Privacy Policy

Last updated: 20 July 2026. This policy explains what personal data SriWatt collects, why, who we share it with, and the rights you have. Questions? Email namaste@sriwatt.io.

1. Who we are

SriWatt (“SriWatt”, “we”, “us”) is a product operated by Matrika OÜ, a company registered in the Estonian Commercial Register (e-Business Register)under registration number 17500422, with its registered office in Tallinn, Estonia.Matrika OÜ is the data controller responsible for your personal data under the EU General Data Protection Regulation (GDPR) and Estonian data-protection law.

For any privacy matter, contact us at namaste@sriwatt.io.

2. What we collect

Contact & account details — your name, work email, company, phone and role, when you sign up, book, or get in touch.
Sign-in data — if you choose “Sign in with Google”, we receive your name, email address and profile picture from your Google Account to create and secure your account. We do not receive your Google password.
Project & calculator inputs — the site, pipeline and system data you enter to size devices and generate forecasts.
Device measurement data — where a SriWatt Hardware device is deployed at your site, the on-site climate and soiling readings it records (such as irradiance, temperature, weather and soiling metrics, with timestamps and the device’s location). This ground-truth telemetry — the core of our deep-tech subscription — is used to produce site-specific, measurement-based forecasts and analytics. It concerns environmental conditions at the site, not individuals.
Location data — when you place a project on the map, we collect the latitude/longitude coordinates and the address you select. The picker is powered by Google Maps Platform; map, address search and reverse-geocoding requests are processed by Google. We store these coordinates with the project to position devices and to generate site-specific sunlight and weather forecasts.
Imported contacts (referrals) — only if you choose “Import contacts” to invite people to our referral programme, we access the names and email addresses of your Google contacts through the Google People API (read-only). These are loaded into your browser so you can choose who to invite; we keep only the email addresses of the contacts you actually invite, to send the invitation and to attribute and verify referral earnings. We do not store your wider contact list and never edit your contacts.
Order & payment data — what you ordered and billing details. Card payments are processed by Stripe; we never see or store full card numbers.
Electricity bill data — if you use the Bill Analysis tool, we extract billing figures (units consumed, amount, sanctioned load, tariff) from a bill you type in or upload, to generate a sizing recommendation. An uploaded PDF is processed transiently to extract those figures and is not stored.
Design & simulation inputs — array layout, module/inverter selection and site geometry you enter in Design Studio, and battery/tariff parameters you enter for a BESS arbitrage simulation, used to generate the corresponding layout, yield or dispatch outputs.
Public preview leads — if you use the free consumer “solar potential” preview tool (on our site or embedded on an EPC’s own site), we collect the name, email, phone and address you provide once you exceed the free preview limit, to route you to a relevant EPC and improve the tool.
Phone number — if an EPC has your mobile number on file, you may sign in using a one-time SMS code sent to that number instead of email.
Usage & device data — basic technical data such as pages visited, approximate region, browser type and IP address, used to keep the service secure and improve it.
Performance & error telemetry — anonymous, aggregate Core Web Vitals, uncaught software errors and page-visit counts from every page, with no visitor, session or account identifier attached to them. See Cookie Policy §4 for exactly what is (and is not) recorded.

3. How we use your data

To create and authenticate your account and operate the platform.
To answer enquiries, and to size, quote and fulfil your device orders.
To process payments and meet our accounting and legal obligations.
To position projects on the map and produce site-specific forecasts from the coordinates you set.
To collect on-site ground-truth measurements from deployed SriWatt Hardware devices and turn them into measurement-based forecasts, analytics and telemetry dashboards.
To generate Design Studio array layouts/yield simulations and BESS dispatch/arbitrage estimates from the inputs you provide.
To route public preview leads and embedded-calculator leads to the relevant EPC.
To send referral invitations to the contacts you select, and to attribute and verify the resulting referral earnings.
To secure the service, diagnose errors, monitor and improve performance, and prevent abuse.
To send service-related communications (e.g. order confirmations and invoices).

4. Legal bases (GDPR)

We rely on: performance of a contract (to provide the service you requested and fulfil orders); legitimate interests (to secure, run, diagnose errors in, and improve the service, including the anonymous performance/error telemetry described in our Cookie Policy); legal obligation (e.g. tax and accounting); and consent where required (e.g. Google contact import for referrals, or optional communications), which you may withdraw at any time.

5. Google user data & Limited Use

When you connect a Google Account, SriWatt’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements. Specifically:

We only request the minimum Google account scopes needed to run the features you use.
We use Google user data solely to provide and improve those user-facing features.
We do not sell Google user data, and do not use it for advertising.
We do not transfer Google user data to others except as necessary to provide or improve the service, to comply with applicable law, or as part of a merger or acquisition.
We do not allow humans to read your Google data unless you give consent, it is necessary for security or to comply with law, or the data is aggregated and anonymised.

The specific Google OAuth scopes we may request, and why, are:

openid, email, profile — only if you use “Sign in with Google”, to create and secure your account using your name, email address and profile picture.
https://www.googleapis.com/auth/contacts.readonly (Google People API) — requested only when you choose to import contacts for the referral programme. It grants read-only access to your contacts’ names and email addresses so you can select who to invite. We never use it to modify your contacts, and we retain only the addresses of contacts you invite, to deliver the invitation and verify referral earnings.

You can withdraw this access at any time from your Google security settings.

6. Google Maps location picker

The project location picker is built on Google Maps Platform (the Maps JavaScript, Places and Geocoding APIs). When you search for a place, move the map marker, or use the “My location” option, those requests — and, if you grant it, your device’s geolocation — are sent to Google to render the map and resolve coordinates. Google’s handling of that data is governed by the Google Privacy Policy. We store the latitude/longitude and address you finally select with your project; we do not receive your Google account password or contacts through the map.

We share personal data only with the processors that run the service, under contracts that require them to protect it:

Stripe — payment processing.
Supabase — application database and authentication hosting.
Resend — transactional email (confirmations, invoices, referral invitations).
Google — optional sign-in, Google People API (contact import), and Google Maps Platform (location picker).
Our cloud hosting provider (Vercel) — runs the application; see also Cookie Policy §4 for the first-party, non-personal performance/error telemetry we generate ourselves rather than sourcing from any analytics vendor.

We do not sell your personal data, and we do not use any third-party analytics or advertising service. We may disclose data where required by law.

8. International transfers

Some processors operate outside the European Economic Area. Where that happens, transfers are protected by appropriate safeguards such as the European Commission’s Standard Contractual Clauses or an adequacy decision.

9. How long we keep it

We keep enquiry, account and booking records only as long as needed for the relationship and to meet our legal obligations, then delete or anonymise them. You can ask us to delete your data sooner (see your rights below).

10. Your rights

You have the right to access, correct, delete, restrict or object to the processing of your data, to data portability, and to withdraw consent. To exercise any of these, email namaste@sriwatt.io. You also have the right to lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee) or your local supervisory authority.

You can also revoke SriWatt’s access to your Google Account at any time from your Google security settings.

11. Cookies & telemetry

We use strictly necessary cookies to keep you signed in and the service secure and working. We also run first-party, anonymous performance and error telemetry — Core Web Vitals, uncaught software errors, and page-visit counts — on every page, which cannot be turned off because it carries no visitor, session or account identifier of any kind and is not itself a cookie (see Cookie Policy §4 for exactly what is recorded and why that makes it non-personal). We run no third-party analytics or advertising cookies, so there is no optional tracking to accept or reject. For the full list of cookies, their purpose and duration, see our Cookie Policy.

12. Children

SriWatt is a business product and is not directed to children under 16.

13. Changes to this policy

We may update this policy from time to time. We will revise the “Last updated” date above and, for material changes, take reasonable steps to notify you.

14. Company details

SriWatt is operated by Matrika OÜ.
Registry: Estonian Commercial Register (e-Business Register)
Registration number: 17500422
Registered office: Tallinn, Estonia
Contact: namaste@sriwatt.io