Solscribe Privacy Policy

1. Information We Collect

We collect information in three ways: information you provide to us directly, information we collect automatically, and information we receive from third parties such as electric utilities and referral partners.

1.1 Information You Provide

When you enroll as a subscriber or interact with our Services, you may provide the following:

• Identity and contact information: full legal name, mailing address, service address, phone number, and email address
• Electric utility account information: utility provider (PNM, El Paso Electric, Xcel/SPS, or applicable rural electric cooperative), utility account number, premise number, meter number, and service agreement number
• Billing and payment information: bank account information (for ACH autopay, via Plaid or similar provider) or credit/debit card information (via Stripe; full card numbers are never stored on Solscribe systems)
• Income qualification information: for low-income (LMI) subscribers, proof of income or program enrollment (SNAP, LIHEAP, TANF, Medicaid, etc.) as required by the New Mexico Community Solar Act
• Anchor tenant/commercial information: business name, Tax ID, authorized signer, billing contact, and property information
• Referral and advocate program information: identity and contact information for individuals you refer, and your relationship to them (if participating in the Solscribe Advocate program)
• Communications: messages, support requests, feedback, survey responses, and consent records

1.2 Information Collected Automatically

When you use our websites, enrollment tools, or subscriber portal, we automatically collect:

• Device and browser information: IP address, browser type and version, operating system, device type, and language preferences
• Usage information: pages viewed, links clicked, time spent, enrollment funnel progress, and referral source (including partner codes via ?p=PARTNER_CODE URL parameters)
• Cookies and similar technologies: session cookies, authentication cookies, and limited analytics cookies. You can control cookies through your browser settings.
• Geolocation (approximate): derived from IP address or — for field canvassing tools, with explicit permission — precise GPS location of enrollment events

1.3 Information from Third Parties

To operate the community solar program, we receive information from third parties, including:

• Electric utilities (PNM, EPE, Xcel/SPS): monthly kilowatt-hour (kWh) allocation reports, bill credit confirmations, meter data, account status, and disconnect notices
• New Mexico PRC and its designated Community Solar Program Administrator (currently InClime): program-level reporting, LMI verification, and compliance data
• Solstice/Perch Energy: during the transition period, existing subscriber records for the seven CLN community solar farms
• Payment processors (Stripe, Plaid): transaction confirmations, payment status, chargeback notifications, and bank verification results
• Communications providers (Twilio, ElevenLabs, SendGrid, or equivalent): delivery receipts, opt-out status, and inbound message content
• Channel partners (e.g., WattsUp NM, LLC): subscriber enrollment information captured during face-to-face canvassing
• Community partner organizations (CLN, Locker505, Homewise, WESST, and similar charities associated with the seven CLN farms): referral tracking

2. How We Use Your Information

We use the information we collect for the following purposes, and only for these purposes:

• Enrollment and account management: to verify eligibility, complete your subscription, allocate kWh capacity, and manage your subscriber account
• Billing and payment: to invoice you, process payments, apply utility bill credits, manage ACH and credit card payments, and pursue collections for past-due amounts
• Service delivery and customer support: to respond to inquiries, resolve issues, process cancellations, and provide portal access
• Regulatory compliance: to comply with the New Mexico Community Solar Act, PRC Rule 17.9.573, utility tariffs, and reporting obligations to the PRC and Program Administrator
• Communications about your subscription: welcome messages, billing notifications, monthly credit statements, delinquency notices, program updates, and other transactional communications
• Marketing (opt-in only): with your consent, communications about Solscribe programs, referral opportunities, and community events
• Fraud prevention and security: to detect and prevent unauthorized access, fraud, identity theft, and other misuse of our Services
• Analytics and improvement: to understand how subscribers use our Services and improve enrollment, billing, and support experiences
• Legal claims and compliance: to respond to subpoenas, court orders, regulatory inquiries, and to protect our legal rights

3. SMS/Text Message Communications and TCPA Consent

Solscribe uses SMS text messages for enrollment confirmations, billing reminders, credit statement alerts, service notifications, and (with separate express consent) marketing messages. All SMS communications comply with the Telephone Consumer Protection Act ("TCPA"), FCC one-to-one consent rules, and applicable state regulations.

3.1 How You Consent

• By enrolling as a subscriber and providing your mobile phone number on the enrollment form, you expressly consent to receive transactional SMS messages from Solscribe related to your subscription.
• Marketing SMS messages require a separate, affirmative opt-in (a separate checkbox) clearly identifying Solscribe as the sender.
• Consent to receive marketing text messages is not a condition of enrolling in or receiving community solar services.

3.2 Your Rights

• You may opt out of SMS messages at any time by replying STOP to any text message. You will receive one confirmation message acknowledging your opt-out.
• Reply HELP to any message for assistance, or contact us at support@solscribe.com or (505) 944-4220.
• Message and data rates may apply based on your mobile plan. Message frequency varies by your preferences and account status.
• We will honor opt-out requests promptly, and in all events within the timeframes required by the TCPA.

3.3 One-to-One Consent

Consistent with FCC rules adopted under the TCPA, Solscribe obtains consent for marketing SMS communications on a one-to-one basis. We do not share, sell, rent, or transfer your mobile number or SMS opt-in consent data to any third party for their own marketing purposes. This rule is absolute and applies regardless of any other data-sharing provision of this Privacy Policy.

4. AI-Powered Communications

Solscribe may use automated, AI-powered voice calling (including services powered by ElevenLabs, Twilio, and similar providers) for outbound communications such as billing reminders, enrollment follow-up, and appointment confirmations.

If you receive an AI-powered call from Solscribe, the call will begin with a clear disclosure that you are speaking with an automated assistant, and you will always have the option to speak with a human representative by asking. Voice recordings may be retained for quality assurance, training, and compliance purposes, as described in Section 8 (Data Retention).

5. How We Share Your Information

We do not sell your personal information. We share your information only as described below, and only with parties subject to confidentiality and data-protection obligations.

5.1 Service Providers

• Cloud infrastructure: Microsoft Azure (hosting, Azure SQL Database, Azure Blob Storage, Azure Key Vault, Azure AD/B2C) — SOC 2, ISO 27001, PCI DSS, and CCPA compliant
• Payment processing: Stripe (PCI Level 1 certified); Plaid (bank account verification for ACH)
• Communications: Twilio (SMS, voice); ElevenLabs (AI voice); SendGrid or equivalent (transactional email)
• Analytics: privacy-focused site analytics only; no cross-site tracking

5.2 Utility and Regulatory Partners

• Your electric utility (PNM, EPE, or Xcel/SPS) for account verification, kWh allocation, bill credit application, and disconnect/reconnect processing
• The New Mexico PRC and its designated Community Solar Program Administrator (InClime) for regulatory compliance and LMI verification

5.3 Transition Partners

During our transition period, existing subscribers of the seven CLN community solar farms may continue to be managed by Solstice/Perch Energy under prior contractual arrangements. Solscribe and Solstice/Perch exchange only the minimum information necessary to manage the co-management period, and all such exchanges are covered by written data-protection agreements.

5.4 Channel Partners and Referral Program Participants

Authorized channel partners (such as WattsUp NM, LLC) and Solscribe Advocate program participants receive only the enrollment and attribution information necessary to calculate compensation. Channel partners are contractually prohibited from using subscriber information for any other purpose.

5.5 Legal Disclosures

We may disclose information when required by law, subpoena, court order, regulatory inquiry (including from the PRC), or when we reasonably believe disclosure is necessary to protect our rights, your safety, or the safety of others, or to investigate fraud.

5.6 Business Transfers

In the event of a merger, acquisition, corporate reorganization (including any transfer between Zia CS Services, LLC and Affordable Solar Group, LLC or affiliated entities), or sale of assets, your information may be transferred as part of the transaction, subject to the protections of this Privacy Policy.

6. Data Security

We take data security seriously. Solscribe is built on Microsoft Azure and designed with security as a foundational requirement.

• Encryption at rest using 256-bit AES (FIPS 140-2 compliant) and encryption in transit using TLS 1.2+
• Always Encrypted for sensitive database columns (utility account numbers, income qualification data, bank account identifiers)
• Role-based access control via Azure Active Directory with multi-factor authentication for all administrative users
• All secrets and API credentials stored in Azure Key Vault — never in source code or configuration files
• Web Application Firewall (Azure Front Door / Application Gateway) and DDoS protection
• PCI DSS SAQ A compliance for payment processing via Stripe.js — raw card data never touches Solscribe servers
• Annual security reviews and regular penetration testing as Solscribe scales

No system is perfectly secure. While we implement industry-standard safeguards, we cannot guarantee absolute security. If you believe your account has been compromised, contact us immediately at support@solscribe.com or (505) 944-4220.

7. Your Privacy Rights

You have the following rights with respect to your personal information, subject to applicable law:

• Access: request a copy of the personal information we hold about you
• Correction: request correction of inaccurate or incomplete information
• Deletion: request deletion of your information, subject to our legal, regulatory, and contractual retention obligations (including utility reporting requirements under the Community Solar Act)
• Opt-out of marketing: unsubscribe from marketing communications at any time
• Opt-out of SMS: reply STOP to any text message
• Portability: request your information in a portable format (for LMI subscribers, we will provide income qualification records upon written request)
• Non-discrimination: we will not discriminate against you for exercising any of these rights

To exercise any of these rights, contact us at privacy@solscribe.com. We will respond within 45 days. We may need to verify your identity before fulfilling your request.

8. Data Retention

We retain personal information only as long as necessary to provide the Services, comply with legal and regulatory obligations, resolve disputes, and enforce our agreements.

• Active subscriber records: retained for the duration of your subscription plus seven (7) years after cancellation, consistent with utility and PRC reporting requirements
• Billing and payment records: retained for seven (7) years (tax and audit requirements)
• Income qualification records (LMI subscribers): retained for the duration of your subscription plus three (3) years
• SMS consent records: retained for four (4) years after your last opt-in or opt-out action, consistent with TCPA recordkeeping practice
• Voice call recordings (AI or human): retained for twelve (12) months for quality assurance and dispute resolution, unless a longer retention is required by a pending legal matter
• Marketing analytics: retained in aggregated, de-identified form only

9. Children's Privacy

Solscribe does not knowingly collect personal information from individuals under 18 years of age. Community solar subscribers must be at least 18 and legally capable of entering into contracts. If you believe we have collected information from a minor, please contact us at privacy@solscribe.com and we will promptly delete it.

10. California Residents (CCPA Notice)

While Solscribe currently operates only in New Mexico, we provide the following notice as a courtesy to any California residents who interact with our websites:

Under the California Consumer Privacy Act (CCPA), California residents have rights to know, access, delete, and opt out of the sale of their personal information. Solscribe does not sell personal information and does not share personal information for cross-context behavioral advertising. To exercise your CCPA rights, contact us at privacy@solscribe.com.

11. Third-Party Links

Our websites and communications may contain links to third-party sites (including our parent Affordable Solar Group, LLC, utility company portals, partner organizations, and regulatory agencies). We are not responsible for the privacy practices of those third parties. We encourage you to review their privacy policies before providing information.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other reasons. We will post the updated policy on our website with a new 'Last Updated' date.

For material changes, we will provide advance notice by email (to subscribers), through a prominent notice on our website, or by SMS (to subscribers who have opted in). Your continued use of the Services after the effective date of an updated Privacy Policy constitutes your acceptance of the updated terms.

13. Contact Us

If you have questions, concerns, or complaints about this Privacy Policy or our data practices, please contact us:

14. Complaints to Regulators

If you are not satisfied with our response to a privacy concern, you may file a complaint with:

• New Mexico Office of the Attorney General — nmag.gov
• New Mexico Public Regulation Commission (for Community Solar program complaints) — prc.nm.gov
• Federal Communications Commission (for TCPA/SMS complaints) — fcc.gov/consumers
• Federal Trade Commission — reportfraud.ftc.gov