Privacy policy

Last updated: 4 July 2026

Who we are

This privacy policy explains how the Amber Energy application ("Amber Energy", "we", "us") collects, uses and protects your personal data when you use our mobile and web application for managing shared local solar energy.

The data controller responsible for your personal data is S. MATTHYS CONSULTING, Avenue général Merjay 32, 1160 Auderghem, Belgium (company number BE 1014.957.520). For any question about this policy or your personal data, contact us at contact@amber-energy.be.

Scope

This policy applies to the Amber Energy Android app and the Amber Energy web application served at amber-energy.be. It does not cover third-party services we link to, which have their own privacy policies.

Data we collect

We only collect the data we need to run the energy-sharing service:

Account and identity: your email address, name, preferred language and email-verification status, obtained when you sign up or sign in (including via Google sign-in).
Login credentials: your password is stored and verified by our identity provider (Keycloak); we never store your password ourselves. We also generate short-lived, hashed tokens for email verification and password resets.
Waitlist information (if you join our waitlist): your email address, and optionally your name, postcode, municipality, street and a short message. When you select a street, we store its approximate map coordinates (the centre of the street). We do not access your device's GPS location.
Energy and metering data: readings from your smart meter and solar inverter (production, consumption and injection), the energy allocated to you within your sharing group, appliance labels you add, and the tariff details of your energy contract. This data is linked to your member account.
Device and installation data: technical identifiers for your smart meter and inverter (such as device hostname, MAC address and the credentials needed to read your inverter's data).
Uploaded contract files: if you import an energy contract to pre-fill your tariff, we process the file to extract pricing information (see "Who we share data with"). We do not store the file itself — only the pricing details you then confirm.
Notifications: if you enable push notifications, a device notification token and your notification preferences.
Session data: cookies and tokens that keep you signed in.

How we use your data

We use your personal data to:

Provide the energy-sharing service — display your energy use, compute how shared solar is allocated to you, and manage your account and installations (legal basis: performance of our contract with you).
Authenticate you and keep your account secure (contract / legitimate interest).
Send you service emails such as verification, password reset and invitations (contract).
Send push notifications you have opted in to, such as solar-surplus alerts (your consent).
Manage our waitlist and understand where interest in the service is located (your consent / legitimate interest).

We do not sell your personal data, and we do not use it for advertising.

Who we share data with

We share personal data only with the service providers we need to run Amber Energy:

Google — when you choose to sign in with Google, and for delivering push notifications (Firebase Cloud Messaging).
Our identity provider (Keycloak) — to manage your login and password.
Anthropic — if you upload an energy contract, the file is sent to Anthropic's AI service solely to extract the tariff details; it is not used to train models and we do not retain the file. Please avoid uploading documents containing information you do not want processed for this purpose.
Our email provider — to deliver the service emails described above.
Your solar inverter's manufacturer (such as SolarEdge, Huawei, Solis or SMA) — to read your production data using the credentials you provide.

We do not have any analytics or advertising trackers in the app.

International transfers

Some of these providers (for example Google and Anthropic) may process data outside the European Economic Area. Where that happens, the transfer is covered by appropriate safeguards such as the European Commission's Standard Contractual Clauses.

How long we keep your data

Account data: for as long as you have an Amber Energy account, and deleted on request.
Detailed smart-meter readings: kept for about one month, then aggregated into summarised statistics.
Uploaded contract files: not retained — processed and discarded immediately.
Verification and reset tokens: short-lived and deleted after use or expiry.

Your rights

Under the GDPR you have the right to access, correct, delete or export your personal data, to restrict or object to certain processing, and to withdraw consent at any time. To exercise these rights, contact us at contact@amber-energy.be.

Security

We protect your data with encrypted connections (HTTPS/TLS), a dedicated identity provider for passwords, and access controls that limit who can see your data.

App permissions (Android)

The Amber Energy Android app requests only these permissions:

Internet access — to communicate with our servers.
Notifications — only if you choose to receive push notifications.

The app does not request access to your location, contacts, camera, microphone or files beyond the contract you choose to import.

Children

Amber Energy is not directed at children and we do not knowingly collect data from children under 16.

Changes to this policy

We may update this policy from time to time. The effective date above shows when it was last changed, and we will inform you of significant changes within the app.

Contact and supervisory authority

For any privacy question, contact contact@amber-energy.be. If you are located in Belgium and believe we have not handled your data properly, you may lodge a complaint with the Belgian Data Protection Authority (Autorité de protection des données / Gegevensbeschermingsautoriteit), Rue de la Presse 35, 1000 Brussels — www.dataprotectionauthority.be.