1. Controller
The Controller within the meaning of the GDPR is the provider named in the Imprint.
2. Hosting (DigitalOcean)
Our servers are located in a data centre in Frankfurt am Main (Germany), operated by DigitalOcean, LLC (United States). Technical access data are stored in server log files with each access.
- Purpose: Technical operation, security, error analysis
- Legal basis: Legitimate interest (Art. 6(1)(f) GDPR)
- Legitimate interest: Operating the service reliably, defending it against attacks, and being able to investigate faults after the fact
- Third-country transfer: EU-US Data Privacy Framework; data centre located in Germany
Automatic backups are stored in encrypted form, also at DigitalOcean in Frankfurt.
3. Cookies
We only use technically necessary cookies for authentication and session management. No tracking, analytics, or advertising cookies are used.
- Legal basis: Section 25(2) No. 2 TDDDG
4. User Account
- Data: Email address, password (stored in encrypted form)
- Purpose: Provision of the user account, authentication
- Legal basis: Performance of contract (Art. 6(1)(b) GDPR)
- Retention period: Until deletion of the account
5. Consumption Data
- Data: Meter readings, measurements, device configurations
- Purpose: Recording and analysis of your energy consumption data
- Legal basis: Performance of contract (Art. 6(1)(b) GDPR)
- Retention period: Until deletion of the account
6. Activity Log
To let you trace changes within the Service, we record an activity log entry for each change to your devices, meters, contracts, readings, environmental records, sharing groups, and account.
- Data: Event type and timestamp, the affected object and the change made, and the username of the acting user
- Purpose: Transparency and traceability of changes to your data, including changes made by members of a sharing group you own
- Disclosure within sharing groups: If you own a device or sharing group, the activity log shows you the username and email address of members who made changes to it, including members who have since left the group. When you make changes within a sharing group owned by another user, your username is visible to that owner. Members only ever see their own actions.
- Legal basis: Performance of contract (Art. 6(1)(b) GDPR)
- Retention period: Up to 5 years from the time of the event, after which entries are deleted automatically. You can delete your activity log manually at any time.
7. Scanning Meter Readings (Anyline SDK)
For optical recognition of meter readings, we use the Anyline SDK by Anyline GmbH (Vienna, Austria). OCR processing takes place locally on your device; no images are transmitted.
- Resources: When loading the scan function, resources are loaded from Anyline servers. Your IP address is transmitted in the process.
- Usage report: After a scan, a technical license event is sent to Anyline.
- Legal basis: Legitimate interest (Art. 6(1)(f) GDPR)
- Legitimate interest: Offering meter readings to be captured by camera, and meeting the license terms of the SDK that makes it possible
- Privacy policy: anyline.com/imprint-and-legal
8. File Uploads
- Data: Uploaded file
- Purpose: Provision of the upload function
- Legal basis: Performance of contract (Art. 6(1)(b) GDPR)
- Retention period: Until deletion of the account
9. Contact Inquiries
- Data: Name, email address, subject, message content
- Purpose: Processing your inquiry
- Legal basis: Pre-contractual measures or performance of contract (Art. 6(1)(b) GDPR)
- Retention period: Until final processing, then deletion
10. Friendly Captcha
To protect our service, we use Friendly Captcha (Friendly Captcha GmbH, Germany).
- Legal basis: Legitimate interest (Art. 6(1)(f) GDPR)
- Legitimate interest: Keeping automated abuse, spam, and mass account creation away from the service
- Privacy policy: friendlycaptcha.com/privacy
11. Payment Processing (Stripe)
For paid features, we use Stripe, Inc. (United States).
- Data: Email address, payment information (transmitted directly to Stripe)
- Purpose: Processing payments
- Legal basis: Performance of contract (Art. 6(1)(b) GDPR)
- Third-country transfer: EU-US Data Privacy Framework
- Privacy policy: stripe.com/privacy
12. Email Delivery (mailbox.org)
Transactional emails are sent via mailbox.org (Heinlein Support GmbH, Berlin). Servers located in Germany.
- Data: Email address, message content
- Legal basis: Performance of contract (Art. 6(1)(b) GDPR)
13. Country Detection (Currency Preselection)
To show prices in a currency you can actually pay in, we determine which country your request comes from by looking up your IP address. The lookup runs on our own server against a database held there; your IP address is not transmitted to any third party for this purpose.
- Data: IP address, country derived from it
- Purpose: Showing prices in the currency of the country the request comes from. If you register, the currency derived this way is stored as the initial currency of your account.
- Legal basis: Legitimate interest (Art. 6(1)(f) GDPR)
- Legitimate interest: Showing visitors a price in a currency they can actually be charged in, without requiring them to select one first
- Retention period: The country itself is not stored. The derived currency is stored only for registered users and can be changed at any time in your profile.
14. Data Transfers to Third Countries
Some of our processors are based in the United States:
| Provider |
Safeguard |
| DigitalOcean, LLC |
EU-US Data Privacy Framework |
| Stripe, Inc. |
EU-US Data Privacy Framework |
15. Your Rights
You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and objection (Art. 21 GDPR). To exercise your rights, please contact us via the details provided in the Imprint.
You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR).
16. Right to Object
You have the right to object at any time, on grounds relating to your particular situation, to processing of personal data concerning you that is based on a legitimate interest (Art. 6(1)(f) GDPR). This covers every processing activity marked with that legal basis in this policy. If you object, we will stop processing the data concerned unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.
An objection requires no particular form. Please send it to the contact details given in the Imprint.
17. Changes
We update this privacy policy as needed. The current version is available on our website.
This is a machine-translated version of the original English document. In the event of any discrepancy, the English (en-US) version is authoritative.