Privacy Policy — SvetSolar Monitor
Last updated: 20 October 2026
This policy is available in Portuguese and English.
1. Who we are
SvetSolar Monitor (monitor.svetsolar.pt) and the SvetSolar mobile app are operated by SVETSOLAR, SOCIEDADE UNIPESSOAL LIMITADA, NIF 515445860, Avenida do Atlântico, n.º 16, 14.º piso, Escritório 8, Parque das Nações, 1990-019 Lisboa, Portugal ("SvetSolar", "we"). We are the controller of your personal data.
For any question about this policy or your data, write to geral@svetsolar.pt or call +351 934 566 607.
We have not appointed a Data Protection Officer: the law does not require one for a company of our size and activity (Article 37 GDPR). Data protection questions are handled directly by the company's management at the address above.
2. What the service does
SvetSolar Monitor shows the owners of solar installations we installed or maintain how their system performs: production, consumption, battery, savings and advice. Your inverter sends its data to the manufacturer's cloud; we read your installation's data from there with our installer account and keep it on our systems.
3. What data we process, and why
| Data | Where it comes from | Why we need it | Legal basis |
|---|---|---|---|
| Name, e-mail, phone, preferred language | You, or our team when your installation was registered | To identify you, let you sign in, send you your monthly report and answer your requests | Performance of our contract with you |
| Installation address and coordinates | Our installation records; coordinates derived from the address | To show your installation on the map and compare its production with local weather | Performance of contract; legitimate interest (a) |
| Equipment data: inverter brand and model, panel power, battery capacity | Our installation records and the manufacturer's cloud | Monitoring and advice | Performance of contract |
| Energy measurements: production, consumption, grid import and export, battery charge and state of charge, hourly and daily, and current alarms of your equipment | The manufacturer's cloud (Huawei FusionSolar, Deye Cloud, FoxESS Cloud, Sigenergy Cloud) | The core of the service: history, reports, alerts, advice | Performance of contract |
| Your electricity tariff | You: typed in, or read from a photo of your bill that you upload | To calculate your savings in euros | Performance of contract |
| Bill photo | You. In the app you take the photo with the camera or pick it from your gallery; the app sees only the photo you chose and shrinks it on your phone before sending it | To read the tariff and, if it is printed, the type of connection (single-phase or three-phase). A bill photo may also show your name, address, NIF and CPE code; we do not keep the photo | Performance of contract |
| Questions to the built-in assistant and its answers | You | To answer your questions about your installation | Performance of contract |
| Use of the portal: pages opened, time spent, a random visit number | Your browser (the app does not tell us which screens you open) | To learn which parts of the portal are used, so we can improve them | Legitimate interest (b) |
| App error reports: phone model, operating system and version, phone language, app version, a random installation number, errors and where in the code they happened, start-up and screen-opening times (screen names). No name, e-mail or client number | The app, automatically | To find and fix errors and slowness in the app | Legitimate interest (e) |
| Your phone's notification address (notification token) and your notification choice | The app, when you agree to receive notifications | To send you alerts (for example, a fault) and advice on this phone | Consent: you can turn notifications off at any time |
| Sign-in with Google: e-mail, name, profile photo link and Google account number | Google, when you choose "Sign in with Google" | Only to let you sign in | Performance of contract |
| Server and security logs: IP address, date and time, page requested, browser type | Your device, automatically | To keep the service secure and to investigate errors and misuse | Legitimate interest (c) |
| Correspondence with our team (e-mail, WhatsApp, phone) | You | To answer you and keep a record of what was agreed | Performance of contract; legitimate interest (c) |
| Referral data: name and phone or e-mail of a person you recommend | You, or the person themselves through your referral link | To contact that person once about our services and, if they become a client, to apply your discount. Referral and battery-offer requests are recorded in our own client management application (Flick), on our server | Legitimate interest (d) |
Our legitimate interests are: (a) showing local weather next to your production, which needs your installation's location; (b) learning which parts of the portal are used, so we can improve them; (c) keeping the service and your data secure and keeping a record of support requests; (d) passing on a recommendation you gave us; (e) keeping the app stable by finding and fixing its errors. We have checked that these interests do not override your rights; you can ask us for the details.
Please give us someone's details for a referral only if they have agreed to it. The first message we send to a person you recommended tells them who recommended us, that we will use their contact only to tell them about our services, that they can ask us to delete it, and where this policy is.
We do not use your data for advertising and we do not sell it.
4. What you must give us, and what is optional
You need to give us your name and e-mail to have an account: without them we cannot give you access to the portal. Your installation's address and the connection to the manufacturer's cloud are needed for monitoring itself. Everything else — phone, tariff, bill photo, questions to the assistant, referrals, notifications, fingerprint or face sign-in — is optional; without it some functions, such as savings in euros, will not work.
5. Automated decisions and the assistant
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects on you (Article 22 GDPR). The built-in assistant is an artificial intelligence system: its answers are generated automatically, are advice only and may contain mistakes. Decisions about your contract, warranty or service are always taken by our team. To give advice we analyse your installation's production and consumption; we do not use this for marketing or to assess you as a person.
6. Who else processes your data
Processors — they act only on our instructions:
| Provider | What for | Where the data is |
|---|---|---|
| Supabase Inc. | Database and sign-in | Database in the EU; some technical services and support in the USA, under EU Standard Contractual Clauses |
| Hostinger | Server for the web application and data collection | France (EU) |
| Resend | Sending e-mails (sign-in links, reports) | E-mails are sent from Ireland; e-mail content and delivery logs are stored in the USA, under EU Standard Contractual Clauses and the EU–US Data Privacy Framework |
| Anthropic (Anthropic Ireland, Limited, with processing by Anthropic in the USA) | The built-in assistant and reading the tariff and, if it is printed, the type of connection (single-phase or three-phase) from bill photos. We send your question with a summary of your installation's figures, or the bill photo | USA, under EU Standard Contractual Clauses. Anthropic deletes our requests within 30 days and does not use them to train its models |
| Expo (650 Industries, Inc.) | The mobile app: error reports, delivery of app updates (installation number, operating system, version) and the notification service. The text of a notification passes through Expo only to be delivered | USA, under the EU–US Data Privacy Framework |
| Telegram | Internal alerts to our team about failing installations and account deletion requests. The alert contains the installation's or the client's name | Netherlands (EU) |
Other recipients — they decide on their own processing:
- Google (Google Maps Platform) converts your address into coordinates once. For this service Google acts as an independent controller under its own privacy policy; Google LLC is certified under the EU–US Data Privacy Framework.
- Apple (Apple Push Notification service) and Google (Firebase Cloud Messaging) deliver notifications to your phone, under their own policies.
- If you choose "Sign in with Google", Google handles that sign-in as an independent controller.
- Huawei, Deye, FoxESS and Sigenergy operate their own clouds, to which your inverter sends data directly, under their own privacy policies. We read your installation's data from them with our installer account.
- If you write to us on WhatsApp, Meta processes those messages under its own terms.
Transfers outside the European Economic Area rely on an EU adequacy decision (for US companies certified under the EU–US Data Privacy Framework) or on the EU Standard Contractual Clauses. You can ask us for a copy of these safeguards at geral@svetsolar.pt.
7. How long we keep data
| Data | How long |
|---|---|
| Energy measurements and reports | As long as you are our client, so that you keep your history. If you ask us to delete your account, we delete them 30 days after we confirm the request |
| Account and contact data | During the relationship. If you ask us to delete your account, we delete your email, phone and sign-in 30 days after we confirm the request; invoicing records for the period required by Portuguese law (up to 10 years) |
| Installation and service: your name, the installation's address and equipment, the contract, warranties, certificates, technician visits, service requests and the files you sent us for the proposal | As long as we are responsible for the installation, also after you delete your account: we need them for the warranty and to defend ourselves in a dispute |
| Use of the portal | 30 days linked to your account, then anonymised; deleted after 90 days |
| Server and security logs | 14 days |
| Questions to the assistant | 12 months, then deleted |
| Bill photos | Not stored by us; Anthropic deletes them within 30 days |
| Referral data | 6 months — the time the referral discount is valid — then deleted if the person has not become a client. If they became a client, it stays in the record of the discount applied |
| App error reports | Kept by Expo under its privacy policy (expo.dev/privacy) |
| Your phone's notification address | While notifications are on. Once they are off — when you sign out, choose "Not now", or the phone stops accepting them — deleted after 90 days |
| Correspondence | 3 years after the matter is closed |
| Backups | Monitoring data backups are kept for up to 14 days, on our server in France and on a company computer in Portugal; data you delete disappears from backups within that time |
| Sign-in | In the portal: until you sign out; if you untick "Keep me signed in", until you close the browser. In the app: until you sign out; if you do not open the app for more than a week, it signs you out by itself |
8. Your rights
Under the GDPR you can at any time:
- see the data we hold about you and get a copy, in a portable, machine-readable format (in the portal and in the app: Settings → My data → Download my data);
- correct it (in Settings, or by writing to us);
- ask us to delete it (Settings → My data → Request deletion, or by writing to us; how it works and what we keep: monitor.svetsolar.pt/delete-account). Deleting your account ends monitoring; we keep the invoicing records the law requires us to keep and the installation and service data listed in section 7;
- restrict processing;
- withdraw consent where we have asked for it, without affecting processing carried out before;
- complain to the Portuguese supervisory authority: CNPD — Comissão Nacional de Proteção de Dados, Av. D. Carlos I, 134, 1.º, 1200-651 Lisboa, www.cnpd.pt — and seek a judicial remedy.
Your right to object. You can object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests. Write to geral@svetsolar.pt. We will stop unless we have compelling legitimate grounds or need the data for legal claims.
We answer within one month. If a request is complex, we may extend this by up to two more months and will tell you why within the first month. Exercising your rights is free of charge. We may ask you to confirm your identity.
9. Cookies and storage on your device
The portal uses only what is strictly necessary to keep you signed in and to remember small settings you chose, such as language. We set no advertising or third-party tracking cookies. To count visits we use a random number created for each visit; it is kept only in the memory of the open page and is never stored on your device.
In the app, your phone keeps: your sign-in, in the phone's protected storage (Keychain or Keystore), until you sign out; if you turned on fingerprint or face sign-in, also your e-mail for the sign-in button, until you turn that sign-in off; the last data loaded, so you can see it without a connection, deleted when you sign out; your notification choice and the version of this policy you accepted. "My data" files are created only when you press the button and go wherever you send them.
Fingerprint or face sign-in. It is optional and you turn it on in Settings. The check is done by your phone itself: the app never receives your fingerprint or your face, only "yes" or "no".
10. Security
Data travels encrypted (HTTPS). Access to the database is restricted by role and row-level rules; manufacturer account sessions are stored encrypted. Our team sees client data only to provide the service. If a security incident puts your data at risk, we will inform you and the CNPD as the law requires.
11. Children
The service is intended for adults (18 or older). We do not knowingly collect data from children.
12. Changes
When we change this policy we update the date above and, for material changes, tell you in the portal or by e-mail. Previous versions are available on request.