Privacy Policy

Last updated: 6 May 2026

This Privacy Policy explains what personal data we collect when you use Heat Pump Dashboard (the "Service"), why we collect it, who we share it with, and what your rights are under the EU General Data Protection Regulation (GDPR).

1. Who we are (joint controllers)

The Service is operated jointly by:

• Miloš Horák, IČO 15917690, Nymburk, Czech Republic
• Dan Martinec, IČO 14233312, Nymburk, Czech Republic

We are joint controllers of your personal data within the meaning of GDPR Article 26. For all data-protection requests you may contact either of us at the email below; we have agreed internally on responding jointly.

Contact: [CONTACT EMAIL]

2. What data we process

• Account data: email address, hashed password, an internal tenant identifier, and (if you purchase) a Stripe customer ID and the date your access expires.
• Pump metadata: the MAC address(es) of the heat pump(s) you register, optional nicknames, and timestamps of your most recent download.
• Telemetry data: sensor readings (temperatures, energy, runtime) downloaded on your behalf from the Tecomat portal and stored in our database for visualisation.
• Server logs: IP address, user agent, and request paths, retained for up to 30 days for security and troubleshooting.
• Payment data: when you purchase access, Stripe processes the payment. We receive only a customer identifier and a confirmation; we never see your card number.

What we deliberately do not store: your Tecomat portal and Acond heat-pump login credentials are kept in your browser's localStorage and sent directly with each download request. They are never persisted on our server.

3. Why we process this data and on what legal basis

• To provide the Service — performance of a contract with you (GDPR Article 6(1)(b)).
• Security, fraud prevention, troubleshooting — our legitimate interests in operating a reliable service (Article 6(1)(f)).
• Tax and accounting records — compliance with legal obligations under Czech law (Article 6(1)(c)).

4. Sub-processors

We use the following carefully selected providers. Each has its own privacy policy and data-processing agreement which we have accepted on your behalf.

• Hetzner Online GmbH (Germany) — hosting of the application and storage of telemetry data. Privacy policy.
• Stripe Payments Europe, Ltd. (Ireland) — payment processing and receipts. Privacy policy.
• Resend, Inc. (United States) — transactional email delivery (post-purchase invite, password reset, verification). Transfers governed by Standard Contractual Clauses. Privacy policy.

5. Where your data is stored

Application data and telemetry are stored on Hetzner Cloud servers in Nuremberg, Germany. Backups are encrypted at rest. The only routine transfer outside the EEA is to Resend (US) for delivering emails, governed by Standard Contractual Clauses.

6. How long we keep it

• Account data: until you delete your account.
• Telemetry data: until you delete the corresponding pump or close your account.
• Backups: rotated, kept for at most 30 days.
• Server access logs: up to 30 days.
• Invoices and tax records: retained as required by Czech accounting law (typically 10 years).

7. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you (Art. 15);
• correct inaccurate data (Art. 16);
• have your data erased, where applicable (Art. 17);
• restrict processing (Art. 18);
• receive your data in a portable format (Art. 20);
• object to processing based on legitimate interest (Art. 21).

To exercise any of these rights, email us at [CONTACT EMAIL]. We will respond within 30 days.

You also have the right to lodge a complaint with the Czech data protection authority, the Úřad pro ochranu osobních údajů.

8. Cookies

Our website does not set any tracking or analytics cookies. The dashboard uses your browser's localStorage to remember your selected pump, your language preference, and (only with your consent) your Tecomat / Acond credentials for download requests.

When you reach the Stripe-hosted checkout page during a purchase, Stripe sets its own cookies. Those are governed by Stripe's privacy policy linked above.

9. Children

The Service is not directed at, and we do not knowingly collect personal data from, individuals under the age of 16.

10. Changes to this policy

We may update this policy from time to time. Material changes will be announced by email to registered users and via a notice in the dashboard at least 14 days before they take effect.