Skip to main content
Energy Review

Privacy Policy

Last updated: July 2026

Who We Are

This privacy policy applies to Energy Review, operating at energy-review.co.uk. We publish data-driven comparisons of the UK's major domestic energy suppliers to help consumers make informed choices. This site is informational only; we do not sell energy or process any energy contracts.

For any privacy-related queries, please contact us at privacy@energy-review.co.uk.

What Data We Collect

You do not need an account to read anything on this site, and we never ask for postal addresses or payment details. We do collect the following.

If you leave a comment. We store the name you give, your comment, and — if you choose to supply one — your email address. We also store a one-way hashed form of your IP address, used solely to detect spam and abuse. Your email address is never published and is not shown to other visitors. Lawful basis: our legitimate interest in hosting a moderated discussion.

If you use the contact form. Your name, email address and message are sent to us through Netlify Forms so that we can reply. Lawful basis: our legitimate interest in responding to enquiries.

Measurement of how the site is used. We record the pages you open on this site, and the time you open them. We do the same when you click an outbound supplier link or when an on-site notice appears. We record the path of the page only — never anything you typed into a search box, and never the rest of the web address. We also record which country the visit came from, and which region or nation within it, worked out from your IP address at the point the request arrives. That lets us tell UK readers from the rest and see which parts of the country we are read in. We never record your town, your postcode or your coordinates. Where another website linked you here, we record that website's domain — never the full link, and never anything you typed into a search engine. To count unique visitors rather than raw page views, we attach an identifier derived on our servers from your IP address and browser, salted with a value that changes every day. It is not stored in your browser and, because the salt rotates, it cannot be used to follow you from one day to the next, nor to link your activity on one part of the site to another. We rely on our legitimate interest in understanding which pages are useful. This does not require consent because nothing is stored on or read from your device — and you have the right to object to it. Write to us at the address above and we will respond. You should know what the design means in practice, though: the identifier is worked out on our servers, changes every day, and is stored nowhere on your device, so we hold nothing that lets us tell your records apart from anyone else's. That means we cannot pick them out to delete them, and we cannot flag you to be left out of future counts. If you would rather not be counted, a browser extension that blocks analytics requests will stop the measurement reaching us.

Analytics cookies (Google Analytics 4 and Microsoft Clarity). These are different: they do store information on your device, so they are off by default and run only if you opt in via the consent banner.

Cookies

We use a consent management platform provided by Silktide to manage cookie preferences. When you first visit the site, a consent banner is shown. No analytics or behavioural cookies are set until you accept them.

The following cookie categories may be active on this site:

Strictly Necessary

These cookies are required for the website to function. They do not require consent and cannot be disabled via the cookie banner.

  • Silktide consent cookie — Stores your cookie preferences so we do not show the banner on every page. Duration: approximately 1 year.
  • Notice dismissal cookie (exit_popup_dismissed_*) — Records that you closed an on-site notice, so it is not shown to you again. It contains no identifier and exists only to honour that choice. Duration: as shown in the notice, typically 30 days.

Analytics (consent required)

These cookies are only set if you opt in. They help us understand how visitors use the site so we can improve content and user experience.

  • Google Analytics 4 (GA4) — Collects anonymised usage data including pages visited, time on site, and referral source. Cookies include _ga and _ga_*. Duration: up to 2 years.
  • Microsoft Clarity — Records anonymised session data including scroll depth and click patterns for behaviour analytics. Cookies include _clck and _clsk. Duration: up to 1 year.

Third-Party Services

Supabase

Our site content (supplier reviews, scores, tariff data) is stored in a Supabase database, hosted in the EU. Supabase also stores the visitor data described above — comment submissions, including the name, any email address and the hashed IP, and the site-usage events. Supabase acts as our data processor and does not use this data for its own purposes.

Google Analytics 4

If you consent to analytics cookies, visit data is sent to Google Ireland Limited. We have configured GA4 with IP anonymisation enabled. Google's privacy policy is available at policies.google.com/privacy.

Microsoft Clarity

If you consent to analytics cookies, behavioural session data is sent to Microsoft Corporation. Microsoft Clarity does not collect or store personally identifiable information. Microsoft's privacy policy is available at privacy.microsoft.com.

Legal Basis for Processing

We rely on the following legal bases under UK GDPR for any data processing that occurs:

  • Legitimate interests — For the technical operation of the website (e.g. server logs required for security and reliability). We have assessed that our legitimate interests are not overridden by your fundamental rights in this context.
  • Consent — For analytics and behavioural cookies (GA4 and Microsoft Clarity). You may withdraw consent at any time by revisiting the cookie preferences panel (accessible via the cookie icon in the footer).

Data Retention

  • Site measurement events — the pageviews, outbound link clicks and on-site notice events described above — are deleted automatically after 14 months.
  • Comments stay published for as long as the page does. The hashed form of your IP address stored alongside a comment is used only to spot spam in the hour after posting, and is erased 7 days after the comment is made. The comment itself is unaffected.
  • GA4 data is retained for 14 months (the minimum available setting), after which it is automatically deleted by Google.
  • Microsoft Clarity session data is retained for 30 days by default.
  • Server access logs (held by our hosting provider) are typically retained for up to 30 days for security purposes.

Your Rights Under UK GDPR

As a data subject in the United Kingdom you have the following rights with respect to any personal data we hold about you:

  • Right of access — You may request a copy of any personal data we hold about you.
  • Right to rectification — You may ask us to correct inaccurate personal data.
  • Right to erasure — You may ask us to delete your personal data where there is no compelling reason for us to continue processing it.
  • Right to restrict processing — You may ask us to halt processing while a dispute is resolved.
  • Right to data portability — Where processing is based on consent or contract, you may request your data in a structured, machine-readable format.
  • Right to object — You may object to processing carried out on the basis of legitimate interests.
  • Right to withdraw consent — Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact us at privacy@energy-review.co.uk. We will respond within one month of receiving your request.

Right to Complain

If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection:

Changes to This Policy

We may update this privacy policy from time to time. When we do, we will update the "Last updated" date at the top of this page. We encourage you to review this policy periodically.