Amber Energy

Privacy policy

Last updated: 31 October 2026

Who we are

This privacy policy explains how the Amber Energy application ("Amber Energy", "we", "us") collects, uses and protects your personal data when you use our mobile and web application for managing shared local solar energy.

The data controller responsible for your personal data is S. MATTHYS CONSULTING, Avenue général Merjay 32, 1160 Auderghem, Belgium (company number BE 1014.957.520). For any question about this policy or your personal data, contact us at contact@amber-energy.be.

Scope

This policy applies to the Amber Energy Android app, the Amber Energy web application available at amber-energy.be and the public website www.amber-energy.be. It does not cover third-party services we link to, which have their own privacy policies.

Data we collect

We only collect the data we need to run the energy-sharing service:

  • Account and identity: your email address, name, preferred language and email-verification status, obtained when you sign up or sign in (including via Google sign-in).
  • Login credentials: your password is stored and verified by our identity provider (Keycloak); we never store your password ourselves. We also generate short-lived, hashed tokens for email verification and password resets.
  • Waitlist information (if you join our waitlist): your email address and postcode, and optionally your name, municipality, street, whether you have solar panels and a short message. When you select a street, we store its approximate map coordinates (the centre of the street). We do not access your device's GPS location.
  • Energy and metering data: readings from your smart meter and solar inverter (production, consumption and injection), the energy allocated to you within your sharing group, appliance labels you add, and the tariff details of your energy contract. This data is linked to your member account.
  • Device and installation data: technical identifiers for your smart meter and inverter (such as device hostname, MAC address and the credentials needed to read your inverter's data).
  • Uploaded contract files: if you import an energy contract to pre-fill your tariff, we process the file to extract pricing information (see "Who we share data with"). We do not store the file itself — only the pricing details you then confirm.
  • Notifications: if you enable push notifications, a device notification token and your notification preferences.
  • Session data: cookies and tokens that keep you signed in.
  • Usage statistics: which days your account is active, how many requests it makes, and whether you use the Android app or a web browser, linked to your account.
  • Monthly summary email: when we sent it to you, your answer to "Was this summary useful?" and any comment you add, and when you first opened Amber from one of its links.
  • Page counts: how many times each page of the app has been opened, as a single total for all members together. It is not linked to your account and records neither who opened a page nor when.
  • Technical logs: our servers record technical events and errors, such as the page where an app error happened, your browser and operating system, your account identifier and your IP address. Our login service also records the email address entered when a sign-in fails.
  • Service monitoring: to detect problems, our monitoring keeps your name with how many days ago you last used the app and how often you sign in, and the name of your household with whether its meters send data.
  • Public website visits: when you browse www.amber-energy.be, the page visited, the site you came from, and your browser, operating system, device type and country. This data is not linked to any account.

How we use your data

We use your personal data to:

  • Provide the energy-sharing service — display your energy use, compute how shared solar is allocated to you, and manage your account and installations (legal basis: performance of our contract with you).
  • Authenticate you and keep your account secure (contract / legitimate interest).
  • Send you service emails such as verification, password reset and invitations (contract).
  • Send push notifications you have opted in to, such as solar-surplus alerts (your consent).
  • Manage our waitlist and understand where interest in the service is located (your consent / legitimate interest).
  • Understand how the app is used, from the usage statistics and page counts above, so we can improve it (legitimate interest).
  • Detect and fix problems with the service, and let our team know when an account is created, using the technical logs and service monitoring above (legitimate interest).
  • Understand how our public website is visited (page views, where visits come from), from aggregated statistics (legitimate interest).

We do not sell your personal data, and we do not use it for advertising.

Who we share data with

Within your sharing, the other members and the sharing's administrators see some of your data, as described in our terms of use. Outside your sharing, we share personal data only with the service providers we need to run Amber Energy:

  • Google — when you choose to sign in with Google, and for delivering push notifications (Firebase Cloud Messaging).
  • Our identity provider (Keycloak) — to manage your login and password.
  • Hetzner Online — hosts our servers and databases in Germany, in the European Union.
  • Slack — our team receives a message there when someone creates an account, with their name and email address, and service alerts that can name a household.
  • Anthropic — if you upload an energy contract as a PDF, we first try to read it on our own servers and send it to Anthropic's AI service only when that does not work; a photo or an image is sent there straight away. Either way it is used solely to extract the tariff details, it is not used to train models and we do not retain the file. Please avoid uploading documents containing information you do not want processed for this purpose.
  • Our email provider — to deliver the service emails described above.
  • Your solar inverter's manufacturer (such as SolarEdge, Huawei, Solis or SMA) — to read your production data, using the credentials you give us or the access you approve with them.
  • Umami — to count visits to our public website www.amber-energy.be. Counting works without cookies, is hosted in the European Union and does not cover the app.

The app has no advertising or third-party tracking.

International transfers

Some of these providers (for example Google, Anthropic and Slack) may process data outside the European Economic Area. Where that happens, the transfer is covered by appropriate safeguards such as the European Commission's Standard Contractual Clauses.

How long we keep your data

  • Account data: for as long as you have an Amber Energy account, and deleted on request.
  • Your household's past energy readings, when you ask us to delete your account and nobody else in your household has one: kept without your name, because your sharing's figures were calculated from them. Bills already issued keep your name, for accounting.
  • Detailed smart-meter readings: kept for about one month, then aggregated into summarised statistics.
  • Uploaded contract files: not retained — processed and discarded immediately.
  • Verification and reset links: valid for 24 hours, and deleted at most two days after use or expiry.
  • Technical logs: 30 days.
  • Service monitoring: 400 days.
  • Messages in Slack: 90 days.
  • Usage statistics: kept for as long as you have an Amber Energy account, and deleted with it.
  • Page counts: kept for as long as the service runs; they say nothing about any one person.
  • Public website visit statistics: kept for six months at Umami, then deleted.

Your rights

Under the GDPR you have the right to access, correct, delete or export your personal data, to restrict or object to certain processing, and to withdraw consent at any time. To exercise these rights, contact us at contact@amber-energy.be. To delete your account, you can also tap "Delete my account" in your profile; amber-energy.be/delete-account explains what we delete and what we keep.

Security

We protect your data with encrypted connections (HTTPS/TLS), a dedicated identity provider for passwords, and access controls that limit who can see your data.

App permissions (Android)

The Amber Energy Android app requests only these permissions:

  • Internet access — to communicate with our servers.
  • Notifications — only if you choose to receive push notifications.

The app does not request access to your location, contacts, camera, microphone or files other than the contract you choose to import.

Children

Amber Energy is not directed at children and we do not knowingly collect data from children under 16.

Changes to this policy

We may update this policy from time to time. The last updated date above shows when it was last changed, and we will inform you of significant changes in the app.

Contact and supervisory authority

For any privacy-related question, contact contact@amber-energy.be. If you are located in Belgium and believe we have not handled your data properly, you may lodge a complaint with the Belgian Data Protection Authority (Autorité de protection des données / Gegevensbeschermingsautoriteit), Rue de la Presse 35, 1000 Brussels — www.dataprotectionauthority.be.