Privacy policy

COTIDIE GROUP DOO is the controller for Solarverse account, service, security, support, and early-access data. A customer organization may separately control personal data it places in Solarverse, including member access and plant information. In that context, we process the data to provide the service under the customer agreement.

COTIDIE GROUP DOO
Bulevar vojvode Mišića 37, sprat 1, 11102 Beograd (Savski Venac), Republika Srbija
PIB 110087689 · MB 21295345

Privacy questions and rights requests can be sent to info@cotidiegroup.com.

• Account and access data: name, business email, password hash, email-verification state, organization memberships, roles, plant grants, invitations, sessions, device/browser information, IP address, and authentication security events.
• Organization and plant data: company identity, branding, plant names, addresses or coordinates, timezone, capacity, commissioning details, device inventory, and configuration entered by authorized operators. Installer staff may also record an on-site contact's name and phone number and access notes for planning site visits; these are visible only to the installer's owners, admins, and technicians and are never sent to AI providers.
• Operational data: inverter telemetry, production and energy readings, status, diagnostics, alerts, weather observations and forecasts, user acknowledgements, audit history, and service logs. On sites with a grid meter we also derive the site's typical consumption by hour from the last four weeks, which can reflect a household's routines; it is shown only to people who can see that site. Your installer may send you short updates about an issue at your site; we keep the message, who it went to, and whether it was delivered.
• Mobile and notification data: app environment, platform, push-subscription identifier, notification preferences, delivery status, and the limited workspace/site snapshot saved for home-screen widgets. Authentication tokens remain in the operating system's secure storage.
• Communications: early-access form details, including name, email, company, fleet information and message, plus support requests and our responses.
• Optional feature data: effective-dated Electricity Prices, Savings Estimates, and their audit history; bounded alert, diagnostic, aggregate telemetry, weather, performance, and equipment evidence when an authorized operator requests an AI Investigation; and authorization/consent records when you connect ChatGPT.
• Network and delivery metadata: IP addresses and request metadata processed by our EU hosts and, when DNS or HTTP traffic is proxied, by Cloudflare to deliver and protect the service.

We receive data from you, your employer or customer organization, an authorized installer, the site collector or edge device, and the web or mobile client. We also receive limited delivery, mapping, weather, email, and connected-service responses from our service providers.

• To provide, secure, support and administer Solarverse, fulfil customer agreements, authenticate users, display authorized plant data, and deliver requested notifications.
• To take steps requested before a contract, including responding to an early-access or product enquiry.
• For legitimate interests in service reliability, fraud and abuse prevention, troubleshooting, auditability, product safety, and understanding whether the service works as intended, balanced against affected users' rights.
• To meet legal, accounting, security, and regulatory obligations or to establish, exercise, or defend legal claims.
• With consent where consent is required, such as operating-system push permission or optional marketing communication. Consent can be withdrawn without affecting earlier lawful processing.

Solarverse may calculate alerts, health states and performance indicators, but does not make solely automated decisions that produce legal or similarly significant effects about an individual.

The web application uses essential authentication and security cookies. Those cookies are necessary to sign you in and protect the session; they are not advertising cookies and we do not use a marketing cookie banner for them. The mobile application stores its session in platform secure storage.

The web and mobile applications load OneSignal only after you enable notifications, or to restore a permission you already granted. We load Google Maps JavaScript only after you choose to show a map. Directions links can still open in a new tab without loading Maps inside Solarverse. We do not currently use third-party advertising cookies, sell personal data, or use personal data for cross-context behavioural advertising.

We disclose only the data needed for providers to perform services for us. Current provider categories include:

• EU application, database, network, backup, and deployment infrastructure, currently including netcup in Germany, and infrastructure used during a controlled migration or recovery operation.
• Cloudflare, when we use it for DNS or as a reverse proxy, for delivery, caching, and abuse protection. Cloudflare may process IP addresses and request metadata.
• Resend for transactional and operational email.
• OneSignal and the relevant Apple or Google platform service for mobile and browser push delivery, only after you enable notifications or have already granted permission.
• Google Maps for maps and directions. A plant's coordinates are sent to Google only after you choose to display the map, or when you open an external directions link. Open-Meteo provides weather data.
• OpenAI when a user deliberately connects the read-only ChatGPT integration. Solarverse does not store ChatGPT prompts or conversations; OpenAI's handling is governed by the user's OpenAI product and workspace settings. See the connector privacy notice.
• Google's paid Gemini Developer API when an authorized owner, administrator, or technician deliberately requests an AI Investigation. Solarverse sends one bounded, non-identifying evidence package for that Alert. It excludes names, emails, workspace and plant names or identifiers, exact coordinates, device serials and connection details, credentials, raw telemetry, logs, and technician notes. Live Investigations use a paid Google Gemini project so prompts are not used to train Google's products.
• The same paid Gemini API for Solarverse AI summaries, when an installer switches on the AI summary of their Morning Brief, asks for the summary of a Monthly Report, or drafts a Plant Update. Solarverse sends only placeholders such as “plant 1” with alert types, severities, report completeness, and yes/no flags, plus, for a Plant Update draft, the installer's optional short note with links removed. Plant names, figures, people's names, and contact details stay in Solarverse and are filled in afterwards.
• The same paid Gemini API for Ask Solarverse, when an installer asks it a question. Solarverse sends the question as typed and the data the assistant reads to answer it, which can include plant and device names and figures, but never contact details, account credentials, or data the person could not already see.
• Professional advisers, regulators, courts, or authorities when disclosure is legally required or necessary to protect rights and service security.

Savings uses recorded solar production and Electricity Prices entered by authorized users. Solarverse does not accept or send electricity bills to an AI provider for Savings.

Solarverse's core application, databases, backups, and service logs are hosted in approved European regions. That is not a claim that every subprocess stays in the EU. Communications, mapping, push, content delivery, and AI features may process limited data in the United States or other countries.

AI Investigations and AI summaries use Google's globally routed paid Gemini Developer API, so Solarverse cannot guarantee EU-only processing for the bounded evidence package or the placeholders a summary is written from. Where data-protection law requires it, we rely on an applicable adequacy decision (including the EU-US Data Privacy Framework for certified US providers), standard contractual clauses or another lawful transfer mechanism, and the provider's data-processing terms. You may contact us for information about safeguards relevant to your data.

We retain data only for as long as needed for the purposes above. The period depends on the type of data and customer relationship:

• Account, organization and plant records are kept while the service or customer agreement is active and then for a limited period needed for export, recovery, legal obligations, disputes, and security.
• Raw inverter and plant telemetry is retained for 24 months in the operational time-series store, then removed. Encrypted backups may hold copies until the backup rotation expires.
• Ordinary sign-in sessions expire after seven days unless refreshed or revoked sooner. Verification links expire after one hour.
• Push identifiers remain until the device is disconnected, the preference is disabled, your access to the organization ends, or the related account data is deleted.
• Email and push messages about your sites, such as updates from your installer or monthly reports they approve (sent by email with a PDF copy), are queued with a record of their delivery for 90 days, then removed. You choose which of these reach you under Account → Notifications; your choices remain until you change them or the related account data is deleted.
• Early-access and support records remain while we evaluate or respond to the request and are periodically reviewed or deleted when no longer needed.
• Privacy and deletion request records are kept only as long as needed to verify, complete, and document the response, including any legal compliance that must be demonstrated.
• Electricity Price history and related audit records are kept as needed to provide recalculated Savings Estimates, explain changes, and preserve customer business records. Any legacy Savings source files created before the bill workflow was retired remain protected while their documented export, retention, or deletion decision is completed.
• Investigation inputs and validated results remain in Solarverse according to the related Alert and customer record. Google states that paid Gemini API inputs and outputs are not used to improve its products. Google may retain prompts, contextual information, and outputs for up to 55 days for abuse monitoring. Solarverse does not enable provider tools, file storage, or provider-side retrieval for this feature.
• Morning Brief AI summaries are shown for the day they are written. Solarverse deletes the placeholders, the filled-in values, and the summary from its AI job records within 24 hours; usage counts and costs remain. Google may retain the placeholders and the summary for up to 55 days for abuse monitoring.
• A Monthly Report AI summary is shown to clients only when an installer approves the report with it; it is then kept with the approved report. Unapproved summaries are deleted from the AI job records within 24 hours, as above.
• Plant Update drafts, including the installer's note, are deleted from the AI job records within 24 hours. A message the installer edits and sends is kept like any other Plant Update.
• Ask Solarverse questions and answers are deleted from the AI job records within 10 minutes after the answer; usage counts, costs, and the time of the question remain. Google may retain them for up to 55 days for abuse monitoring.
• Deleted production data may remain temporarily in encrypted backups until the applicable backup rotation expires. The current pilot rotation keeps hourly, daily, weekly and monthly recovery points, with the oldest routine monthly snapshot retained for up to 12 months. Backup data is not restored except for disaster recovery.

We use measures intended to protect data against unauthorized access, alteration, loss and disclosure, including HTTPS, restricted administrative access, secure session storage, least-privilege service and database roles, tenant isolation, encrypted off-site backups, monitoring, and audit records. No service can promise absolute security; please report suspected misuse promptly.

Depending on applicable law, you may request access, correction, deletion, restriction, portability, or a copy of your personal data, and may object to certain processing or withdraw consent. You may also complain to the competent data-protection authority, including the Commissioner for Information of Public Importance and Personal Data Protection of the Republic of Serbia (poverenik.rs) where applicable.

An organization administrator may need to preserve or transfer operational records owned by the customer before an individual account is deleted.

Solarverse is a business service for solar operators and is not directed to children. We do not knowingly create accounts for anyone under 18. Contact us if you believe a child has provided personal data.

We may update this policy when the product, providers, or legal requirements change. We will publish the revised date here and provide additional notice where a change materially affects users or requires consent.

COTIDIE GROUP DOO
Bulevar vojvode Mišića 37, sprat 1, 11102 Beograd (Savski Venac), Republika Srbija
PIB 110087689 · MB 21295345

Solarverse privacy contact: info@cotidiegroup.com