Privacy Policy

1. Who we are

Flowwave (“Flowwave”, “we”, “us”) is the data controller for the personal data described here. We are based in the Netherlands. For any privacy question or to exercise your rights, contact us at [email protected].

2. What data we collect

• Account data — your name, e-mail address and a securely hashed password.
• Energy telemetry — meter readings your devices push to us (electricity import/export, solar, battery, gas and voltage), with timestamps.
• Home configuration — settings you choose, which may include your approximate location and solar panel orientation to produce a weather-based forecast.
• Support & reviews — messages you send through support tickets and any review you choose to submit.
• Technical data — your IP address and session information, used to keep you signed in and to protect the service against abuse.

3. Why we use it, and our legal basis

• To provide the service (performance of our contract with you) — storing and visualising your energy data, forecasts and notifications.
• Account security & abuse prevention (legitimate interest) — verifying your e-mail, enabling password reset, rate-limiting and protecting the platform.
• Showing reviews publicly (your consent) — only after you submit one and an administrator approves it. You can edit or remove it at any time.

We never sell your data, and we do not use it for advertising.

4. Who we share it with

We share data only with the service providers (“processors”) needed to run Flowwave. They process data on our instructions under data-processing agreements:

• Hetzner Online GmbH — Server hosting & database (Germany (EU)).
• Resend — Transactional e-mail (verification & password reset) (EU region).
• Cloudflare, Inc. — DNS, CDN & network protection (Global (EU data handling safeguards)).

We host within the EU and do not sell or rent your personal data to anyone.

5. How long we keep it

We keep your energy data and account information for as long as your account is active. When you delete your account, your personal data — account, devices, telemetry, tickets and reviews — is removed from our live systems immediately. Encrypted backups rotate on a short cycle (around 14 days) and then expire.

6. Your rights

Under the GDPR (AVG) you can, at any time:

• Access & portability — export all of your energy readings to CSV from your settings, or ask us for a copy of your data.
• Rectification — correct your account details in your settings.
• Erasure — delete your account and data yourself from Settings, or ask us to do it.
• Objection & restriction — object to or restrict certain processing.

To exercise any of these, email [email protected]. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

7. Cookies

We use only strictly-necessary cookies to keep you signed in. We do not use advertising or third-party tracking cookies, so there is no cookie banner to click through.

8. How we protect your data

All traffic is encrypted in transit (HTTPS/TLS). Passwords are stored only as salted hashes and device tokens only as one-way hashes. Our database is never exposed to the public internet and runs on EU infrastructure.

9. Changes to this policy

We may update this policy as the service evolves. We’ll change the “last updated” date above and, for material changes, let you know in the app.

10. Contact

Questions about your privacy? Email [email protected].