SG Nexus Solar — Privacy Policy

Effective date: 29 July 2026 Last updated: 7 August 2026

This Privacy Policy explains how DCI Industries LLC, a Tennessee limited liability company doing business as SG Nexus and SG Nexus Solar ("SG Nexus", "we", "us", "our"), collects, uses, discloses, and protects personal information when you use sg-nexus.com and the SG Nexus Solar platform (the "Services").

It applies to everyone who uses the Services. Section 11 contains additional disclosures for particular regions, including Australia, and those disclosures prevail over the general provisions of this policy for people in those regions.

This policy forms part of, and should be read with, our Terms of Service.

1. A short summary

We are an independent solar information platform. We collect the information we need to run the platform, answer your questions well, and bill you correctly. Because good solar answers depend on where you are and what you already have, we collect information about your location, your site, and your system — and that is the most personal information most users give us.

The things we want you to know up front:

• We do not sell your personal information, and we never have.
• We do not pass your details to installers, retailers, or anyone else as a sales lead. This is a permanent commitment of the platform, not a setting.
• We do not use your questions or your uploaded documents to train artificial intelligence models, and our AI providers are contractually prohibited from doing so.
• We operate from the United States, so information about you is processed in the United States and in other countries where our providers operate.

The rest of this policy sets out the detail.

2. Personal information we collect

2.1 Information you give us

Account information. Your name, email address, password (stored in hashed form), and any optional profile details such as your organisation, role, or display name.

Billing information. Your billing name, billing address, country, plan, purchase history, usage credit balance, transaction records, and tax status. We do not collect or store full payment card numbers. Card details are entered directly with our payment processor, which handles them under its own security standards and privacy policy. We receive only limited data such as the card brand, last four digits, expiry, and authorisation result.

Inputs to the platform's Intelligent Surfaces. When you use Solar Assistant or My Solar, we collect what you submit, which may include:

• your questions, prompts, and conversation history;
• your location at the level you provide it — postcode, suburb, town, state or territory, and in some cases your street address, because rebates, network rules, tariffs, and connection requirements differ by state and by distribution network;
• details of your property and site, such as dwelling type, roof orientation, shading, available space, and switchboard or metering arrangements;
• details of your existing or proposed system, such as panel, inverter, battery, and generator makes and models, capacities, ages, configurations, and monitoring data;
• your energy consumption and generation information, including electricity bills, meter data, tariff details, and usage patterns;
• quotations, proposals, invoices, designs, and other documents you upload, including any information about a third party contained in them;
• photographs you upload of your site, roof, switchboard, or equipment.

Support and communications. The content of emails, support tickets, and other correspondence with us, and any information you choose to include in them.

Feedback and research. Ratings you give to answers, survey responses, and anything you submit if you take part in research, testing, or a user interview.

Installer Directory listings. If you are a provider who submits a listing, we collect your business name, contact details, service areas, stated licences, accreditations, insurances, and any other profile content you supply.

Community and question sources. Where we compile common questions from public sources in order to decide what to write about, we record the question text only. We do not record the identity of the person who asked it, and we do not build profiles of people from public posts.

2.2 Information we collect automatically

Technical and device information. IP address, approximate location derived from IP address, browser type and version, operating system, device type, screen characteristics, language, and time zone.

Usage information. Pages viewed, content read, features used, searches run, links followed, session times, referring pages, usage credit consumption events, and error and diagnostic logs.

Cookies and similar technologies. See Section 9.

2.3 Information from third parties

Payment processor. Transaction outcomes, chargeback and dispute notices, and fraud signals.

Authentication providers. If you sign in using a third-party account, we receive your identifier and basic profile information from that provider.

Analytics and infrastructure providers. Aggregated and technical information about how the Services are performing.

Public and licensed sources. Publicly available business, licensing, and product information used to build and maintain our content and directory.

2.4 Information we ask you not to give us

Please do not submit sensitive information to the platform. In particular, do not submit government identifiers, payment card numbers, health information, biometric information, or information revealing racial or ethnic origin, political opinions, religious beliefs, sexual orientation, union membership, or criminal history. We do not need it, and we do not want it in the system.

If you upload a document containing another person's personal information — for example, an installer's name and contact details on a quotation — you are responsible for having a lawful basis to provide it, and we handle it only for the purpose of responding to your request.

3. How we use personal information

We use personal information for the following purposes:

Providing the Services. Creating and administering your account, authenticating you, delivering content, generating answers through Solar Assistant and My Solar, saving your system profile and history, and maintaining your settings.

Making answers relevant to you. Using your location, site, system, and consumption information so that answers reflect the rebates, network rules, standards, tariffs, and conditions that actually apply where you are, rather than a national average.

Billing and account management. Processing platform access fees and usage credit purchases, maintaining your usage credit balance, applying consumption charges, issuing invoices and receipts, handling refunds, and managing renewals, failed payments, and disputes.

Supporting you. Responding to enquiries, investigating problems, and communicating with you about your account, your access, your usage credit, and changes to the Services or to our terms.

Improving the Services. Understanding which content and features are used and where they fall short, identifying gaps in our coverage, diagnosing errors, testing changes, and measuring performance. Wherever it is practical to do so, we use de-identified or aggregated information for this purpose.

Improving the knowledge base. We may extract general technical information, mathematical formulas and equipment data from what you upload to improve the knowledge base. All data is sanitized and no personal or business data is recorded. We do not use any of your data to train AI models.

Deciding what to publish. Analysing the questions people ask, in aggregate and without identifying individuals, to decide what to research and write next.

Safety, security, and abuse prevention. Monitoring for fraud, abuse, scraping, unauthorised access, and breaches of our Terms of Service; investigating incidents; and protecting our users, our systems, and the public.

Legal and compliance. Meeting our legal, tax, accounting, and regulatory obligations, responding to lawful requests, establishing and defending legal claims, and enforcing our terms.

Marketing, if you have chosen to receive it. Sending news, updates, and offers about the Services. You can unsubscribe from marketing at any time using the link in any marketing email or by contacting us. We do not sell your details to third-party marketers, and we do not send you marketing on behalf of installers or retailers.

3.1 What we do not do with your information

To be explicit, because this is the question we are most often asked:

• We do not sell, rent, or trade personal information.
• We do not share your details with installers, retailers, manufacturers, brokers, or lead-generation businesses.
• We do not accept payment from any provider in exchange for exposure, ranking, referral, or recommendation.
• We do not use your Inputs or the answers generated for you to train artificial intelligence models.
• We do not use your information to build advertising profiles or to target you with third-party advertising.

4. Artificial intelligence and model training

Solar Assistant and My Solar generate answers using large language models supplied by third-party artificial intelligence providers. When you use those features, the content of your request — including any site, system, or document information you have provided for that request — is transmitted to the provider so that a response can be generated.

We contract with those providers on terms under which your content is not used to train their models. The provider processes it to return a response, retains it only for the limited period their terms permit for abuse-monitoring purposes, and does not use it for any other purpose.

We do not train models of our own on your content, and we do not build training datasets from user Inputs or Outputs. We may use aggregated statistics and de-identified examples to evaluate and improve the quality of our own prompts, retrieval, and content — never in a form that identifies you.

We may retain and review specific content where it has been flagged for safety, security, or abuse reasons, or where we are required to do so by law.

Where an automated system makes a decision about you that produces a legal or similarly significant effect — for example, an automated fraud or abuse determination that restricts your account — you may ask us to review it, and Section 8 explains how.

5. Who we share personal information with

We share personal information only in the circumstances below.

Service providers and sub-processors. We use third parties to run the Services on our behalf, and share only what each needs. The categories are:

Each is bound by contract to use the information only for the purposes we specify, to keep it secure, and not to use it for their own purposes. We maintain a current list of sub-processors and will provide it on request to admin@dci-us.com.

Corporate transactions. If we are involved in a merger, acquisition, financing, reorganisation, or sale of assets, personal information may be transferred as part of that transaction, subject to the acquirer continuing to handle it in accordance with this policy or giving you notice of any change.

Legal and safety disclosures. We may disclose personal information where we reasonably believe it is necessary to comply with a law, regulation, subpoena, court order, or lawful government request; to enforce our Terms of Service; to detect, prevent, or address fraud, security, or technical issues; or to protect the rights, property, or safety of any person. Where we are permitted to do so, we will notify you of a legal request affecting you.

With your direction. If you connect a third-party service to your account or ask us to share information with someone, we will do so as you direct. Once information reaches a third party at your direction, its handling is governed by that party's privacy policy, not ours.

Aggregated and de-identified information. We may publish or share statistics and insights that do not identify any individual — for example, the most common questions asked in a given state — and this is not personal information.

6. International transfers

We are based in the United States and the Services are operated from there. Our providers may operate in the United States and in other countries.

If you are outside the United States, your personal information will be transferred to, stored in, and processed in the United States and in other countries whose data protection laws may differ from those of your own country. By using the Services you acknowledge this transfer. Acknowledging it is not the same as consenting to it, and we do not rely on your use of the Services as consent for any purpose that requires consent.

Where the law requires a transfer mechanism, we rely on the appropriate one — for example, standard contractual clauses for transfers from the European Economic Area or the United Kingdom. For Australia, our position on cross-border disclosure under Australian Privacy Principle 8 is set out in Section 11.1.

In every case, and independently of any consent or transfer mechanism, we take reasonable steps to ensure that overseas recipients handle personal information consistently with this policy, including by binding them contractually to appropriate data protection, confidentiality, security, and purpose-limitation obligations.

7. Retention, de-identification, and security

7.1 How long we keep information

We keep personal information only as long as we need it for the purposes described in this policy, or for as long as the law requires.

We may retain information for longer where it is subject to a legal hold, needed to establish or defend a legal claim, or required by law. When we no longer need information, we delete it or irreversibly de-identify it.

7.2 De-identification and aggregation

We de-identify and aggregate information for analytics, quality measurement, and content planning. Once information has been de-identified so that it can no longer reasonably be associated with you, we may retain and use it indefinitely, and we do not attempt to re-identify it.

7.3 Security

We maintain technical and organisational measures appropriate to the risk, including encryption of data in transit and at rest, hashed password storage, role-based access controls and least-privilege access for our personnel, network and application security controls, logging and monitoring, secure development practices, contractual security obligations on our providers, and incident response procedures.

No system is completely secure. We cannot guarantee the security of information transmitted to or stored by us, and you provide it at your own risk. Protect your account by using a strong, unique password and by telling us promptly if you suspect unauthorised access.

If a data breach occurs that is likely to result in serious harm, we will notify affected individuals and the relevant regulator as required by law. For Australia, this includes the Notifiable Data Breaches scheme described in Section 11.1.

8. Your rights and choices

Depending on where you live, you may have some or all of the following rights:

• Access — to be told whether we hold personal information about you and to obtain a copy of it.
• Correction — to have inaccurate or incomplete information corrected.
• Deletion — to have your personal information deleted, subject to legal retention requirements.
• Portability — to receive certain information in a structured, commonly used, machine-readable format.
• Objection and restriction — to object to, or ask us to restrict, certain processing.
• Withdrawal of consent — to withdraw consent where we rely on it, without affecting processing already carried out.
• Opt out of marketing — at any time.
• Opt out of sale or targeted advertising — although, as stated, we do not sell personal information or engage in targeted advertising.
• Human review of automated decisions — where an automated decision has a legal or similarly significant effect on you.
• Non-discrimination — we will not deny you service, charge you a different price, or provide you a lower quality of service because you exercised a privacy right.

8.1 How to exercise your rights

Many things can be done directly in your account settings, including updating your details, changing marketing preferences, and closing your account. Closing your account deletes your personal information, including your Solar Assistant conversation history and your My Solar profiles and uploads, subject to the legal retention requirements in Section 7.

For anything else, contact admin@dci-us.com with the email address on your account and a description of your request. We will verify your identity before acting, which may require additional information. We respond within the period required by the applicable law, and in any case within 30 days, or we will tell you why we need longer.

You may use an authorised agent where the law permits, provided we can verify the agent's authority.

If you are unhappy with our response, you may ask us to review it by writing to admin@dci-us.com with "Privacy appeal" in the subject line, and you may complain to your regulator. Section 11 lists the relevant regulators.

9. Cookies and similar technologies

We use cookies and similar technologies for the following purposes:

Strictly necessary. Signing you in, keeping you signed in, maintaining session state, load balancing, and security. These cannot be turned off without breaking the Services.

Functional. Remembering your preferences, such as your state or region, display settings, and language.

Analytics. Understanding how the Services are used so we can improve them, measured in aggregate.

We do not use advertising or cross-site tracking cookies, and we do not allow third parties to place advertising cookies through the Services.

You can control cookies through your browser settings, and where required by law we present a cookie banner allowing you to accept or decline non-essential cookies. Blocking strictly necessary cookies will prevent the Services from working. We honour Global Privacy Control and similar browser-level opt-out signals where the law requires it.

10. Children

The Services are not directed at children, and we do not knowingly collect personal information from anyone under 18. Account holders must be at least 18 years old.

If you believe a child has provided us with personal information, contact admin@dci-us.com and we will delete it promptly.

11. Regional disclosures

11.1 Australia

This section applies to individuals in Australia and prevails over the general provisions of this policy to the extent of any inconsistency.

Application of the Privacy Act. We handle personal information about individuals in Australia in accordance with the Privacy Act 1988 (Cth) ("Privacy Act") and the Australian Privacy Principles ("APPs"). In this section, "personal information" and "sensitive information" have the meanings given in the Privacy Act.

Why we collect it (APP 3). We collect personal information for the purposes set out in Section 3 of this policy. We collect it directly from you wherever it is reasonable and practicable to do so. You may deal with us anonymously or under a pseudonym where it is lawful and practicable — for example, when browsing published content — but we cannot provide an account, paid access, personalised answers, or support without identifying you.

Sensitive information. We do not seek sensitive information and ask you not to provide it. Where sensitive information is inadvertently provided, we will not use or disclose it for any purpose other than the one for which it was provided, and we will delete it where practicable.

Unsolicited information (APP 4). If we receive personal information we did not solicit and could not lawfully have collected, we will destroy or de-identify it as soon as practicable, provided it is lawful and reasonable to do so.

Direct marketing (APP 7). We use personal information for direct marketing only where you would reasonably expect it or where you have consented. Every marketing message includes an unsubscribe facility, and you may ask us at any time not to use or disclose your information for direct marketing by contacting admin@dci-us.com. We do not disclose your personal information to any other organisation for that organisation's direct marketing purposes, and we do not supply your details to installers, retailers, or lead buyers.

Cross-border disclosure (APP 8). We are based in the United States, and personal information about you will be disclosed to overseas recipients. The countries in which recipients are likely to be located are the United States, and, depending on the provider, other countries in which our cloud hosting, artificial intelligence, payment processing, email, analytics, and support providers operate, which may include member states of the European Union, the United Kingdom, Canada, Japan, Singapore, and Australia itself.

Our primary position is that we take reasonable steps under APP 8.1 to ensure overseas recipients do not breach the APPs, including by binding each recipient contractually to obligations substantially equivalent to the APPs, limiting what each recipient receives to what it needs, and requiring appropriate security controls. We stand behind that position, and it applies whether or not you have given any consent.

Separately, where we ask for it, we may seek your express consent to a specific overseas disclosure under APP 8.2(b). Any such consent will be sought clearly and specifically at the time, and you may decline or withdraw it. We do not treat your mere use of the Services as consent for the purposes of APP 8.2(b), and nothing in this policy operates to displace our accountability under APP 8.1 by implication.

If you would prefer that your personal information not be disclosed overseas, contact admin@dci-us.com. Because the platform is operated from the United States, we may not be able to provide the Services to you on that basis, and we will tell you plainly if that is the case.

Data quality and security (APPs 10 and 11). We take reasonable steps to ensure the personal information we collect, use, and disclose is accurate, up to date, complete, and relevant, and to protect it from misuse, interference, loss, and unauthorised access, modification, or disclosure, as described in Section 7.3. We destroy or de-identify personal information when we no longer need it for any permitted purpose, unless we are required to retain it.

Notifiable Data Breaches. We comply with the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act. If we have reasonable grounds to believe an eligible data breach has occurred, we will notify affected individuals and the Office of the Australian Information Commissioner ("OAIC") as required.

Access and correction (APPs 12 and 13). You may request access to, and correction of, the personal information we hold about you by contacting admin@dci-us.com. We will respond within 30 days. We do not charge for making a request; we may charge a reasonable cost-based fee for giving access, and if we do we will tell you first. If we refuse access or correction, we will give you written reasons and tell you how to complain. If we refuse to correct information, you may ask us to attach a statement noting that you consider it inaccurate, and we will do so.

Complaints. If you believe we have breached the APPs, contact admin@dci-us.com with "Privacy complaint" in the subject line. We will acknowledge your complaint within 7 days and respond substantively within 30 days. If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner:

Office of the Australian Information Commissioner

GPO Box 5218, Sydney NSW 2001

Telephone 1300 363 992

www.oaic.gov.au

Spam and telemarketing. We comply with the Spam Act 2003 (Cth) and the Do Not Call Register Act 2006 (Cth). We do not make unsolicited marketing calls, and we do not engage anyone to make them on our behalf.

Governing law for privacy matters. Notwithstanding any provision of our Terms of Service, disputes about our handling of personal information about individuals in Australia may be dealt with under Australian law and by the OAIC.

11.2 United States

No sale or sharing. We do not sell personal information, and we do not share it for cross-context behavioural advertising, as those terms are used in United States state privacy laws. We have not done so in the preceding 12 months. We do not knowingly sell or share the personal information of anyone under 18.

Categories. In the preceding 12 months we have collected the categories of personal information described in Section 2, for the purposes described in Section 3, from the sources described in Section 2, and disclosed them for business purposes to the categories of recipients described in Section 5.

Your rights. If you are a resident of California, Tennessee, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, or another state with a comprehensive privacy law, you have the rights listed in Section 8 to the extent that law provides them, including rights to know, access, delete, correct, obtain a portable copy, opt out of sale, sharing, targeted advertising, and certain profiling, and to appeal a refusal. Exercise them as described in Section 8.1. We will not discriminate against you for doing so.

Sensitive personal information. We do not collect sensitive personal information for the purpose of inferring characteristics, and we do not use or disclose it beyond the purposes permitted without a right to limit.

Shine the Light. California residents may request information about disclosures of personal information to third parties for their direct marketing purposes. We make no such disclosures.

Appeals. If we decline a request, you may appeal by writing to admin@dci-us.com with "Privacy appeal" in the subject line. If your appeal is denied, you may contact your state attorney general.

11.3 European Economic Area, United Kingdom, and Switzerland

Controller. DCI Industries LLC is the controller of personal information processed through the Services.

Legal bases. We rely on the following legal bases under the General Data Protection Regulation and the UK GDPR:

Your rights. In addition to Section 8, you have the right to lodge a complaint with your supervisory authority. In the United Kingdom this is the Information Commissioner's Office (ico.org.uk).

Transfers. Transfers out of the EEA, the UK, and Switzerland are made under the European Commission's standard contractual clauses, the UK International Data Transfer Addendum, or another lawful mechanism, together with supplementary measures where appropriate.

11.4 Canada

We rely on express consent where required and implied consent where the purpose is obvious and you voluntarily provide the information. Personal information is transferred to and processed in the United States and may be accessible to United States authorities under United States law. You may contact admin@dci-us.com to exercise your rights or to obtain further information about our policies and practices in relation to service providers outside Canada, and you may complain to the Office of the Privacy Commissioner of Canada.

12. Changes to this policy

We may update this policy. When we do, we will change the "Last updated" date at the top and post the revised policy in the Services.

If a change is material — for example, a change to the purposes for which we use personal information, or to the categories of recipients — we will give you prominent notice before it takes effect, and where the law requires it we will obtain your consent. Continued use of the Services after a change takes effect means you accept the updated policy.

We keep prior versions and will provide one on request.

13. How to contact us

Privacy enquiries, access and correction requests, complaints, and appeals: admin@dci-us.com

General platform support, accounts, and billing: support@sg-nexus.com

Postal address: DCI Industries LLC d/b/a SG Nexus, d/b/a SG Nexus Solar 116 Agnes Rd, Knoxville, TN 37919 United States

If you are in Australia and are not satisfied with our response, you may contact the Office of the Australian Information Commissioner at www.oaic.gov.au or 1300 363 992.

This Privacy Policy should be read together with the SG Nexus Solar Terms of Service.