Privacy policy

What we collect

Account: your e-mail address, the name you give (optional), a hash of your password if you set one, and which sign-in methods you use (e-mail link, password, passkey, Google or Apple — from Google and Apple we receive only your e-mail address, whether it is verified, and your name).

Security: for each signed-in session, the browser it came from, the IP address and when it was last used; a log of account events such as sign-ins, password changes and data exports.

Plan and usage: your plan, when it renews, the single analyses you bought, and how many site analyses your organisation ran each month.

What you upload: meter data files, bills, site details such as the address and the grid connection capacity, solar data, and the analyses and reports made from them. They are stored on our servers so the analyses can run and you can come back to them.

Payments: Stripe processes them under its own privacy policy. We receive your e-mail, country, the billing address and VAT number where the invoice needs them, the plan and the payment status — never your card.

E-mails you write to us, and messages (with any photos) you send to our Telegram support bot, so we can answer. Telegram delivers those messages under its own privacy policy; we keep the conversation so the team can follow it, and delete it if you ask.

Where you first came from: on your first visit this browser keeps the name of the site that linked to us (only its address, such as google.com — never the page), the campaign tags in our own links (utm_…), the first page you opened, its language and the date. It stays in your browser and reaches us only if you create an account, as part of the sign-up; then it is stored with your account and used only to see which channels bring customers. Google's ad click id (gclid) is kept only where Google Ads may load, as described below.

Website analytics and cookies

Our own analytics (Umami, hosted by us) counts visits without cookies and without identifying you.

In the European Economic Area, the United Kingdom and Switzerland, Google Analytics, Google Ads, Microsoft Clarity and Gravity load only if you accept the cookie banner. Everywhere else, Google Analytics and Google Ads load by default, the banner says so, and "Decline" turns them off; Microsoft Clarity and Gravity still load only if you accept. We work out which applies from the country Cloudflare reports for your connection, and if it can't tell, we treat you as being in the EEA.

Google Ads measures whether a visit from one of our Google ads went on to create an account or subscribe; we do not use it to show you personalised ads. Gravity measures whether our ads in AI chat apps bring visitors: which ad a visit came from and which pages it saw. You can change your mind at any time by clearing this site's data in your browser and answering the banner again.

When you sign in we set a session cookie and short-lived security cookies (for Google/Apple sign-in, passkeys and confirming sensitive changes). They are needed for the account to work and are not used for advertising.

E-mails

Your account e-mail gets messages about your account, your analyses and payments.

Tips and news (about one e-mail a month) go only to people who ticked that box when signing up or switched it on in their account. We record when and where you agreed. Every such e-mail has an unsubscribe link, and the same switch in your account turns it off.

The newsletter (new guides and Zorowatt news, about one e-mail a month) also goes to people without an account who entered their address in the form on our guides and then confirmed it with the link we e-mailed; an address that is never confirmed gets nothing more. We keep the address, its language, the page it was entered on, and when and from which IP it was entered and confirmed. It is one list: being a customer never puts you on it, and the unsubscribe link in any newsletter or the switch in your account takes you off it.

Why we use your data

To provide the service you signed up for (contract): your account, your analyses and reports, billing and support.

To keep accounts secure (legitimate interest): sessions and security logs.

To understand which of our channels bring customers (legitimate interest): where a new account first came from, kept with the account.

With your consent: tips and news e-mails, Microsoft Clarity and Gravity (measuring our own ads), and, in the EEA, the UK and Switzerland, Google Analytics and Google Ads. You can withdraw it at any time.

Outside the EEA, the UK and Switzerland, measuring visits and our own ads with Google Analytics and Google Ads (legitimate interest), unless you decline in the banner.

To keep invoices and tax records as the law requires (legal obligation), with Stripe.

Who processes it for us

[Hosting provider — to be confirmed] hosts the service and the database; Cloudflare delivers the website and protects it; [object storage for uploaded files and encrypted backups — to be confirmed] stores files; [e-mail provider — to be confirmed] sends our e-mails and holds the mailbox [email protected]; Anthropic (Claude) helps us draft answers to the e-mails you send us — it reads the message, and a person reads every answer before it is sent; Stripe handles payments; Telegram carries the support chat; Google and Apple only when you choose to sign in with them; Microsoft Clarity and Gravity only with your consent; Google Analytics and Google Ads with your consent in the EEA, the UK and Switzerland, and unless you decline elsewhere.

Some of these companies may process data outside the European Union; they do so under the European Commission's standard contractual clauses or an equivalent safeguard. We do not sell your data. Its only advertising use is measuring our own ads with Google Ads and Gravity, as described above.

How long we keep it

As long as your account exists. When you delete your account it is removed after 30 days (write to us within those 30 days to restore it); backups roll over and the data disappears from them afterwards. What you uploaded about your clients goes with it.

Signed-in sessions expire on their own. Payment records are kept, by us and Stripe, for as long as tax law requires.

Your rights

You can see, download and delete your data from your account page, or ask us by e-mail. You can also ask us to correct it, restrict or object to how we use it, and withdraw any consent you gave.

If you think we got something wrong, write to us first. You can also complain to the data protection authority in your country, or in the country where the seller is established.

Children

Zorowatt is a tool for businesses and is not meant for anyone under 16.

Changes

When this policy changes, we update the date at the top; for important changes we also tell account holders by e-mail.