This is the English version of a document originally drafted in Romanian. The Romanian version is available at greenlead.ro/spark/confidentialitate. Both versions describe the same processing activities.
1. Who we are
The Spark – Solar Assistant mobile app (“Spark”, “the app”) is operated by:
Nova Carpathians Creations S.R.L., a Romanian company, VAT no. RO40526927, registered office in Câmpeni village, Botoșani county, Romania — the same company that operates the GreenLead platform (greenlead.ro).
- E-mail: contact@greenlead.ro
- Phone: +40 754 389 035
For the purposes of Regulation (EU) 2016/679 (GDPR), we are the controller of the personal data processed through the Spark app.
We are not legally required to appoint a Data Protection Officer (DPO), but you can use contact@greenlead.ro for any GDPR request.
Relationship with the GreenLead platform
Spark is a mobile app separate from the greenlead.ro web platform, but it uses the same account infrastructure. If you already have an account on greenlead.ro, your Spark account is the same account, and part of your profile (name, e-mail, phone, locality, details about your photovoltaic system) is shared between the two services.
The general GreenLead privacy policy (available in Romanian) continues to apply to the web services — installer matching, quotes, configuration requests. This document covers the Spark mobile app specifically and prevails for the data described below.
2. In short: what you need to know
- Spark reads your photovoltaic system data from your account with the inverter manufacturer and uses it to show you production, consumption, battery state and any faults.
- To do that, we store the credentials you enter for your inverter cloud (section 4.3 — please read it, it matters).
- The questions you ask the Spark+ assistant and the photos you upload for diagnostics are sent to external artificial intelligence providers (Google and OpenAI) so they can generate the answer.
- We do not sell your data. We do not use it for advertising. We do not give it to installers without your explicit request.
- The app does not access your phone's location. The coordinates used for the weather forecast come from the locality you enter in your profile or from the plant data reported by your inverter.
- You can delete your account entirely from within the app (Settings → Delete account).
3. What data we collect and why
3.1 Account data
| What | Source | Legal basis |
|---|---|---|
| E-mail address, password (stored as a hash by our authentication provider) | From you, at sign-up | Performance of the contract (Art. 6(1)(b) GDPR) |
| First and last name | From you, at sign-up or in your profile | Performance of the contract |
| Apple or Google account identifier | From Apple/Google, if you choose “Continue with Apple” / “Continue with Google” | Performance of the contract |
| Phone number (optional) | From you | Legitimate interest — contacting you when needed (Art. 6(1)(f)) |
If you use Sign in with Apple, Apple may hide your real e-mail address behind a privaterelay.appleid.com alias. We only receive and store the alias.
3.2 Your energy profile
You enter these yourself, during onboarding or later in your Profile, and Spark uses them to produce every calculation relevant to your home:
- locality, county, address and property type, floor area, number of occupants
- whether you have photovoltaic panels, installed capacity (kW), number of panels, inverter brand
- battery capacity (kWh), whether you have a heat pump and its rating, whether you have an electric vehicle and its battery capacity
- estimated monthly bill, the actual energy price in your contract, contract type, supplier, feed-in tariff
- your main appliances, consumption pattern and the hours during which you consume
- the applicable settlement scheme (prosumer / consumer), export status
- the system's installation date and investment value, if you choose to enter them (used solely to compute payback)
Legal basis: performance of the contract — without this data the app cannot produce the estimates and recommendations that are the very purpose of the service.
3.3 Your inverter connection
When you connect a photovoltaic system, you give us the credentials for your account on the manufacturer's platform (Sungrow iSolarCloud, Huawei FusionSolar, Growatt ShineServer, Deye Cloud, SolisCloud, Solarman or others added later). Specifically, we store:
- the chosen provider and server region
- the username / e-mail address of that account
- the access credential (the account password or, for some brands, a system code / API key)
- access and refresh tokens, where the brand uses OAuth-style authentication
- your plant's code and name
Legal basis: performance of the contract, at your explicit request. See section 4.3 for how this data is protected.
3.4 Your photovoltaic system data
Retrieved automatically and periodically from your account with the inverter manufacturer, for as long as the connection remains active:
- solar production, household consumption, import from and export to the grid
- battery state and state of charge, charge/discharge power
- technical parameters reported by the inverter: voltages and currents per phase and per string, frequency, temperatures, insulation resistance, equipment states
- alarms and error codes reported by the system
- consolidated daily totals (production, self-consumption, import, export, peak power, hourly curve)
This data is kept as history so we can show you trends over time, detect production anomalies and run routine checks.
Legal basis: performance of the contract.
3.5 The Spark+ assistant and Diagnostics
- the content of your conversations with the Spark+ assistant and of diagnostic sessions (your messages and the generated answers)
- the photos you take or pick from your gallery for diagnostics (usually pictures of the inverter, of an error display or of the installation)
- session metadata: equipment type, the selected problem, the error code, whether the problem was marked as resolved
Photos are sent to the artificial intelligence provider to be analysed. Images passed directly into the conversation are not saved to our database; they exist only for the duration of processing the request. When you upload an image to our private storage, the file and a reference to it are retained, and both are deleted together with the diagnostic session or with your account.
The camera and photo gallery are accessed only when you explicitly tap the button to add a photo. The app does not access your gallery in the background.
Legal basis: performance of the contract.
3.6 Notifications
- your device's push notification token, the platform (iOS/Android) and the active/inactive state
- your notification preferences (daily recommendations, price alerts, inverter alarms and the thresholds you choose)
- a log of the notifications sent: type, title, delivery status and any errors
Legal basis: consent (Art. 6(1)(a)) — you grant notification permission at operating-system level and can withdraw it at any time from your phone's settings or from Settings → Notifications in the app.
3.7 Usage and technical data
- usage events in the app: opening the app, screens visited, onboarding steps completed, connecting/disconnecting an inverter and the outcome (success/error, without credentials), sending a message in Spark+, starting a diagnostic session or a routine check, hitting the free plan limit, viewing and interacting with the subscription page, the result of a purchase, changing language, sharing an image from the app
- for each event: app version, platform, a session identifier and the timestamp
- AI model usage metrics: the function called, the provider and model used, the number of tokens consumed, latency, whether the call succeeded and any error code — used to control costs and limits, not for profiling
- error and crash reports, collected through Sentry, configured not to include default personal data
- your interface language preference
Legal basis: legitimate interest (Art. 6(1)(f)) — to understand how the app is used, detect defects and keep the cost of the service under control. We do not build advertising profiles and we do not sell this data.
3.8 Subscriptions
When you purchase a Spark Pro subscription, payment is processed entirely by Apple (or Google, on Android). We do not receive or store your card details. We only receive confirmation that the subscription is active, linked to your account identifier, in order to unlock your paid features.
Legal basis: performance of the contract.
3.9 What we do NOT collect
- Your phone's location. The app does not request or use the location permission. Coordinates for the weather forecast are derived from the locality you enter in your profile or from the plant position as reported by the inverter manufacturer's platform.
- Contacts, microphone, calendar, health or other sensitive data.
- Special categories of data within the meaning of Art. 9 GDPR.
- We do not track your activity in other apps or websites and we do not display advertising.
4. Who we share data with
We do not sell or rent your data. We share it only with the following providers, strictly to operate the app, each under a data processing agreement:
4.1 Infrastructure and service providers (processors)
| Provider | What they process | Where |
|---|---|---|
| Supabase (infrastructure on Amazon Web Services) | Account, profile, inverter data, conversations, notifications — effectively the whole database and the server functions | European Union (Frankfurt, Germany) |
| Google (Gemini API) | The content of Spark+ conversations and diagnostic sessions, diagnostic photos and your system's technical context, in order to generate the answer | USA |
| OpenAI | The same categories as above, as a fallback when Google does not respond; additionally, generating daily recommendations and indexing our technical knowledge base | USA |
| Expo (Expo Application Services) | The push notification token and the content of push notifications sent to your phone | USA |
| Sentry | App error and crash reports | European Union / USA |
| Open-Meteo | Approximate geographic coordinates (locality or plant position), for the weather forecast; they receive no identifier of yours | European Union |
| Apple / Google Play | Processing subscriptions and their status | USA |
The artificial intelligence providers we use are engaged through their developer interfaces, which provide that data submitted via the API is not used to train their models.
4.2 Inverter manufacturers' platforms (independent recipients)
When you connect an inverter, we transmit your credentials to that manufacturer's platform (Sungrow, Huawei, Growatt, Deye, Solis, Solarman etc.), in order to authenticate on your behalf and read your plant's data.
These companies are independent controllers for the account you hold with them, and your relationship with them is governed by their own privacy policies, not by this one. Many of them are located outside the European Union (China and other jurisdictions). By connecting an inverter, you agree to this transfer.
4.3 A candid note about inverter credentials
The credentials for your inverter cloud are needed so the app can periodically read your system's data in the background — including while your phone is switched off. For that reason they are stored by us, not merely used once.
How they are protected:
- the database is hosted in the European Union and is encrypted at rest at storage level by the infrastructure provider;
- all transmissions are encrypted (TLS);
- access is restricted through row-level security policies, so that one user cannot read another user's connection;
- credentials are never displayed back in the app, never appear in logs and are never sent to artificial intelligence providers.
What you should nonetheless know
These credentials do not benefit from additional, separate field-level encryption beyond the protections above. Where the manufacturer's platform allows it, we recommend using a dedicated account with limited rights instead of your main administrator account. You can delete the connection from the app at any time, and the stored credentials are removed along with it.
4.4 Other situations
We may disclose data where the law requires it, upon a lawful request from an authority, or to defend our rights in court. If the company were ever involved in a merger or acquisition, data could be transferred to the new entity, with prior notice to you.
We do not pass your data to installers in the GreenLead network unless you explicitly ask us to (for example, by sending a technical sheet to an installer or through a quote request).
5. Transfers outside the EU
Some of the providers listed above (Google, OpenAI, Expo, Sentry, Apple) process data in the United States. These transfers are carried out on the basis of the mechanisms set out in Chapter V of the GDPR — Standard Contractual Clauses adopted by the European Commission and/or the EU–U.S. Data Privacy Framework, as applicable.
The transfer of credentials and read commands to the inverter manufacturers' platforms (section 4.2) is carried out on the basis of Art. 49(1)(b) GDPR — necessary for the performance of the contract concluded with you, at your request.
6. How long we keep data
| Category | Retention period |
|---|---|
| Account and energy profile | For as long as the account is active |
| Inverter connection (including credentials) | Until you delete it in the app or delete your account |
| Raw system measurements (detailed periodic readings) | 90 days from recording |
| Consolidated daily totals | For as long as the account is active — they form the basis of your energy history |
| Alarms and error codes | For as long as the account is active |
| Spark+ conversations and diagnostic sessions | For as long as the account is active |
| Usage events and AI consumption metrics | 24 months from recording |
| Error reports (Sentry) | A maximum of 90 days |
| Log of notifications sent | 12 months from dispatch |
After you delete your account, we keep only what the law requires us to keep (for example, accounting records relating to subscriptions, under Romanian tax legislation).
7. Your rights
Under the GDPR, you have the right:
- of access — to know what data we hold about you and to receive a copy;
- to rectification — to correct inaccurate data (you can edit most of it directly in your Profile);
- to erasure — you can delete your account directly in the app, Settings → Delete account; the operation is irreversible and removes the account, the profile, the inverter connection, the system history, conversations and diagnostic sessions;
- to restriction of processing;
- to data portability — to receive your data in a structured, commonly used format;
- to object to processing based on our legitimate interest, including the collection of usage events;
- to withdraw your consent at any time, where processing is based on consent (for example, push notifications), without affecting the lawfulness of prior processing.
You can exercise your rights by writing to contact@greenlead.ro. We respond within one month of receiving the request. For complex or numerous requests, that period may be extended by no more than two further months, in which case we inform you of the extension and its reasons within the first month (Art. 12(3) GDPR).
You also have the right to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) — Bd. G-ral Gheorghe Magheru nr. 28–30, sector 1, Bucharest; anspdcp.ro. If you reside in another EU member state, you may also lodge a complaint with your local supervisory authority.
8. Security
We apply appropriate technical and organisational measures: encryption in transit (TLS) and at rest, isolation of data between users through row-level security policies, authentication through a specialised provider, restricted administrative access, logging of sensitive operations.
No system is entirely secure, however. If a personal data breach occurs that is likely to affect your rights, we will inform you without undue delay, in accordance with Art. 33–34 GDPR.
9. Children
Spark is not directed at persons under 16 and we do not knowingly collect their data. If you become aware that a child has provided us with personal data, write to contact@greenlead.ro and we will delete it.
10. Automated decisions
The app automatically generates estimates, recommendations and technical verdicts based on your system's data. These are informational — they produce no legal effects concerning you and do not constitute automated decisions within the meaning of Art. 22 GDPR. You may always disregard them or ask for a human opinion by writing to us.
11. Changes to this policy
We may update this policy when we add new features or change providers. The current version is always available at greenlead.ro/spark/en/privacy and in the app, under Settings → Privacy Policy. The date of the last update appears at the top of the document. For significant changes, we will notify you in the app.
12. Contact
Nova Carpathians Creations S.R.L.
VAT no. RO40526927
Câmpeni village, Botoșani county, Romania
contact@greenlead.ro · +40 754 389 035
The terms of use for the Spark app are available at greenlead.ro/spark/en/terms.