Privacy Policy
1. Who we are
Solistant is operated by Ben Leonard, trading as Solistant, a UK-based sole trader. Our contact address is 1 Lyndhurst Road, Londonderry, BT47 5HS, United Kingdom. For privacy questions, email support@solistant.co.uk.
2. What this policy covers
This policy explains the personal data we process when you use the Solistant app, why we process it, how long we keep it, and your rights under the UK GDPR and Data Protection Act 2018.
3. Data we process and why
Account data
We process your email address, sign-in provider identifiers and authentication records to create, secure and manage your account. Passwords are stored only as one-way hashes. The legal basis is performance of our contract with you.
Connected-system credentials
When you connect supported services, we process credentials such as Solis API keys and secrets or a myenergi API key. They are encrypted at rest using AES-256-GCM and used to retrieve system data and, where enabled, issue scheduling commands. The legal basis is performance of contract.
Energy, system and forecast data
We process readings such as solar generation, household consumption, battery state of charge and inverter status, together with forecasts and the postcode or coordinates you provide. This lets us produce energy forecasts and schedules. The legal basis is performance of contract.
Subscription data
We receive subscription status, renewal dates and billing-event metadata from RevenueCat so that we can provide paid features and administer subscriptions. We do not receive your full payment-card details. The legal bases are performance of contract and compliance with relevant legal obligations.
Notifications, diagnostics and service email
If you allow notifications, we process a push token to deliver schedule and account notices; this is based on consent, which you can withdraw in device settings. Sentry may process error details, device model, operating-system version and app state so that we can maintain a reliable service, based on our legitimate interests. Resend processes your email address and necessary message content for verification, password reset and essential service email, based on contract and our legitimate interest in account security.
Advertising and device information
For users on the free or expired tier, Google AdMob may process device or advertising identifiers, IP address, approximate location derived from IP, ad interactions and technical device information. We use Google’s User Messaging Platform to collect applicable advertising privacy choices. Ads are requested only when Google reports that an ad request is permitted. You can revisit available choices in the app under Settings → Privacy → Ad privacy choices.
4. Inverter-command audit records
Commands sent through Solistant are recorded with details such as time, command type, target and response. These records are kept for three years and, after account deletion, are pseudonymised using a one-way hash of your user ID. This supports incident investigation and the establishment or defence of legal claims, which is a proportionate legitimate interest given the nature of hardware-control activity.
5. Service providers
We use providers to operate Solistant. Depending on the features you use, these include:
| Provider | Purpose |
|---|---|
| Neon; Fly.io | Database and application hosting |
| Expo / EAS; Google Firebase | App delivery and push notifications |
| Google sign-in and AdMob advertising | |
| Sentry | Error and performance monitoring |
| Resend | Transactional service email |
| RevenueCat | Subscription management |
| Open-Meteo; Met Office; PVGIS; Solcast | Weather and solar forecasts or calculations |
| Postcodes.io | Postcode and coordinate lookup |
| Groq | Short explanations generated from plan data |
| Solis; myenergi | Connected inverter or diverter services |
Some providers operate outside the UK. Where required, transfers use an applicable adequacy regulation or safeguards such as the UK International Data Transfer Agreement or UK Addendum to the EU Standard Contractual Clauses. Further information is available on request.
6. Retention
| Data | Retention |
|---|---|
| Account, connected-system credentials, readings and forecasts | Until you delete your account |
| Subscription records | Until account deletion, except records required for tax, accounting, fraud prevention or legal claims |
| Inverter-command audit records | Three years; pseudonymised after account deletion |
| Push tokens | Until permission is withdrawn or the account is deleted |
| Sentry crash logs | 90 days |
7. Your rights
You may have rights to access, correct, erase or receive your personal data; object to certain processing; and withdraw consent. You can export data through Settings → Privacy and delete your account through Settings → Account. You can also use our account-deletion page or email us. We aim to respond within one calendar month.
You can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.
8. Security
We use measures including TLS in transit and AES-256-GCM encryption for connected-system credentials at rest. No system is completely secure; please contact us if you suspect unauthorised account access.
9. Automated plans and human review
Plans are generated using rules, forecasts, historical readings and your settings. They are not professional energy, electrical, financial or safety advice. You can review, change or disable automation and ask us to investigate a plan or command.
10. Children
Solistant is not directed at children under 13 and we do not knowingly collect their data. Contact us if you believe a child’s data has been provided.
11. Changes and contact
We will provide an in-app notice, push notification or email where a material change requires it. Questions and rights requests can be sent to support@solistant.co.uk.
Ben Leonard, trading as Solistant
1 Lyndhurst Road
Londonderry
BT47 5HS
United Kingdom