Legal

Privacy Policy

Last updated: 5 November 2026

This notice explains what personal data backyard.energy collects when you use the service, why we process it, how long we keep it, and the rights you have under the EU General Data Protection Regulation (GDPR). We describe only what the product actually does.

Who is responsible

The data controller is the operator of backyard.energy. For any privacy question or to exercise your rights, contact info@backyard.energy.

What we collect

Account data: your first and last name, email address, username, password (stored only as a bcrypt hash) and — if you use Google sign-in — your Google account identifier.
Estonian national ID code (isikukood), optional: collected only if you provide it, to establish billing / e-invoice identity.
Preferences: interface language, country, timezone, theme and notification settings.
Energy data: meter readings for your metering points at hourly or 15-minute resolution, plus the node / branch / meter structure, contracts and parameters you configure. Consumption timeseries can reveal household occupancy patterns, so we treat it as personal data.
Session and security data: a session cookie (JWT) and audit-log records of security-relevant actions (logins, profile changes) including IP address and browser user-agent.
Agent sign-in: when an AI tool starts a sign-in, we store the IP address and user-agent of that request, even if nobody approves it. When you approve it, we store a session record (a client label taken from that user-agent, the company or personal scope, read-only or write mode, creation, last use and how it ended), the IP address each of its credentials was issued to, and a log of each call it makes (method, route without its parameters, status and time). Credentials are stored only as hashes.
Product-usage counters: a per-day count of how many times you opened each screen of the application, stored against your account. No page-by-page event log is kept, so an individual session cannot be reconstructed from it. Nothing is sent to a third party, and no tracking cookie or device fingerprint is involved.

Why we process it

To provide the energy-analytics service — computing your energy and cash flows, costs, forecasts and reports.
To authenticate you and keep your account secure.
To send transactional email (email verification, password reset, the notice that you approved an agent sign-in, which names the client, its IP address and the read-only or write mode, the notice that an agent session was stopped, and the alerts you opt into).
To meet legal and accounting obligations where they apply.
To learn which parts of the application are actually used, so that unused ones can be removed rather than guessed about. Only aggregates are ever displayed — a view count and a count of distinct users — never who opened what.

Legal basis

We process account and energy data to perform the service you request (contract). Security logging, abuse prevention and product-usage counting rely on our legitimate interest. Optional data such as the national ID code, and marketing consent, rely on your consent — which you can withdraw at any time.

How long we keep it

Account and energy data: for as long as your account is active.
On account deletion: your identifying details are erased (pseudonymized) immediately, and the consumption timeseries of nodes you solely own is permanently purged after a short grace period (currently 30 days) that lets you recover from an accidental deletion. Nodes owned by an organization stay with that organization.
Audit logs: retained about 12 months, then deleted automatically; identifiers relating to a deleted account are redacted at erasure.
Product-usage counters: about 13 months, then deleted automatically. They are also deleted immediately when your account is erased.
Agent sign-in: a daily job deletes a sign-in request, with its IP address and user-agent, 1 day after it expires (a request expires after 5 minutes); the call log after 90 days; the IP address of a credential 30 days after that credential expires while the session is in use; and a session that was revoked or has no usable credential left, with its credentials and client label, 90 days after it was revoked or its last credential expired. What is linked to your account is deleted immediately when your account is erased.

Who processes data on our behalf

Hosting and database: our self-hosted PostgreSQL infrastructure.
Email delivery: an SMTP email provider for verification, password-reset, agent sign-in and alert messages.
Google: only if you choose Google sign-in (identity verification).
Estonian energy data exchange (Estfeed): only if you connect it, to import your metering data.
Elering NPS: public electricity-market prices (no personal data).
Self-hosted monitoring (Grafana, Loki, Prometheus) for operational logs.
Your own AI tool: an AI tool you approve through agent sign-in receives the data it reads with that approval.

Your rights

Access — request a copy of your data. You can download a machine-readable export of your personal data from your profile, and a CSV of each node's meter readings from the app.
Rectification — correct inaccurate data.
Erasure — delete your account and data from your profile settings.
Portability — receive your data in a structured, machine-readable format (the JSON export).
Restriction and objection — limit or object to certain processing.
Complaint — lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon).

Cookies and sessions

We use a strictly-necessary session cookie (an httpOnly JWT named bem-token) to keep you signed in. An AI tool that signs in through agent sign-in holds three strictly-necessary httpOnly cookies of its own: bem_agent_pending for the sign-in in progress (5 minutes), and bem_agent_access and bem_agent_refresh for its session (30 days). We do not use advertising or third-party tracking cookies. Your theme preference is stored locally in your browser.

Contact

For privacy questions or to exercise any of the rights above, email info@backyard.energy.