P1On Privacy Policy

⚠️ DRAFT — requires counsel review before publication. Placeholders in [BRACKETS] must be completed by the controller. This draft is written to satisfy GDPR Art. 13/14 and to serve as the privacy-policy URL required by the Apple App Store and Google Play.

Every statement about data below is checked against the code (tables in backend/template.yaml, entity definitions in DATA_MODEL.md). Questions only counsel or the owner can answer are marked > **For counsel:**. The controller identity, DPO and lawful bases are owner task O15 and are not decided here.

Effective date: [DATE] Version: [SEMVER — bump on every material change; the app stores the version the user accepted] Last updated: 2026-10-05

1. Who we are (data controller)

[CONTROLLER LEGAL NAME], [REGISTERED ADDRESS], [COMPANY NUMBER] ("P1On", "we", "us") is the controller of your personal data.

• Contact / Data Protection Officer: [DPO NAME, EMAIL]
• Supervisory authority: you may lodge a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données, www.dataprotectionauthority.be) or, if you are in the Netherlands, the Autoriteit Persoonsgegevens (www.autoriteitpersoonsgegevens.nl).

For counsel: name the controller legal entity and decide whether a DPO must be appointed (Art. 37) — owner task O15. Nothing in this draft names either.

2. What P1On does

P1On is a mobile app that reads your home smart-meter data via a P1 WiFi reader you own, shows you real-time and historical energy usage and cost, and produces AI-generated weekly insights, usage alerts and a progress ("skyline") view.

Households. In P1On a home is the unit that owns readers and data. You can invite other people into your home with a link. Every member of a home sees that home's devices, readings, insights, alerts, alert history and progress, and the list of its members. See §3 ("Shared with the other members of your home").

Important: smart-meter consumption data is personal data. It can reveal when you are home, your sleep and holiday patterns, and which appliances you use. P1On additionally infers appliance-level behaviour using non-intrusive load monitoring (NILM). We treat this data accordingly.

3. What data we process

Each row names the database table or service that holds the data, so the retention in §6 can be read against it.

Shared with the other members of your home. Every member of a home can see all the rows above that are keyed to the home: devices (including the contract data), readings and summaries, insights, alerts, alert history, progress, and the member list (user id, role, join date and the display name each member chose to set; never email addresses). Only home owners can change the energy plan and price zone, and only owners can invite or remove members. When someone leaves or is removed, they lose access at once.

For counsel: (a) the lawful basis for disclosing one person's household data to the other members the owner invites; (b) whether the household exemption (Art. 2(2)(c)) or joint controllership applies between members; (c) whether a member must be told that an owner can see their usage.

We do not collect data from your grid operator or supplier portal: all energy data comes from hardware you own. We do not collect your location, address or phone number. Two shared caches hold no personal data at all: day-ahead wholesale electricity prices (p1on-prices) and daily mean outdoor temperature per price zone (p1on-weather).

4. Why we process it, and our legal basis

For counsel: confirm the lawful basis for each bracketed row (owner task O15). Whether NILM disaggregation, which infers appliance behaviour, can rest on the contract or needs consent is the central question.

Where a purpose relies on consent, we ask for it explicitly and you may withdraw it at any time without affecting the lawfulness of earlier processing.

5. AI-generated content

Your weekly insights are generated by Amazon Nova large language models (Nova Micro, with Nova 2 Lite as a fallback if the primary is unavailable), hosted on AWS Bedrock in the EU. The model receives only the week's figures (total kWh, kWh per day, kWh per appliance category, the pre-computed findings and tip candidates, and your appliance survey answers) and last week's tip texts. It does not receive your name, email address, home name or any identifier. They are advisory only — they do not make automated decisions with legal or similarly significant effects about you (GDPR Art. 22 does not apply). AI-generated text is labelled as such in the app.

6. How long we keep data

Retention is enforced by DynamoDB time-to-live (TTL) where a TTL is shown. DynamoDB deletes an expired item within about 48 hours of its expiry, so a TTL is a clean-up, not a precise clock.

There is no separate analytics or training store today: the long-term history is the 2-year summaries above. (A cold-storage bucket exists but nothing writes to it; see §7.) Two shared caches hold no personal data and are not listed above: day-ahead electricity prices (40 days) and daily mean temperatures (400 days).

Backups. Every DynamoDB table has point-in-time recovery switched on, which keeps a rolling 35-day backup that we can restore from if data is lost or corrupted. When you delete your account (or something expires), your data is erased from the live tables at once, but copies of it can remain in these backups until the 35-day window has passed; backups are not edited, they simply roll off. We do not restore a backup in a way that would bring back an erased account. This is standard practice, and the 35 days is the longest your data can persist after erasure (plus the up-to-48-hour TTL delay above).

For counsel: confirm the 2-year period for summaries, insights and progress rows and its justification (seasonality of household consumption), and the Sentry retention period.

When you delete your account we erase your data as described in §9.

7. Machine-learning training

[NOT YET LIVE — the ML training/export pipeline this section describes (readings → S3 → training store) is not implemented yet; do not publish this section, or reword it to the present tense, until it ships. Kept here as the intended design:]

We use your readings to train models that power insights and anomaly detection. Before data enters our training store we [pseudonymise it by replacing device and user identifiers with salted tokens held separately]. The optional appliance-label feedback loop is strictly opt-in. Deleting your account also removes your data from the training store.

8. Who we share data with (sub-processors)

We use vetted service providers under Art. 28 data-processing agreements. Our current sub-processor list is at sub-processors.md. What each receives:

Transfers outside the EEA. Notification delivery goes through Expo, which is a US company, and on to Apple and Google; your push token and the notification content leave the EEA on that path. Sentry's region is not yet confirmed. Everything else stays in the EU.

For counsel: the transfer mechanism for Expo, Apple/Google and (if US) Sentry — Standard Contractual Clauses, the EU–US Data Privacy Framework, or another — and whether the push payload should be reduced so that it carries no figures or identifiers (owner decision; design change).

Public data sources receive no personal data. To price dynamic tariffs and compute progress targets we fetch day-ahead electricity prices (api.energy-charts.info) and daily mean temperature (KMI/IRM in Belgium, KNMI in the Netherlands). Each request names only a price zone (BE, NL or LU), a weather station and a date. No user, device or home information is sent.

9. Your rights

You have the right to access, rectify, erase, restrict, and object to processing of your data, and to data portability. In the app you can:

• Delete your account (Profile → Delete account) — erases your data across all our stores; access is revoked within 30 seconds, and the stored data is physically deleted in the background, normally within 15 minutes and in every case within 24 hours.

  Shared homes. What is erased depends on who else is in your home:

  • If you are the only member, the whole home is deleted: its devices, readings, summaries, insights, alerts, alert history, progress rows and invite links.
  • If other people are still members, the home and its data stay in place for them. Only your own membership, push tokens, live connections, profile and sign-in account are removed. If you were the only owner, the longest-standing remaining member becomes the owner. Rows that record who created something (a device's pairer, an alert's creator, an invite's creator, who invited a member) keep your user id, which no longer maps to any account.

  For counsel: whether keeping a departed member's opaque user id on shared-home rows, and keeping the readings of a shared home, is acceptable under Art. 17, or whether the user id must be scrubbed (owner decision; a code change).

• Download your data (Profile → Download my data) — a machine-readable JSON copy (GDPR Art. 15 and 20). It contains your profile (including your display name), the homes you belong to (name, time zone, your role), their devices, alert rules, alert history, insights, progress rows, the invite links you created (never the link itself or its hash), your push tokens with their registration time, and the daily summaries of every device for the whole two-year retention. The hourly summaries and the raw readings still inside their nine-day window are delivered in pages by the web app's download; the phone apps' download carries everything else, and we send the hourly and raw detail on request within the one-month period below. Each export request is logged with your user id and the time (never the data) so we can show we answered within the deadline.

You may also contact [DPO EMAIL]. We respond within one month (GDPR Art. 12(3)).

10. Security

Data is encrypted in transit (TLS) and at rest (AWS KMS on our databases and storage). Every request is authenticated, and access to a home's data is checked on every request against your current membership of that home (a consistent read, so a removed member is refused immediately). Readers authenticate to our broker with their own factory-installed certificate. Error reports are configured not to attach request bodies, headers or cookies.

11. Children

P1On is not directed at children. You must be at least 16 years old to use it.

12. Changes

We may update this policy; we will notify you of material changes in the app and record the version you accept.

13. Contact

[CONTROLLER LEGAL NAME] — [DPO / PRIVACY EMAIL] — [POSTAL ADDRESS].