Privacy Policy
Terms of Service Privacy Policy Cookie policy
This is a translation. The Polish version is binding.
1. Data controller
The controller of personal data is L4T Leszek Filipów ul. Pawła Pośpiecha 5, 44-300 Wodzisław Śląski. Contact regarding personal data: kontakt@coreinfra.eu.
What data, for what purpose and for how long
| Activity | Data | Purpose and legal basis | How long | Recipients |
|---|---|---|---|---|
| User accounts and sign-in | email, name, password hash (bcrypt/argon), IP and time of last sign-in, link to Google/GitHub/CCiL account (identifier, no tokens) | panel access, account security Art. 6(1)(b) (contract); (f) (security — IP, attempt limits) | until account deletion; reset/activation tokens until expiry + 1 day | hosting; email (centrum.coreinfra.eu); Google/GitHub only when used for sign-in |
| Sites, devices and configuration | site name and address/city, coordinates, PV capacity, battery, tariff, devices (brand, model, connector serial number), automation settings | home energy management Art. 6(1)(b) GDPR | until site or client account deletion (request: 14 days to withdraw) | hosting; OpenStreetMap Nominatim (city and postal code — approximate coordinates); Open-Meteo (coordinates rounded to 0.01° ≈ 1 km) |
| Energy measurements (telemetry) | PV, grid and battery power and energy, consumption, temperatures; the consumption profile may reveal household occupancy | visualisation, forecasts, optimisation, reports Art. 6(1)(b) GDPR | raw measurements: per plan (history_days); hourly aggregates: until account deletion; batches: 7 days | hosting; client node (buffer of up to 72 h) |
| Control (commands) and automation decisions | device commands, their source (user/automation/autopilot), result | control execution and accountability Art. 6(1)(b); (f) (accountability) | commands and history: 90 days; optimisation runs: 30 days | hosting; client connector/node |
| AI assistant and AI recommendations | user's question, site facts (no email or name), answer | explaining decisions and data Art. 6(1)(b) GDPR (plan feature) | questions and answers: 30 days | AI CoreInfra (ai.coreinfra.eu) |
| Push notifications | browser subscription endpoint, browser (User-Agent), alert level | alert notifications Art. 6(1)(a) (enabled by the user) / (b) | until the subscription is disabled or expires (HTTP 404/410) | browser vendor push service (Google FCM, Mozilla, Apple, Microsoft) — content end-to-end encrypted (RFC 8291) |
| Monthly email reports | email, site energy and cost summary | information for the client Art. 6(1)(b) GDPR; opt-out in the panel | report snapshots: until account deletion; mail log: 30 days | email (centrum.coreinfra.eu) |
| Absence calendar (iCal) | private calendar link (encrypted), events with keywords as absence periods | consumption forecast during trips Art. 6(1)(a) (voluntary connection) | until the calendar is disconnected | calendar provider chosen by the client (file download) |
| Logs, audit and diagnostics | application events (request URL, IP, user ID), administrative actions, problem reports (reporter's email) | security and maintenance Art. 6(1)(f) GDPR | event log: 7 days; integration logs: 7 days; audit: until client account deletion | hosting; L4T support ticket panel (panel.l4t.pl) — only tickets submitted by the user |
| Public website visit statistics | address and title of the visited public page, referring page, screen resolution, browser language (no cookies set by the script, no data from the client panel) | visit statistics of the public website and link exchange Art. 6(1)(f) GDPR | as set by the link exchange panel (panel.l4t.pl) | L4T link exchange panel (panel.l4t.pl) |
| Backups | entire database (encrypted) | disaster recovery Art. 6(1)(f) GDPR; Art. 32 GDPR | 14 most recent backups on the backup node (deleted data disappears from backups as they rotate) | backup nodes (ciphertext, without key) |
Entities to which we entrust data
- Hosting (application and database server) — all data (data processing agreement with the hosting provider)
- centrum.coreinfra.eu (email) — email, message content (CoreInfra service)
- AI CoreInfra (ai.coreinfra.eu) — facts about the installation, questions to the assistant (CoreInfra service; only when enabled in the plan)
- Google / GitHub (OAuth) — sign-in (identifier, email) (only when the user signs in with this account)
- Browser push services — encrypted notification content (only after notifications are enabled)
- OpenStreetMap Nominatim — city and postal code (approximate geocoding)
- Open-Meteo — coordinates rounded to approx. 1 km (weather and solar irradiance forecast)
- L4T support ticket panel — ticket content, reporter's email (only tickets submitted from the panel)
- L4T link exchange panel (panel.l4t.pl) — visit statistics of public pages (page address, referrer, screen, language) (public pages only, when statistics are enabled; switch: Integrations → Link exchange)
2. Rights of data subjects
You have the right to access your data, to rectification, erasure, restriction of processing, data portability and to object to processing based on legitimate interests.
You may withdraw your consent (e.g. to push notifications or calendar connection) at any time in the panel; this does not affect the lawfulness of processing carried out before its withdrawal.
Data export and account deletion are available in the panel (Privacy). Send other requests to kontakt@coreinfra.eu.
You have the right to lodge a complaint with the President of the Personal Data Protection Office (UODO) (ul. Stawki 2, 00-193 Warsaw).
3. Voluntary provision and automated decisions
Providing data is voluntary but necessary to create an account and use the panel.
Automation and AI schedule the operation of energy devices (e.g. battery charging). These are not decisions producing legal effects concerning you within the meaning of Art. 22 GDPR; you switch automatic mode on and off yourself.
4. Transfers of data outside the EEA
Data is stored on the Service's hosting provider's server. Signing in with a Google or GitHub account and browser push notifications may involve transferring data to the USA — on the basis of the European Commission's decision on the EU-US Data Privacy Framework or the standard contractual clauses of these providers — only when you use these features.
5. Cookies and browser storage
We use essential cookies: the session (HEMSSID — sign-in, cart, form protection), the remembered language (hems_lang) and the remembered cookie choice (hems_consent), and in browser storage — the theme and display settings.
Visit statistics run only after you consent in the banner; you can change your consent in the page footer (“Cookie settings”). We do not use advertising cookies.
The full list, retention periods and how to manage them are described in the Cookie policy (/polityka-cookies).
6. Security
Connections are encrypted (HTTPS), passwords are stored as hashes (bcrypt), and integration secrets, keys and tokens are encrypted. The connector only makes outbound connections and verifies the server certificate.
Administrative access is recorded in the audit log.