Privacy Policy

What changed (2026-09-30): Section 9 now discloses that PostHog session replay and heatmaps also run inside the logged-in app, with all on-screen text and every form field masked before it leaves your browser. Previous change (2026-09-25): Section 8 corrected two retention claims to match what the product actually does. The contracts/bills/support-tickets row previously promised a 2-year post-closure retention period that no purge job implements; it now says plainly that this category is deleted when your account is, with no separate window. The web-server-logs row previously said "up to 90 days" for all IP-bearing logs; it now discloses that successful-login IP records and admin-access logs are each kept up to 365 days. Previous change (2026-09-24): Section 2 now discloses overhead property imagery (satellite/aerial images of your roof, sourced from Google's Solar API, Google Static Maps, or a state GIS/federal imagery program depending on your state) and AI-assisted analysis of that imagery to identify panel layout, added to Sections 2, 3, 4, and 8. Section 2 also now discloses that we record network address, approximate location, device/browser, referrer, UTM campaign parameters, and whether a public demo session preceded it for every new account at signup, for fraud- and abuse-detection purposes; retained on your account record for 90 days, then cleared automatically (Sections 2 and 8). Section 6 adds Google as a subprocessor for property imagery and corrects the Cloudflare row to disclose R2 object storage of your uploaded documents and property imagery. Previous change (2026-09-20): Sections 2 and 10 now describe how OwlWatt collects solar telemetry for a connected vendor cloud account (Enphase or SolarEdge), not only the on-site Enphase Envoy gateway. Previous change (2026-09-16): added disclosure for the public no-signup demo (owlwatt.com/demo) — we record a demo visitor's network address, approximate location, device and browser, referring page, and in-product actions, retained 90 days, never sold or shared (Sections 2 and 9). Previous change (2026-09-15): anonymous-visitor analytics now uses a first-party PostHog cookie instead of memory-only storage, so a visit can be linked to a signup made later in the same browser. Visitors in the EU, UK, EEA, or Switzerland are unaffected: they still get no cookie, no persistent identifier, and no analytics data if Do Not Track or Global Privacy Control is on, that part of Section 9 has not changed. See Section 9 for the full description.

OwlWatt (the "Service") is built around a simple promise: we collect only what we need to monitor your solar system, we never sell your data, and we never train AI models on it.

This policy explains how we collect, use, share, and protect personal information about you, and your rights under the European General Data Protection Regulation (GDPR), the UK GDPR, the California Consumer Privacy Act (CCPA), the California Privacy Rights Act (CPRA), and comparable U.S. state laws.

• 1. Who we are
• 2. What we collect and from where
• 3. How we use it and why we are allowed to
• 4. What we don't do with it
• 5. Do Not Sell or Share My Personal Information
• 6. Who we share it with (Subprocessors)
• 7. International data transfers
• 8. How long we keep it
• 9. Cookies and similar technologies
• 10. How we protect it
• 11. Your rights
• 12. Complaints and supervisory authorities
• 13. Children's privacy
• 14. Changes to this policy
• 15. Contact

1. Who we are

OwlWatt is a service of SO Enterprising, LLC. Our operations are based in Massachusetts, USA. For purposes of GDPR, we are the data "controller" for personal information we collect from you. For purposes of CCPA, we are a "business" and, where we act on our customers' behalf, a "service provider." OwlWatt doesn't currently have an EU or UK representative under GDPR Article 27; customers in the EU/UK with questions can contact us directly at the address in Section 15.

2. What we collect and from where

Categories of information

• Account information: email, optional display name, timezone, a salted one-way password hash (your plaintext password is never stored), and your two-factor authentication secret (encrypted at rest).
• Solar telemetry: how we collect this depends on your inverter brand and collection method. If you use the optional OwlWatt Iris collector on an Enphase system, production, consumption, and grid-flow watts are polled from your local Enphase Envoy gateway every 5 seconds, plus per-microinverter snapshots uploaded by your collector every 5 minutes (individual panel readings within each snapshot may be up to 15–25 minutes old, since your Envoy polls each microinverter in rotation over powerline networking). If you connect a vendor cloud account instead (Enphase or SolarEdge, cloud-only), daily production totals are pulled directly from that vendor's cloud API on our regular polling schedule, and no local device or 5-second readings are involved.
• System metadata: installer name, hardware specifications, grid provider, SREC enrollment, contract PDFs, and utility bills that you upload.
• Vendor credentials and OAuth tokens (Enphase Enlighten email + password, used to mint the JWT your collector needs to read your local Envoy; or the OAuth access/refresh tokens created when you connect an Enphase or SolarEdge cloud account): stored encrypted at rest using AES-256-GCM with a per-customer key wrapped under a master key held only in our cloud secret store; decrypted only inside the short-lived JWT mint or OAuth-refresh operation against the vendor's authentication service; never logged, never shared, and purged immediately when you disconnect the vendor connection in Settings → Solar System.
• Device telemetry: health metrics from your OwlWatt collector device (CPU temperature, disk usage, software version, LAN IP, hostname) so we can keep it healthy.
• Support information: messages, attachments, and metadata from support tickets and feature requests you submit.
• Property imagery: an overhead (satellite or aerial) image of your roof, sourced from Google's Solar API, Google Static Maps, or a state GIS / federal aerial-imagery program depending on your state and provider availability, fetched using the address you provide. With your consent, we run AI-assisted analysis (Section 3) on this image to identify panel layout and count. We don't currently apply a fixed deletion window to this image or its analysis; see Section 8.
• Signup telemetry: when you create an account, we record the network (IP) address, approximate location (country and, where available, region/city), device/browser/OS, referring page, and UTM campaign parameters present at that moment, plus whether a public demo session (Section 2, Public Demo Sessions below) preceded the signup. This is used only as a fraud- and abuse-detection signal, is stored on your account record, and is cleared automatically after 90 days (Section 8).
• Consent records: for marketing, SMS, research, and AI-analysis consent, we record the timestamp and the IP address at the moment you gave (or withdrew) consent, as an audit trail.
• Usage information: web-server logs with IP address, user-agent, timestamps, and pages accessed, kept for up to 90 days for security and debugging; plus analytics events collected by PostHog, see Section 9.

Sources

• Directly from you, account signup, settings, support tickets, contract and bill uploads, preference choices.
• From your OwlWatt collector, device identity, telemetry, LAN IP, health.
• From your solar gateway, production, consumption, and per-inverter metrics read locally by the collector (Iris/Enphase customers only).
• From your inverter manufacturer's cloud API, daily production totals, once you connect your Enphase or SolarEdge account (cloud-only customers, or as a secondary source alongside the collector).
• From web requests, IP address, browser metadata, approximate country (provided by our CDN).
• From public imagery providers, an overhead image of your roof (Google's Solar API, Google Static Maps, or a state GIS / federal aerial-imagery program), looked up using the address you provide.

3. How we use it and why we are allowed to

We process personal information only for the purposes below, and only where we have a lawful basis to do so under GDPR Article 6. Under CCPA, these are the business purposes for which personal information is collected.

• Deliver the Service, show your dashboard, history, and audit-style reports; detect underperforming panels, billing anomalies, and offline devices. Lawful basis: performance of a contract.
• Generate AI insights using Anthropic's Claude commercial API. Anthropic's commercial API terms prohibit using your data to train their models. We send anonymized summaries only (never raw bills or contracts) unless you explicitly request a contract analysis. Lawful basis: performance of a contract; consent for contract analysis.
• Identify your panel layout from property imagery, with your consent, we send the overhead roof image described in Section 2 to Anthropic's Claude commercial API to detect panel groups, count, and orientation, the same no-training terms apply. Lawful basis: consent.
• Detect and prevent fraudulent signups, the signup telemetry described in Section 2 (network address, approximate location, device, and whether a demo session preceded the signup) is reviewed by our team as a legitimacy signal; it never auto-blocks or auto-judges an account. Lawful basis: legitimate interest in a secure service; fraud prevention.
• Keep your collector device healthy, diagnostics, over-the-air software updates, offline detection. Lawful basis: performance of a contract; legitimate interest in a reliable service.
• Communicate with you, account notifications, service alerts, and support replies. Lawful basis: performance of a contract for transactional mail; consent for any marketing.
• Secure the Service and prevent abuse, rate limiting, intrusion detection, fraud prevention. Lawful basis: legitimate interest in a secure service; compliance with legal obligations.
• Comply with law, respond to lawful requests from courts, regulators, and law enforcement. Lawful basis: legal obligation.

4. What we don't do with it

• We don't sell your personal information to anyone.
• We don't share your personal information with your installer, utility, or any third party for their own marketing or advertising without your explicit consent.
• We don't train AI models on your data, and neither does Anthropic, their commercial API terms prohibit it.
• We don't use your data for cross-context behavioral advertising.
• We don't collect special categories of data (health, biometrics, religion, etc.).

5. Do Not Sell or Share My Personal Information

6. Who we share it with (Subprocessors)

We engage the following third-party service providers to operate the Service. We will post updates to this list at least 30 days before adding a new subprocessor so customers have time to object.

7. International data transfers

Most subprocessors process personal data in the United States. PostHog (Section 6) processes analytics data in the EU. If you access the Service from the EU, UK, Switzerland, or another jurisdiction that restricts cross-border transfers, some of your data (account, telemetry, billing, support) will be transferred to and processed in the United States.

Transfers from the EU/UK/Switzerland to the United States are covered by Standard Contractual Clauses (SCCs) incorporated into each subprocessor's DPA linked above, and (where applicable and active) by the EU–U.S. Data Privacy Framework (DPF), UK Extension, and Swiss–U.S. Data Privacy Framework.

8. How long we keep it

• Raw 5-second telemetry: retained for 13 months so we can provide accurate year-over-year comparisons, billing anomaly detection, and audit-ready reports for installer claims.
• Aggregated daily/monthly telemetry: retained indefinitely while your account is active, for historical trends.
• Account information: retained for as long as your account is active. On request, your account is soft-deleted immediately and hard-deleted after a 90-day grace period.
• Contracts, bills, and support tickets: retained for as long as your account is active. We don't currently apply a separate, shorter retention window to this category; it's deleted when your account is, per the Account Information row above.
• Web-server logs and IP addresses: most operational logs (e.g. webhook-signature failures) are retained for up to 90 days for security, debugging, and abuse prevention. Two narrower, longer-lived logs exist for account security: successful-login IP records and admin-access logs are each retained for up to 365 days, then deleted by an automated daily purge job.
• Anonymous landing-page visitor analytics (a randomly generated visitor ID, referrer, UTM campaign parameters, and browser user-agent, captured when our A/B testing system is active): retained for up to 90 days, then deleted by an automated daily purge job.
• Public demo sessions (the no-signup demo at owlwatt.com/demo, a shared sample account with no real customer data): your network (IP) address, approximate location derived from it (including, where available, an organization/network-owner lookup), device and browser type, referring page, UTM campaign parameters, the page you landed on, and the specific actions you take within the demo (which tabs you view, any feature you try that's blocked in demo mode, and whether you click through to sign up), retained for 90 days, then deleted by an automated daily purge job. See Section 9 for what's sent to our analytics provider versus what stays only in our own systems.
• Signup telemetry (Section 2): network address, approximate location, device/browser, referring page, UTM campaign parameters, and demo-session linkage captured at the moment you create an account, cleared from your account record after 90 days. Unlike other account data, this happens automatically and is not affected by whether your account stays open.
• Property imagery and its AI analysis (Section 2): retained for as long as your account is active. We don't currently apply a separate, shorter retention window to this category; it's deleted when your account is, per the Account Information row above.
• Encrypted database backups: may persist up to 90 days after account deletion before rolling off.

To erase all your data entirely, use Account Deletion in Settings → Account → Cancel account.

9. Cookies and similar technologies

Cookies we set directly

• Session cookie (owlwatt_app_session): a signed JWT that keeps you logged in. HttpOnly, Secure, SameSite=Strict. Lasts up to 30 days, or until you log out.
• CSRF cookie (ow_csrf): a random token our dashboard JavaScript reads and echoes back on write requests, to block cross-site request forgery. Secure, SameSite=Strict; not HttpOnly, because our own JavaScript has to read it. Same 30-day lifetime as the session cookie.

Analytics

We run one analytics tool, PostHog, on our marketing site, help/learn content, and the signup, confirmation, and pairing pages. It's loaded from owlwatt.com/ph (a reverse proxy to PostHog's EU servers, not posthog.com directly) and records page views. On /signup, /pricing, /confirm, /pair, and /founders only, it also records session replay (a recording of on-page interactions, with every form field masked) so we can see where people get stuck signing up. Click heatmaps run on the same pages. It's configured with autocapture off (no blanket click/form tracking) and anonymous visitors aren't assigned a persistent identity profile (person_profiles: identified_only).

PostHog cookie (ph_<project key>_posthog, first-party, scoped to owlwatt.com): if you're an anonymous visitor outside the EU/UK/EEA/Switzerland (see below), PostHog sets this cookie to recognize repeat visits from the same browser, so that if you later sign up, your pre-signup page views can be linked to your account for conversion measurement. Lasts up to 1 year, PostHog's default lifetime. It carries a randomly generated identifier, never your email, name, or any other identifying information, and it's not used for advertising or shared with any advertiser. It is set only if your browser honors neither Do Not Track nor Global Privacy Control (see below).

EU, UK, EEA, and Switzerland: we don't set this cookie at all, regardless of your Do Not Track or Global Privacy Control setting. Our server detects your region from your IP address (via Cloudflare, our CDN) and instead configures PostHog in "cookieless" mode: no cookie, no browser storage, and page views are linked using a rotating, non-reversible hash computed on PostHog's servers rather than any identifier stored in your browser. This means we currently can't link a pre-signup visit from this region to a later signup the way we can elsewhere.

For everyone, regardless of region: it honors your browser's Do Not Track setting and Global Privacy Control signal (Section 5); if either is present, PostHog (including session replay and the cookie described above) doesn't load at all.

Session replay and heatmaps in the logged-in app: inside the dashboard and setup wizard, PostHog records session replay and click heatmaps with all on-screen text and every form field masked in your browser before anything is sent, so contract text, energy and dollar figures, and email addresses never reach PostHog. We see only the page layout, where you clicked, and how far you scrolled. Canvas and embedded frames are not recorded, and the Do Not Track and Global Privacy Control rules above apply here too. The sign-in page runs no analytics. We previously loaded Plausible directly from plausible.io on the dashboard and sign-in pages; we removed it because it wasn't proxied through our own infrastructure like PostHog is.

PostHog isn't used for advertising or cross-context behavioral targeting, we don't run ad-retargeting pixels, and we don't sell or share analytics data with anyone (see Section 5). If you'd like to object to this processing, use the Objection right in Section 11 or contact us at the address in Section 15.

Public demo sessions (owlwatt.com/demo): starting or using the demo also sends events to PostHog, tagged so they can be filtered out of real-customer analytics. What's sent to PostHog is coarse and anonymous — an anonymous per-visit identifier (not your email or account, because there is no account), the demo persona you chose, referrer domain and UTM campaign parameters, your approximate country (and region, if our CDN ever provides one), a coarse device/browser/OS category parsed from your user-agent, and which in-product actions you took. Your full network (IP) address, browser user-agent string, exact UTM parameters, and the exact page you landed on are never sent to PostHog for demo sessions — they, along with an organization/network-owner lookup and autonomous-system number derived from the IP address (so we can tell, e.g., that a demo visit came from a particular company's network) and a record of exactly which tabs you viewed, any feature you tried that's blocked in demo mode, and whether you clicked through to sign up, are recorded only in our own database, retained for 90 days (see Section 8), and are never sold or shared with any third party.

10. How we protect it

• All connections to OwlWatt are TLS-encrypted (HTTPS).
• Passwords are salted and hashed with a one-way key-derivation function; your plaintext password is never stored or logged.
• Two-factor-authentication secrets are encrypted at rest.
• Vendor credentials you provide (e.g., Enphase Enlighten email + password) and vendor OAuth tokens (Enphase v4 or SolarEdge V2 access & refresh tokens) are envelope-encrypted at rest under a per-customer AES-256-GCM key whose wrapping key lives only in our cloud secret store; the plaintext exists only inside short-lived JWT mint or OAuth-refresh operations against the vendor's authentication service. The encrypted envelope is the sole source of truth. We don't retain plaintext copies.
• Database backups and off-site copies are encrypted.
• Access to production systems is limited to the founder and protected by strong authentication and audit logging.
• We maintain internal records of processing activities (RoPA) and review our subprocessor list on a rolling basis.
• OwlWatt maintains an internal Written Information Security Program (WISP) describing the administrative, technical, and physical safeguards we apply to your personal information, reviewed at least annually. The WISP itself isn't published, but its existence is confirmed here for transparency.

No system is perfectly secure. If we ever experience a personal-data breach that is likely to result in a risk to your rights and freedoms, we will notify affected customers without undue delay and, where required, notify the relevant supervisory authority within 72 hours.

11. Your rights

You have the following rights over your personal information. To exercise any of them, email [email protected] or use the self-service options in Settings → Account where indicated. We will respond within 30 days (GDPR) or 45 days (CCPA); free of charge in the vast majority of cases.

Rights available to everyone

• Access: download all of your data as a ZIP (Settings → Account → Privacy & Legal → Download all my data).
• Correction: edit your profile, system information, and preferences in Settings; email us for anything you can't self-serve.
• Deletion: request account deletion from Settings → Account → Cancel account; 90-day grace period, then hard-deleted.

Additional rights under GDPR / UK GDPR

• Restriction: ask us to restrict processing while a dispute is pending.
• Objection: object to processing based on legitimate interest or direct marketing.
• Portability: receive your data in a structured, machine-readable format (the ZIP export satisfies this).
• Withdraw consent: where processing is based on consent (e.g., marketing emails, contract analysis), withdraw at any time without affecting the lawfulness of processing done before withdrawal.
• Not be subject to solely automated decision-making that produces legal or similarly significant effects. We don't do this today; if we ever introduce such processing, we will notify you and provide an opt-out.

Additional rights under CCPA / CPRA

• Right to know what categories and specific pieces of personal information we have collected, used, disclosed, or shared about you in the past 12 months, see Sections 2, 3, and 6.
• Right to delete, see the Deletion right above.
• Right to correct inaccurate personal information.
• Right to opt out of sale or sharing. We don't sell or share, so there's nothing to opt out of. See Section 5.
• Right to limit use of sensitive personal information. We do not collect sensitive PI as defined by CPRA.
• Right to non-discrimination. We won't charge you more, provide degraded service, or penalize you in any way for exercising any of these rights.
• Authorized agents: you may designate an authorized agent to make requests on your behalf; we will verify the agent's authority and your identity before acting.

We may need to verify your identity before fulfilling certain requests; we will match information you provide against your account record and may ask for additional verification for sensitive requests.

12. Complaints and supervisory authorities

If you believe we have mishandled your personal information, we would like the chance to fix it, please contact us first at [email protected]. You also have the right to lodge a complaint with a supervisory authority:

• EU residents, your local Data Protection Authority. A directory is available at edpb.europa.eu.
• UK residents, the Information Commissioner's Office at ico.org.uk.
• California residents, the California Privacy Protection Agency at cppa.ca.gov, and the California Attorney General.
• Other U.S. states with comprehensive privacy laws (Virginia, Colorado, Connecticut, Utah, and others), your state Attorney General.

13. Children's privacy

The Service is intended for homeowners and isn't directed to children under 16. We don't knowingly collect personal information from anyone under 16. If you believe a child under 16 has provided us personal information, please contact [email protected] and we will delete it.

14. Changes to this policy

We will update this policy from time to time as the Service evolves or as the law requires. When we make material changes, adding a new subprocessor, changing retention periods, adding new categories of data, or expanding our use of your data. We will notify you at least 30 days in advance by email and by posting a prominent notice on the Service. We also update the "Last updated" date at the top of this page on any change.

15. Contact

Questions, requests, or concerns about this policy or how we handle your personal information?

• Email: [email protected]
• Mail: SO Enterprising, LLC, Massachusetts, USA (full mailing address provided on request)

If you are an EU or UK data subject and would like to exercise rights that require us to engage additional formalities (for example, a subject access request through an authorized agent), please state that in your email and we will respond accordingly.