Privacy Notice

Who we are

DemandQ, Inc. operates the website www.demandq.ai and the demand-response product marketed as DRMax. We help California commercial and industrial businesses — warehouses, manufacturers, distribution centers, and similar facilities — participate in utility demand-response programs and get paid for reducing electricity use during grid stress events.

Our privacy contact is contactus@demandq.com.

What we collect and why

Email engagement signals

We send cold outreach emails to business contacts whose information is already in our CRM. When we do, each email contains:

• A 1×1 invisible image (a “tracking pixel”) hosted at https://www.getdemandq.com. If your email client loads remote images, we record that the email was opened, along with an approximate timestamp.
• Tracked links that pass through https://www.getdemandq.com/t/c/<token> before redirecting to the destination URL. Clicking a link tells us the link was clicked and when.

What we know from this: your email address, your internal contact ID in our CRM, whether you opened the email, whether you clicked a link, and roughly when. We do not know who specifically loaded the image if your email client pre-fetches images on your behalf.

Why we collect it: to measure whether our outreach is relevant and worth your time, and to avoid following up with people who have shown no interest.

Website analytics

When you visit www.demandq.ai, two analytics tools run on the page: PostHog (US-based) and Google Analytics 4. Between them, they collect:

• Pages you visit and how long you stay
• Which buttons you click and which forms you interact with, including whether you start a form and leave without submitting
• How far down the page you scroll
• Links you click that take you off our site
• Aggregate heatmap data (which areas of a page people click most)
• A sample of anonymized session recordings — see “Session recordings” below for what is and is not captured
• City- or region-level location derived from your IP address (we do not store your raw IP)
• Browser type, operating system, and device category

If you arrived from one of our outreach emails and clicked a tracked link, the redirect appended your CRM contact ID to the destination URL as a query parameter (ph_distinct_id). PostHog uses that parameter to connect your site visit to your outreach record so we can see which emails actually drove engagement. If you arrived organically, PostHog does not create a named profile for you — anonymous visits stay anonymous.

Savings calculator

The savings estimator on the DRMax page asks for inputs like your monthly kWh usage, building type, and utility. We use those inputs to compute and display your estimate. We also capture those inputs as analytics events in PostHog so we can improve the calculator. We do not store raw calculator responses in a database linked to your identity unless you then submit an enrollment or interest form.

Session recordings

PostHog records a sample of website sessions as anonymized click-and-scroll playback. We use these recordings to spot usability problems — for example, to see whether visitors who open the “Enroll Now” form are getting stuck on a particular field instead of completing it. Recordings are stored by PostHog (US) and are accessible only to DemandQ team members.

• What is captured: cursor movement, clicks, scroll position, page navigation, and the visible structure of the pages you viewed.
• What is masked: the contents of input fields (including everything you type into the Savings Calculator, enrollment form, and interest form) and any element we have tagged as sensitive. We see that you interacted with a field; we do not see what you typed.
• How long it is kept: recordings are retained for up to 30 days and then deleted by PostHog under its standard retention policy.
• How to opt out: if your browser sends a Global Privacy Control (GPC) signal, we exclude your session from recording. You can also email contactus@demandq.com and we will delete any recording associated with your CRM contact ID and stop recording your future sessions.

What we do not collect

• Keystroke logging outside of explicit form submissions, and we do not capture the contents of any input field in session recordings (see “Session recordings” above)
• Audio, video, or biometric data of any kind
• Precise geolocation (GPS)
• Health, financial account, or any other sensitive personal information category defined under CPRA Section 1798.121

How we use this information

• To measure outreach effectiveness and decide which topics resonate with which types of businesses
• To improve the website (heatmaps tell us which sections are confusing or overlooked)
• To follow up personally with prospects who showed interest — we do not use automated decision-making that has legal or similarly significant effects on you

What we do not do

• We do not sell your personal information to any third party.
• We do not share your personal information with third parties for cross-context behavioral advertising.
• We do not use your information for any purpose inconsistent with what is described here.

Cookies and tracking technologies

Our website uses cookies and similar technologies (such as local storage and pixel tags) to keep our analytics tools working and to remember basic preferences across visits.

• Strictly necessary cookies: none today. The site does not require login.
• Analytics cookies: PostHog sets a first-party cookie to maintain anonymous session identity for the duration of your visit. Google Analytics 4 sets cookies (typically _ga and _ga_*) to measure visitors, sessions, and conversion. Both vendors are listed in the Sub-processors section below.
• Email pixels: the 1×1 tracking pixel in our outreach emails is not a cookie. It is an image request your email client makes when remote images are loaded. Disabling remote-image loading in your email client prevents this signal.

Your controls:

• Most browsers let you block or delete cookies from the Settings panel. Blocking cookies will not break the site.
• To opt out of Google Analytics across all sites, install the Google Analytics opt-out browser add-on.
• If your browser sends a Global Privacy Control (GPC) signal, we honor it as described in the section below.

Sub-processors

We share data with the following third parties who process information on our behalf:

None of these sub-processors are authorized to use your information for their own marketing or to sell it.

Your rights under CCPA/CPRA

If you are a California resident, you have the following rights. You can exercise any of them by emailing contactus@demandq.com or using the unsubscribe link in any email we have sent you.

• Right to know. You can ask what personal information we have collected about you in the last 12 months, where it came from, how we use it, and whether we share it with anyone.
• Right to delete. You can ask us to delete your personal information. We will do so and ask our sub-processors to do the same, subject to legal exceptions (for example, records we are required to retain for fraud prevention or legal compliance).
• Right to correct. If the information we have about you is inaccurate, you can ask us to fix it.
• Right to opt out of sale or sharing. We do not sell or share your personal information for advertising purposes. You therefore have nothing to opt out of under this provision, but the right exists and we acknowledge it.
• Right to limit use of sensitive personal information. We do not collect sensitive personal information as defined by CPRA. You have the right to limit its use if we ever did.
• Right to non-discrimination. Exercising any of these rights will not affect your ability to use our services or receive our content.

We will respond to verifiable requests within 45 days. We may ask you to verify your identity before disclosing or deleting records.

Global Privacy Control (GPC)

If your browser sends a GPC signal (supported by browsers like Firefox with privacy extensions, Brave, and others), we treat it as an opt-out of data sharing for advertising purposes and as an instruction to exclude your session from session recording. Because we do not conduct cross-context behavioral advertising, the practical effect is that PostHog and GA4 continue to collect anonymous analytics (pageviews, clicks, aggregate counts) for our internal measurement purposes only, but no session recording is captured for visits where GPC is active.

Children’s privacy

Our website and outreach are intended for business audiences. The services are not directed to children under 13, and we do not knowingly collect personal information from children under 13 (or under 16 where state law sets a higher age). If you believe we have inadvertently collected information from a child, please email us at contactus@demandq.com and we will delete it promptly.

Unsubscribe

Every email we send includes an unsubscribe link. Clicking it removes you from our outreach lists and we will not email you again. You can also email contactus@demandq.com with the subject “Unsubscribe” and we will handle it manually within 10 business days.

Data retention

We retain personal information for as long as is reasonably necessary to fulfill the purposes described above. For the right-to-know lookup, we can report on data collected in the prior 12 months. Email engagement logs (open/click timestamps) are retained for up to 24 months. Web analytics data retention is governed by PostHog’s and Google’s own policies; we do not have a shorter custom retention configured at this time.

Business transactions

If DemandQ is involved in a merger, acquisition, financing, reorganization, asset sale, or bankruptcy, personal information may be among the assets transferred. We will require any successor to honor this Privacy Notice with respect to the information transferred, or to provide affected individuals with notice of any material change in handling and an opportunity to opt out where required by law.

Changes to this notice

If we make material changes, we will update the “Last updated” date at the top of this page. We will not retroactively apply material changes to data already collected without notifying affected contacts directly.

Contact us

Questions, requests, or concerns about this privacy notice:

Email: contactus@demandq.com

We aim to respond to all inquiries within 5 business days and to all formal rights requests within 45 days.