Datenschutzerklärung (Privacy policy)
1. Controller
Ali Mert Özdemir, Petersburger Straße 71, 10249 Berlin, Germany. Email: offhours.energy@gmail.com, phone +49 157 33640354.
2. Hosting and database
Website and application: Lovable (lovable.dev) — application hosting on Cloudflare's global edge network. When you visit the site, the host processes technical access data (IP address, time, requested page, browser type) to deliver the site and protect it against misuse. The host also loads a first-party performance script (/~flock.js) that measures page-load metrics, and sets short-lived technical cookies (__dpl for deployment routing, __cf_bm for bot protection).
Database and sign-in: Lovable Cloud (Supabase) — database and authentication hosted on AWS, region eu-west-1 (Ireland). Transfers to providers outside the EU/EEA, where they occur, are based on the EU standard contractual clauses or an adequacy decision.
3. Account and sign-in data
For administrator-created client accounts we process email address, encrypted password and sign-in times in order to provide the portal (Art. 6(1)(b) GDPR). The sign-in session is kept in your browser's local storage. Client building records are isolated by account using database row-level security; clients should only access their assigned buildings and public samples. Portal access dates and report history are retained to administer delivery.
4. Contact form
We store name, company, email, number of buildings, data type and your message to answer your request (Art. 6(1)(b) GDPR for pre-contractual steps; otherwise Art. 6(1)(f) GDPR). Only the administrator can read these entries.
5. Energy data and bills
Energy data you send us or enter in the platform is used only to produce your screening report. In the demo, entered buildings are kept only in your browser session and cleared when you sign out. Uploaded PDF bills are read in your browser; the file itself is not uploaded to our servers and is kept in the open browser tab only if you tick "keep file". Please remove names and account numbers before uploading.
6. AI assistant and bill extraction
AI provider: Lovable AI Gateway, routing requests to OpenAI (model openai/gpt-6-astra). The portal assistant model is openai/gpt-6-astra via the Lovable AI Gateway. For the optional bill-extraction aid, only the text extracted from your bill is sent to generate suggestions, which you must confirm or correct. The AI assistant (beta) receives your question and the calculated figures of the building you are viewing; it never receives uploaded bills. AI answers can be wrong. The intended limit is 20 questions per account per day; access-control enforcement is being completed.
7. Cookies and local storage
We use no advertising or tracking cookies and no third-party fonts or analytics of our own. Only technically necessary storage is used (sign-in session, demo session data, and the host cookies named in section 2), which does not require consent under §25(2) TDDDG.
8. Legal bases
Art. 6(1)(b) GDPR (contract and pre-contractual steps) and Art. 6(1)(f) GDPR (legitimate interest in a secure, working website and in answering enquiries).
9. Retention
Enquiries are deleted when they are no longer needed, at the latest two years after the last contact, unless statutory retention periods apply (e.g. six or ten years for commercial and tax records). Account data is deleted when the account is closed. Server access logs are kept only briefly by the host.
10. Your rights
You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and to object to processing based on Art. 6(1)(f) (Art. 21). Contact us at the email above.
11. Right to lodge a complaint
You may complain to a supervisory authority, in particular the Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59–61, 10555 Berlin, www.datenschutz-berlin.de.
12. Data processing agreement
A data processing agreement (AVV) under Art. 28 GDPR is available on request for clients who send us personal data.