Privacy notice

1. Who we are

EnergyFlow (energyflow.ro) is operated by DEVOPS TEAM SRL, Str. Complexului nr. 3, Carcea, Dolj, Romania, fiscal code RO35610990, registered with the Trade Register under J16/276/2016 (“we”, “us”). For anything about your data, write to [email protected] or to the postal address above.

2. Our role

• Controller — for visitors to this website and for the people who hold an EnergyFlow account (for example an installer's staff): we decide how that data is used.
• Processor — for data about solar sites, their plants and their owners that an installer or other business customer puts into EnergyFlow. The business customer is the controller of that data; we process it only on their instructions and under a data processing agreement (Art. 28 GDPR), which is part of our Terms of service. If you own one of these sites, your installer is your first point of contact, and we will help them answer your request.

3. What we collect

Energy readings from a home can reveal patterns of daily life (for example when people are home). We treat them as personal data whenever they relate to an identifiable owner and protect them accordingly. We do not collect special categories of data (Art. 9 GDPR) and the service is not intended for children.

4. Why we use it, and on what legal basis

Where we rely on legitimate interests you can object at any time (see Your rights). We make no decisions about people based solely on automated processing that produce legal or similarly significant effects. Automated alarms and recommendations concern equipment, not people.

5. Who receives data

We never sell personal data. We share it only with:

• Hosting. Our servers, databases and backups run on infrastructure in the European Union that we operate ourselves. Traffic between your browser and them passes through Cloudflare (below).
• Network and security. Cloudflare, Inc. carries all traffic between your browser and energyflow.ro, api.energyflow.ro and auth.energyflow.ro over its network and an encrypted tunnel to our servers (content delivery and protection against attacks). To do so it processes your IP address and the requests you send, on our behalf.
• Email delivery. Amazon Web Services (Amazon SES) sends our service emails, including the messages of automation scenarios to people who have not connected a chat.
• Chat alerts, only if you connect them: Telegram (Telegram Messenger Inc.) or WhatsApp (Meta Platforms Ireland Ltd.) deliver alarm messages, and the messages of automation scenarios you receive, to your chat and receive their text, which names the site and the alarm or what the scenario found.
• Sign-in with Google, only if you choose it: Google receives the fact that you are signing in to EnergyFlow and gives us your name and email.
• Weather data. Open-Meteo receives approximate site coordinates (no names or account details) so we can fetch local weather and produce forecasts.
• Solar yield data. PVGIS, the European Commission's Joint Research Centre service, receives a site's coordinates and its panels' tilt and orientation (no names or account details) so we can compare a plant's output with its long-term expected yield.
• Maps and address search. When you open a site's roof map, your browser loads satellite images directly from Esri (ArcGIS World Imagery) and, if you search for an address on the map, sends what you typed to OpenStreetMap's Nominatim service (OpenStreetMap Foundation). They receive your IP address, browser details and the map area or address you looked at, not your name or account. When a site has no coordinates, our servers look up its address in Nominatim to place it on the map, sending only the address.
• Equipment platforms you connect (inverter vendors, Home Assistant, Tuya, EV charger platforms and similar). We send them your access credentials and, for automation, the commands you set up. Some of them we sign in to the way their own app does, with the email and password of your account there; those passwords, like every credential, are stored encrypted. They handle data under their own privacy terms.
• Your installer or the business you share a site with, and anyone you give an owner share link to.
• Authorities, when the law requires it, and professional advisers (accountants, lawyers) bound by confidentiality.

Every service provider acting for us is bound by a data processing agreement.

6. Transfers outside the EEA

Cloudflare, Inc. is a US company and may process traffic in its data centres outside the EEA; Amazon SES processes service emails in the United States; Esri, whose satellite images the roof map loads, is a US company; Telegram and WhatsApp (if you connect them) may process alert messages outside the EEA; and Google sign-in (if used) may involve transfers to the US. The OpenStreetMap Foundation is in the United Kingdom, which the European Commission recognises as ensuring adequate protection. The other transfers rely on the EU–US Data Privacy Framework where the recipient is certified, and on the European Commission's Standard Contractual Clauses otherwise. You can ask us for a copy of the relevant safeguards.

7. How long we keep it

• Account data — while your account is open, then deleted within 90 days of closure.
• Detailed energy readings — up to 3 years; daily and monthly totals — up to 5 years, so year-on-year performance can be compared. A business customer can ask for earlier deletion.
• Vendor credentials — deleted as soon as you disconnect the platform or close your account.
• Records of the owner's agreement to control — kept while the connection that controls the equipment exists, also after control is turned off, and deleted with the connection.
• Technical logs — up to 30 days, unless needed to investigate a security incident.
• Invoices and accounting records — as long as Romanian tax law requires (currently up to 10 years).
• Backups roll over and are overwritten within 30 days.

8. Security

All traffic is encrypted in transit (HTTPS/TLS). Vendor credentials, including passwords, are stored encrypted, access inside the app is limited to the account that owns a site, and staff access to production is restricted and logged. If a personal data breach is likely to put you at risk, we will tell the supervisory authority within 72 hours and inform the people affected, as the GDPR requires.

9. Cookies and local storage

We use only what is strictly necessary for the service to work or to remember a choice you made, so no consent is needed and none is asked for. We use no analytics, advertising or social-media cookies.

You can delete cookies in your browser settings at any time; you will then need to sign in again.

Visit statistics on our public pages. To know which pages and articles are read, we count visits to energyflow.ro's public pages ourselves, without cookies and without storing anything in your browser. For each visit we record the page, the site you came from (its name only), any campaign tag in the link, and whether you used a phone, tablet or computer. To count how many different people visited on a day, your IP address and browser identifier are combined with a random value that changes every day into a code; the IP address and browser identifier themselves are not stored, and the day's random value is deleted the next day, after which the code can no longer be linked to you. If your browser sends Do Not Track or Global Privacy Control, nothing is counted. We do this on the basis of our legitimate interest in understanding how our website is used (Art. 6(1)(f) GDPR) and keep the statistics for up to 24 months.

10. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you and get a copy of it;
• have inaccurate data corrected;
• have data erased, or its use restricted;
• receive data you gave us in a machine-readable format and have it passed to another provider (portability);
• object to processing based on legitimate interests;
• withdraw any consent you gave, without affecting processing before withdrawal.

Write to [email protected]. We answer within one month, free of charge, and may ask you to confirm your identity first. You can also complain to the Romanian supervisory authority, Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, București, www.dataprotection.ro, or to the authority in the EU country where you live or work.

11. Changes to this notice

When we change this notice we update the date at the top. If a change materially affects how we use your data, we will tell account holders by email before it takes effect.