Solandris Privacy Policy

§1. Who is responsible for your data?

The controller is CSHARK sp. z o.o., ul. Wyspa Słodowa 7, 50-266 Wrocław, Poland, KRS 0000524245, NIP 8971801698, REGON 022496426.

For privacy matters, contact contact@solandris.com.

This Policy explains which personal data we process when you use Solandris, why we process it, how long we keep it and your rights.

§2. What data do we process?

Depending on how you use Solandris, we may process:

1. Account data: email address, nickname, protected authentication data, preferred language, registration details and records of acceptance of the Terms.
2. Device data: device identifiers, assigned names, settings, firmware versions and connection information.
3. Information source settings: selected weather locations, air-quality stations, calendar URLs, external data source URLs and necessary access credentials.
4. Presets and rules: display configurations, preset names and descriptions, and author information.
5. Technical data: information needed for security, troubleshooting and operation, potentially including IP addresses and system events logged by our infrastructure.
6. Correspondence: information you send us, including your email address and message content.

We do not require your date of birth or phone number during standard registration.

We do not ask you to provide special categories of personal data, such as health information or religious beliefs.

§3. Why do we process data?

We do not sell personal data or use account data for advertising profiling.

We do not send marketing messages or newsletters without an appropriate legal basis.

§4. External information sources

Solandris retrieves data from selected sources through its own backend.

Weather and air quality. We send providers only the parameters required to retrieve information, such as a selected city for weather or a GIOŚ monitoring-station identifier for air quality. We do not send these providers your account email address, nickname or account identifier. Providers may process technical information about requests originating from our servers.

Calendars. If you connect a calendar, Solandris retrieves its data to execute rules you configure. Calendars may contain information about other people. Only connect calendars you are authorised to access.

External JSON sources. If you configure your own data source, Solandris retrieves information from the specified URL and uses selected values according to your settings.

Calendar and JSON data are processed to execute rules and, as a rule, are not permanently stored as complete copies of those sources.

Devices receive the processed output rather than complete calendar entries or JSON documents.

Access credentials for external sources are encrypted.

§5. Presets and sharing

You can create presets defining device behaviour.

If preset sharing becomes available and you choose to share a preset, other users may see its name, description, author nickname and shared configuration.

Do not include confidential information or other people's personal data in shared presets unless you have a lawful basis to do so.

Passwords and tokens should not be included in public presets.

§6. Who receives data?

We use the following providers in particular:

• Microsoft Azure: application and API infrastructure in North Europe (Ireland), databases in Poland Central (Poland), storage and diagnostics.
• Azure Communication Services: transactional emails relating to accounts and the service.
• EMQX Cloud Serverless: MQTT broker hosted in a European AWS region. MQTT carries device identifiers, colour information and control commands, not user account data, calendar contents or retrieved source data. The provider may process connection metadata such as device IP addresses and session information.
• OVHcloud: hosting of the public Solandris landing page and technical handling of visits.
• Weather and environmental information providers: data sources queried by the Solandris backend using the parameters described in §4, without sending user account details.

We may also contact external calendar or JSON endpoints configured by users. Not every external information provider processes personal data on our behalf.

Providers acting as our processors must be subject to appropriate data protection arrangements.

Our separately maintained Technology Providers list describes current providers and their functions.

§7. Transfers outside the European Economic Area

Our main Azure application infrastructure is located in EU regions. The EMQX Cloud Serverless broker operates in a European AWS region.

Hosting in Europe does not necessarily exclude access to some data from outside the European Economic Area, for example by provider support personnel.

Any transfer outside the EEA must rely on a lawful transfer mechanism and safeguards under the GDPR, such as an adequacy decision or standard contractual clauses, as applicable.

The details of potential transfers still require verification before this Policy is approved.

§8. How long do we keep data?

We limit retention to what is necessary for each purpose.

1. Account and configuration data are kept while you use the service. Afterwards they are deleted or retained only where required by law or necessary to protect legitimate legal claims.
2. Calendar and JSON source data are processed to execute rules without maintaining a permanent archive of complete responses.
3. Job execution history and diagnostic logs are retained as needed for troubleshooting and security. The intended periods, including a previously proposed seven-day period, still require verification in production.
4. Backups follow infrastructure retention settings. The proposed 14-day period still requires production verification.
5. Correspondence is retained while handling the matter and subsequently as justified by its nature and potential legal claims. Specific retention rules remain to be established.

Deleting data from active systems does not always immediately delete it from backups. Backups expire under their retention cycle.

§9. Account deletion

You may initiate account deletion in Solandris account settings or contact contact@solandris.com.

Deletion covers the account and its associated devices, source configurations and presets held in the service, subject to data that may legally be retained.

The intended deletion process also revokes devices' access to the MQTT broker. Enabling this mechanism in production is planned for the next deployment and must be verified before this Policy is approved.

Deleting an account may not erase settings stored locally on a physical device. Backup data expires under the applicable retention cycle.

§10. How do we protect data?

We apply technical and organisational measures designed to protect data against unauthorised access, loss and disclosure.

These include password protection, access controls, encryption of external-source credentials and protection of network communications.

No information system can eliminate every risk, so we develop safeguards in line with the nature of the service.

§11. Your rights

Subject to the conditions set out in the GDPR, you have rights to:

• access your data and obtain a copy;
• rectify inaccurate data;
• erasure;
• restriction of processing;
• data portability;
• object to processing based on legitimate interests;
• withdraw consent where processing relies on consent.

To exercise these rights, contact contact@solandris.com.

You may also complain to the President of the Polish Personal Data Protection Office at https://uodo.gov.pl/.

§12. Cookies and browser storage

Solandris uses mechanisms necessary for the service to function, including login sessions, security and language preferences.

The public website and application may use different browser storage mechanisms.

We do not use advertising tracking cookies or analytics tools for user profiling.

For details, see Cookies and Local Storage.

§13. Automated processing

Solandris automatically processes information from your selected sources and determines device display output according to your rules.

This supports the service's functionality. It is not used to make decisions about users that produce legal or similarly significant effects.

§14. Changes to this Policy

We may update this Policy due to changes in law, the service or the technologies used.

We will notify users of significant changes as appropriate.

The current version will be available on the Solandris website.