Privacy Policy

1. Who is responsible for your data

The data controller is Low Grid (the Low Grid team). Privacy questions and data-protection requests: support@lowgrid.app.

The service is hosted in the EU. Some providers listed below may process data outside the EEA; see section 6.

2. What we collect

Account data: e-mail address, display name if you set one, the sign-in provider (Apple, Google or e-mail link) and the Supabase user identifier.

Site and tariff profile: country and price zone, timezone, the supplier and tariff plan you choose, and the devices you add to your site.

Automations and integrations: automation rules, run history, estimated savings, device names, integration type, non-secret driver settings such as a webhook URL or Shelly device identifier, and credentials for those integrations. Credentials are encrypted with AES-256-GCM and are never returned by the API.

Notifications: e-mail address and, if you enable push notifications, a device push token, platform (iOS or Android) and UI language.

Billing: plan, provider (App Store, Google Play, RevenueCat or Stripe), subscription status, expiry and grace dates, trial flag, transaction identifiers and the raw webhook events the stores send us. We do not receive or store your full card number; the store or Stripe handles the payment.

Technical data: IP address and request metadata in server logs, kept only to operate and secure the service. We do not ship third-party analytics or advertising SDKs.

3. Why we process data and on what basis

We process account, profile, automation and billing data to provide the service you asked for (contract). We process push tokens and notification preferences only after you enable notifications (consent), and you can withdraw that consent in the app or device settings.

We process technical logs and security events to keep the service reliable and secure (legitimate interest), and billing records to meet tax and accounting obligations (legal obligation). We do not use your data for automated decisions that have a legal effect on you.

4. How long we keep it

Account and profile data is kept while your account exists. If you delete your account, we delete or anonymise the related data, except billing and accounting records that we must keep for the period required by law.

Automation run history and savings entries are kept while the related site or account exists. Push tokens are deleted when you disable notifications, sign out of that device, or delete your account. Server logs are kept for a short operational period and then discarded.

5. Who we share data with

We share data with service providers that process it on our behalf: Supabase (authentication and database hosting), Apple and Google (sign-in and in-app payments), RevenueCat (subscription management), Stripe (web purchases and the billing portal), Resend (transactional e-mail for web checkout links) and our hosting provider.

We also receive price data from ENTSO-E and Elering; that data contains no personal information. We do not sell personal data and do not share it for advertising.

6. International transfers

Our providers may process data outside the European Economic Area, in particular in the United States. Where that happens, the transfer is based on an adequacy decision of the European Commission, or on the European Commission's Standard Contractual Clauses together with the additional safeguards required by EU law.

7. Your rights

If you are in the EU/EEA you can ask for access to your data, correction, deletion, restriction of processing, portability, and you can object to processing based on legitimate interest. You can withdraw consent for notifications at any time.

Send requests to support@lowgrid.app. We answer within one month; we may need to verify your identity first. You also have the right to complain to a supervisory authority in the country where you live or work or where the alleged infringement took place.

8. Analytics and cookies

The Low Grid app does not include a third-party analytics or advertising SDK. Product analytics is a no-op in release builds; a development-only mode can print events to the device console, and those events stay on the device.

The marketing website sets no cookies. If you allow analytics, the site loads Plausible, a privacy-friendly analytics service, and sends aggregate events — page views, download clicks, waitlist steps and language or market choices — together with the campaign parameters (utm_*) and referring host you arrived with. Nothing is loaded or sent until you agree. Your choice is stored in your browser's local storage, not in a cookie, and you can change it at any time with “Analytics settings” in the footer. The only cookie we use is the strictly necessary session cookie that keeps an administrator signed in to the admin area, and it is scoped to /admin.

9. Security

Data is sent over HTTPS. Integration credentials are encrypted at rest with AES-256-GCM, access is limited to the services that need it, and admin access requires a signed session. No system is completely secure; if you find a vulnerability, report it to support@lowgrid.app.

10. Children

Low Grid is not directed at children. An account requires you to be at least 16 years old, and we do not knowingly collect data from children under that age. If you believe a child has created an account, contact us and we will delete it.

11. Changes to this policy

We may update this policy when the service or the law changes. The date at the top shows the current version. If a change is material, we will announce it in the app or by e-mail before it takes effect.

12. Contact

Data controller: Low Grid (the Low Grid team). E-mail: support@lowgrid.app for privacy requests and for any other question about these documents.