part of the request. Google says Google Analytics 4 does not log or store individual IP addresses and uses them only to work out an approximate location.

We have turned off advertising features, Google signals, and remarketing, and we do not link Google Analytics to any advertising account. We set Google Analytics to keep detailed visit data for no more than 14 months. Google Analytics runs only on the live website. Google's privacy information is at policies.google.com/privacy.

Do Not Track and Global Privacy Control

If your browser sends a Global Privacy Control or Do Not Track signal, the website does not load Google Analytics for your visit. The rest of the website, including the contact form, still works. You can also block or delete the Google Analytics cookies in your browser settings, or use Google's opt-out add-on at tools.google.com/dlpage/gaoptout.

Server logs

Our web server automatically records standard technical information each time a page is requested: IP address, date and time, the page requested, and browser type. We use it to keep the website running and to deal with abuse, and we keep it only as long as needed for those purposes.

What the website does not do

The fonts are hosted on our own server, so your browser does not contact Google Fonts. The website has no advertising pixels, no social-media trackers, no chat widget, no embedded video or maps, and no cookies other than the Google Analytics cookies above. It links to the Apple App Store and Google Play. If you click one, you leave our site and their privacy policies apply.

5. Who we share information with

We do not sell your personal information. We do not share it for cross-context behavioral advertising (advertising based on your activity across different sites or apps).

We share information only with companies that do work for us, and only for that work, and in the cases listed below:

We may also disclose information if the law requires it, to protect against fraud or a security problem, or if Ndili merges with or is bought by another company. In that case, the new owner must honor this policy for the data it receives.

6. Sensitive information

California's privacy law treats some information as "sensitive," such as health information and precise location. A Medical Baseline setting or a service address can fall into those groups. We use any such information only to provide the app features you asked for. We do not use it to guess other things about you, and we do not sell or share it.

7. Security

We protect your information with reasonable safeguards: encrypted connections (HTTPS) between the app, the website, and our servers; access to customer data limited to the people who need it to run and support the service; and care in how we store the authorization PG&E gives us. No system is perfectly secure, and we cannot promise otherwise. If we learn that your personal information was accessed without permission, we will tell you as the law requires.

8. Your choices and your California privacy rights

You can ask us to delete your data at any time, whether you are still subscribed, have cancelled, or have deleted your account. If you live in California, you also have the right to:

• Know what personal information we collect, use, and disclose about you, and get a copy of it.
• Delete the personal information we collected from you, with a few legal exceptions.
• Correct personal information about you that is wrong.
• Opt out of sale or sharing. We do not sell or share your personal information, so there is nothing to opt out of.
• Limit the use of sensitive personal information. We use it only to provide the app, so there is nothing further to limit.
• Not be treated worse for using these rights.

How to ask: email support@ndilitechnologies.com and say what you want us to do (for example, "delete my data"). Write from the email address you use with the app, or tell us the device and account you use, so we can confirm it is you. We delete your data as soon as we receive your request and have confirmed who you are, and we confirm by email when it is done. If we ever need more time, we will tell you, and we will not take more than 45 days. You can also ask someone to make a request for you; we may ask for written proof they are authorized.

California's "Shine the Light" law (Civil Code section 1798.83) lets you ask which personal information a company shares with others for their direct marketing. We do not share personal information for others' direct marketing.

9. The categories of information we collect (California's list)

In the last 12 months we have collected these categories of personal information: identifiers (name, email address, and IP address on the website; the account or device identifiers described in section 2); commercial information (your subscription status, and your electric usage and billing data from PG&E); internet activity (website visit statistics); and approximate location from website visits, plus the service address that comes with your PG&E data. We collected them from you, from PG&E with your authorization, and from the tools described above. We did not sell or share any of them for advertising. We disclosed them to the service providers in section 5 for business purposes.

10. Children

The app and the website are for adults who pay a PG&E electric bill. They are not directed to children under 16, and we do not knowingly collect personal information from children under 16. If you believe a child has sent us information, contact us and we will delete it.

11. Other places, and changes to this policy

Our services are meant for people with PG&E electric service in California, and they are not directed to people in the European Economic Area or the United Kingdom. Information is handled in the United States.

When we change this policy in a way that matters, we will post the new version at this address and change the "last updated" date. If a change affects how we use the data in the app, we will also tell app users in the app or by email.

12. Contact

Ndili Technologies, Inc., San Jose, California. Questions, access requests, and deletion requests: support@ndilitechnologies.com.