Privacy Policy

1. General

Elenord is an electricity price mobile application. Its developer and the data controller is Tofix OÜ (registry code 14843268, Estonia).

This privacy policy explains what data Elenord processes, why it is processed, which third-party services the application uses, and what rights you have regarding your personal data.

Elenord works without an account. You do not need to create an account or provide a name, email address, phone number or any other registration details.

Elenord processes personal data in accordance with the EU General Data Protection Regulation (GDPR) and other applicable data protection legislation.

2.1. Application settings

Elenord is built on the principle of collecting as little data as possible. What is processed depends on which features you use.

The application stores the settings needed to run it on your device, for example:

• selected language

• selected country

• notification preferences

• electricity price thresholds

• notification times

• other preferences needed for the app to work

This data is used to remember your configuration and provide the features you selected. These settings are not linked to your name, email address or any user account.

2.2. Push notifications

If you enable price alerts or the morning digest, the following is processed in order to deliver notifications:

• the device push token

• country

• language

• your selected notification settings

• notification price thresholds and times

• the time the data was last changed

This data is processed so that Elenord can deliver your chosen price alerts and morning digests even when the app is not open.

The push token is a technical identifier tied to the device. It is not used to identify your name, email address or a user account.

When notifications are turned off, Elenord’s notification server does not process this data to send new notifications.

Notification data is kept only while notifications are active. It is deleted when notifications are turned off or when the push token becomes invalid.

2.3. Notification server and IP address

Elenord uses Cloudflare Workers to run its notification server.

When notification requests are processed, the request IP address may be processed temporarily. The IP address is used primarily for rate limiting and to prevent abuse of the service.

The same server is also used to relay electricity generation data requests, which means the IP address may be processed temporarily even when notifications are not enabled.

IP addresses are not stored in Elenord’s notification database.

Cloudflare may process technical request data as part of providing its service, in accordance with its own terms and data protection practices.

2.4. Usage statistics

Elenord uses Firebase Analytics to analyse how the application is used, for example to understand:

• which screens are used

• how long sessions last

• which device type and app language are used

• in which countries the app is used

• how the different features are used

Firebase Analytics uses an app instance identifier and other technical data that allow usage of a specific app installation to be analysed.

Usage statistics are collected only after you give consent. Consent is requested when you first set up the application and is switched off by default. Until consent is given, Firebase Analytics data collection is disabled in the application.

You can withdraw consent at any time in the application settings. Withdrawal stops data collection immediately.

Analytics collection is not necessary for Elenord to function. The application works in full without consent.

Elenord does not use Firebase Analytics to collect your name, email address, phone number or precise location.

2.5. Crash reports and performance monitoring

Elenord uses Sentry to detect and fix technical problems in the application.

The application may send Sentry, for example:

• the application version

• the device model

• the operating system version

• a technical error message

• technical information about the cause of a crash

• technical data related to application performance

In addition to crash reports, Elenord uses Sentry performance monitoring. It is configured so that approximately 20% of traced transactions are used for performance analysis.

Elenord does not use Sentry’s session replay feature. No recording of screen content or user actions is made.

Sentry data is used solely to improve the technical reliability and performance of the application. It is retained according to Elenord’s Sentry settings, but no longer than 90 days.

2.6. Subscriptions and payments

Elenord is a paid application. A 30-day free trial is offered through Google Play, after which use continues as a paid subscription at EUR 7.99 per year unless the subscription is cancelled in accordance with Google Play’s terms.

Google Play Billing and RevenueCat are used to manage subscriptions.

RevenueCat uses a technical app user identifier that RevenueCat generates automatically. Elenord does not provide RevenueCat with a user’s name, email address or user account, because Elenord has no user accounts.

Elenord does not receive or store payment details such as card numbers. Payment processing and payment data are handled by Google Play in accordance with Google’s own terms and privacy practices.

RevenueCat receives the technical and subscription-related data needed to manage the subscription, including the technical user ID and data on purchase or subscription status.

2.7. Application updates

Elenord uses Expo (EAS Update) to update application content without installing a new version through the store.

When the application starts, the device contacts the Expo update service to check whether a new version is available. During this request, the device IP address and technical data about the application version and update channel may be processed.

This data is used solely to deliver the correct update. Elenord does not store this data in its own systems or use it for any other purpose.

3. What Elenord does not ask for or require

Elenord does not ask for or require, in order to use the application:

• your name

• email address

• phone number

• password

• home or other address

• precise location

• contact list

• photos or videos

• your payment card details

• user account data

Elenord has no user accounts and no sign-in.

Elenord does not sell users’ personal data and does not use it for targeted advertising.

Elenord does not use the Android Advertising ID, and its collection is disabled in the application.

4. Legal basis for processing

The legal basis depends on the specific purpose of processing.

Processing of the data and settings needed to provide the application’s core features is based on the provision of the service and, where applicable, performance of a contract.

Push notification data is processed in order to provide the notification feature you chose. Enabling notifications is voluntary and they can be turned off in the application.

Processing related to technical reliability, security, abuse prevention, bug fixing and performance monitoring is based on Elenord’s legitimate interest in providing a secure and reliable service.

Usage statistics are collected on the basis of your prior consent.

You may withdraw consent at any time in the application settings. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

5. Third-party services

Elenord uses the following third-party services:

• Elering / Nord Pool API — to obtain electricity price data. This is public electricity market data.

• ENTSO-E Transparency Platform — to obtain electricity generation data.

• Cloudflare Workers — to run Elenord’s notification server. Data needed to send notifications is processed, and the IP address may be processed temporarily when handling requests.

• Expo Push Service — to deliver push notifications to your device.

• Expo (EAS Update) — to check for and deliver application updates. The IP address may be processed when handling the request.

• Firebase Analytics (Google LLC) — to collect and analyse usage statistics after the user has given consent.

• Sentry — to monitor application errors, crashes and performance.

• Google Play Billing — to process purchases, the trial period and subscriptions. Payment data is processed by Google Play.

• RevenueCat — to manage subscription status and validity. RevenueCat uses a technical app user identifier in Elenord.

These providers’ own privacy and data protection terms may apply in addition to this privacy policy.

6. Data retention

Elenord follows the principle of collecting and retaining as little data as possible.

Application settings are kept on your device for as long as they are needed, or until you delete them or remove the application.

Push notification data is kept on Elenord’s notification server only while notifications are active. It is deleted when notifications are turned off or when the push token becomes invalid.

Firebase Analytics user-level data is retained for 14 months. This is the retention period set by Elenord in Firebase Analytics.

Sentry data is retained for up to 90 days.

Subscription data related to RevenueCat and Google Play is retained according to those services’ terms and for the period necessary to manage subscriptions.

IP addresses may be processed through Cloudflare and Expo for technical purposes. In Cloudflare the IP address is used, among other things, for rate limiting, and in Expo for handling requests related to checking and delivering application updates. Elenord does not store IP addresses in its notification database.

7. Data transfers and third countries

Elenord uses several international technology service providers. As a result, data may also be processed by providers or their sub-processors located outside the European Economic Area.

Where personal data is transferred outside the European Economic Area, such transfer must be based on a mechanism permitted under the GDPR, such as a European Commission adequacy decision or appropriate standard contractual clauses.

Elenord selects providers that offer appropriate data protection and security mechanisms.

8. Data security

Elenord applies reasonable technical and organisational measures to protect processed data against accidental loss, destruction, alteration, unauthorised disclosure or other unlawful processing.

Elenord is designed so that users do not need to create an account or provide directly identifying personal data in order to use the application.

9. Your rights

Under the GDPR, and depending on the specific processing, you have the right to:

• know what personal data concerning you is processed

• request access to your personal data

• request correction of inaccurate data

• request erasure of data

• request restriction of processing

• object to certain processing

• receive data concerning you in a machine-readable format, where the right to data portability applies

• withdraw consent you have given

Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

Because Elenord does not use user accounts and does not collect a name or email address, linking certain data to a specific person may be technically limited.

Data deletion requests can be submitted at https://elenord.ee/en/data-deletion or by writing to info@elenord.ee

The data deletion page covers data processed in Elenord’s own systems. Data processed in third-party systems such as Google Play, RevenueCat, Firebase, Sentry or Expo may be subject to those providers’ own deletion and data protection procedures.

10. Right to lodge a complaint

If you believe your personal data has been processed contrary to applicable data protection rules, you have the right to lodge a complaint with the Estonian Data Protection Inspectorate or with the competent supervisory authority of another EU Member State, in accordance with the GDPR.

Before lodging a complaint, you may contact Elenord to give us an opportunity to resolve the matter.

11. Children’s privacy

Elenord is not directed at children and we do not knowingly collect children’s personal data.

If a parent or guardian believes a child has provided personal data to Elenord, please contact us so that we can assess the situation and delete the data if necessary.

12. Automated decisions and profiling

Elenord does not make decisions about users based on automated processing or profiling that produce legal effects or similarly significantly affect them.

13. Changes to this privacy policy

We may update this privacy policy from time to time, for example when application features, service providers or applicable legal requirements change.

We will inform users of material changes through the application or another suitable channel.

The current version of the privacy policy is always available on the Elenord website.

14. Contact

Data controller:

Tofix OÜ

Registry code: 14843268

Estonia

Questions about privacy and personal data processing: info@elenord.ee

Data deletion requests can be submitted at https://elenord.ee/en/data-deletion