The Controller within the meaning of the GDPR is the provider named in the Imprint.
Our servers are located in a data centre in Frankfurt am Main (Germany), operated by DigitalOcean, LLC (United States). Technical access data are stored in server log files with each access.
Automatic backups are stored in encrypted form, also at DigitalOcean in Frankfurt.
We only use technically necessary cookies for authentication and session management. No tracking, analytics, or advertising cookies are used.
To let you trace changes within the Service, we record an activity log entry for each change to your devices, meters, contracts, readings, environmental records, sharing groups, and account.
For optical recognition of meter readings, we use the Anyline SDK by Anyline GmbH (Vienna, Austria). OCR processing takes place locally on your device; no images are transmitted.
To protect our service, we use Friendly Captcha (Friendly Captcha GmbH, Germany).
For paid features, we use Stripe, Inc. (United States).
Transactional emails are sent via mailbox.org (Heinlein Support GmbH, Berlin). Servers located in Germany.
To show prices in a currency you can actually pay in, we determine which country your request comes from by looking up your IP address. The lookup runs on our own server against a database held there; your IP address is not transmitted to any third party for this purpose.
You may choose to receive service-related notifications about your account and the features you use, for example about messages, activities or status changes. You can manage the available topics in account settings. Administrators also receive notices about Apple refund requests. The service remains usable without push notifications.
We process push tokens or browser subscriptions including encryption data, installation identifiers, account and session associations, device names, language, app/delivery environment, topic choices, activation times and delivery status. Notifications contain general messages and technical navigation references, not chat text, meter readings, payment data or access tokens.
Delivery uses Apple/APNs and, for Web Push, the browser's chosen service from Apple, Google or Mozilla. They receive the data required for delivery. Privacy notices:
Push services may also process data in the United States. Apple and Mozilla identify standard contractual clauses as transfer safeguards in their privacy notices; Google identifies the EU-US Data Privacy Framework. The notices linked above provide details and contact options for information or copies of safeguards.
Consent is the legal basis for optional notifications (Article 6(1)(a) GDPR). You may withdraw it at any time for the future by disabling topics in account settings or removing registered devices; system permission can also be revoked. Earlier processing remains lawful. Administrative notices support prompt handling of refund requests based on our legitimate interest (Article 6(1)(f) GDPR) and reach only registered administrator devices.
Device registrations are deleted when removed or when the account is deleted. Registrations not updated for 180 days and delivery records for notifications expired for more than 30 days are regularly cleaned up in batches; backlogs may delay deletion. Account-wide topic preferences remain stored until account deletion. Notifications already handed to providers may still arrive; provider retention periods are described in their privacy notices.
For push, we store local identifiers, registration status, prompt choices and pending deregistrations in the browser. This storage supports the requested function or implements your choices, not advertising or analytics (Section 25(2) No. 2 TDDDG).
Some of our processors are based in the United States:
| Provider | Safeguard |
|---|---|
| DigitalOcean, LLC | EU-US Data Privacy Framework |
| Stripe, Inc. | EU-US Data Privacy Framework |
You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and objection (Art. 21 GDPR). To exercise your rights, please contact us via the details provided in the Imprint.
You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR).
You have the right to object at any time, on grounds relating to your particular situation, to processing of personal data concerning you that is based on a legitimate interest (Art. 6(1)(f) GDPR). This covers every processing activity marked with that legal basis in this policy. If you object, we will stop processing the data concerned unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.
An objection requires no particular form. Please send it to the contact details given in the Imprint.
We update this privacy policy as needed. The current version is available on our website.
This is a machine-translated version of the original English document. In the event of any discrepancy, the English (en-US) version is authoritative.