Privacy Policy
Last updated: 30 September 2026
This is the English version of our Dutch privacy statement. If the two versions differ, the Dutch version prevails.
This statement explains which personal data we process when you visit lyvra.energy, use the Lyvra app, or connect a smart meter dongle, charging station or inverter to your account. It applies to all Lyvra services and is written to meet Articles 13 and 14 of the GDPR.
1. Who is responsible for your data
The controller for the processing described here is:
Lyvra Energy, a trading name of 3L Digital Compagniestraat 18, 1813 SX Alkmaar, Netherlands Chamber of Commerce (KvK): 99219247 VAT: NL005376831B51 privacy@lyvra.energy Phone: +31 6 33049735
For privacy questions or to exercise your rights, contact us at the address above. We respond within one month, as the GDPR requires.
2. What we process, why, and for how long
We only process data needed for the service you asked for. The table below is the complete picture.
| Category | Examples | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| Account data | Name, email, hashed password, language, timezone | Create and secure your account, sign-in, support | Performance of contract, Art. 6(1)(b) | While the account exists, deleted after the 30-day notice period |
| Location data | Address, postcode, country, home coordinates | Link your location to weather, solar forecast and network rates | Performance of contract, Art. 6(1)(b) | While the account exists |
| Smart meter data | Electricity and gas readings from the P1 port, consumption, export, meter ID | Show consumption, calculate costs, control smart charging | Performance of contract, Art. 6(1)(b) | While the account exists, see section 3 |
| Charging data | Sessions, energy delivered, start and stop times, schedules, charger ID, RFID tags | Run and report on charging, smart and solar charging, load balancing | Performance of contract, Art. 6(1)(b) | While the account exists |
| Solar and battery data | Production measurements, forecasts, inverter and battery ID | Show production, align consumption with your own generation | Performance of contract, Art. 6(1)(b) | While the account exists |
| Linked accounts | Tokens for services you connect, such as Easee or Peblar | Read and control your connected devices | Performance of contract, Art. 6(1)(b) | Until you disconnect or delete the account |
| Payment data | Subscription status, transaction and invoice data, last four digits and card brand | Payment for Lyvra+ and hardware, invoicing, refunds | Contract, Art. 6(1)(b), and legal obligation for invoices, Art. 6(1)(c) | Invoices 7 years under Dutch tax law, other payment data while the account exists |
| Device and push data | Device model, OS, app version, push token | Send the notifications you enabled, keep the app working on your device | Performance of contract, Art. 6(1)(b) | Until you disable notifications, sign out, or delete the account |
| Diagnostics and crash reports | Crash reports, error messages, anonymous app ID | Find and fix app and backend errors | Consent in the app, Art. 6(1)(a) | 90 days |
| Usage statistics | Screens opened, features used, session length, device type | Understand which features need work | Consent in the app, Art. 6(1)(a) | 14 months |
| Website data | IP address, browser type, pages visited, referrer | Provide and secure the website, measure visits | Legitimate interest in a working, secure site, Art. 6(1)(f), consent for non-essential cookies | Server logs up to 12 months |
| Contact and support | Name, email, message content | Answer your question, document the contact | Legitimate interest in answering you, Art. 6(1)(f) | 24 months after the contact is closed |
| Newsletter | Email, language, signup date | Send the product updates you asked for | Consent, Art. 6(1)(a) | Until you unsubscribe |
3. Smart meter data, in plain language
Detailed energy data says a lot about a household: when you are home, when you cook, when you sleep. We treat it accordingly.
- Readings come from your own meter's P1 port, through a dongle you install yourself. We read nothing from your energy supplier or grid operator unless you explicitly connect that account
- We store measurements at the coarsest granularity at which the feature still works, and condense older detailed readings into hourly and daily totals
- Readings are linked to your account and the location you added, not otherwise to a named person
- We never sell energy data and we do not share it with energy suppliers, advertisers or data brokers
- You can disconnect a dongle at any time. Collection stops immediately
If we ever want to use meter data for something outside the service you signed up for, we will ask first.
4. Automated decisions
Lyvra makes automated decisions about when your devices run, for example starting a charging session when prices are low or your solar output is high. Those decisions affect your devices, not your legal position or your access to the service, and you can override any schedule or switch smart charging off.
We do not carry out profiling within the meaning of Article 22 GDPR, and we do not use your data for decisions about credit, insurance, employment or pricing.
5. Who else processes your data
We do not sell personal data. To run the service we use the following processors, each bound to our instructions by a data processing agreement.
| Processor | What they do | Location |
|---|---|---|
| Hosting provider | Runs our servers and databases | EU |
| Google (Firebase) | Push notifications, crash reporting, app statistics | EU and US, under the EU-US Data Privacy Framework |
| Sentry | Backend and app error monitoring | EU and US, under Standard Contractual Clauses |
| Mollie | Payment processing for subscriptions and hardware | EU (Netherlands) |
| Apple, Google | Validate in-app purchases and subscriptions | EU and US |
| Cloudflare | Bot protection on our forms | EU and US, under Standard Contractual Clauses |
| Email provider | Sends transactional and support email | EU |
Services you link yourself, such as an Easee or Peblar account, run at those companies under their own privacy policies. We exchange only what is needed to read and control your devices.
We may also disclose data where the law requires it, or to bring or defend legal proceedings.
6. Transfers outside the EU
Your account and energy data are stored on EU servers. Some processors above are US companies. Where data reaches them, the transfer relies on the European Commission's adequacy decision for the EU-US Data Privacy Framework, or on Standard Contractual Clauses with supplementary technical measures. You can request a copy of the safeguards we use.
7. Your rights
Under the GDPR you can:
- Get access to the personal data we hold about you and receive a copy
- Correct data that is inaccurate or incomplete
- Delete your account and data, via Settings in the app or our deletion page
- Export your data in a portable, machine-readable format
- Restrict or object to processing based on legitimate interest
- Withdraw consent at any time for statistics, diagnostics or the newsletter, without affecting processing that already happened
Manage this in the app under Settings, or email privacy@lyvra.energy.
If you think we have mishandled your data, you can complain to the Dutch Data Protection Authority.
8. How we protect your data
We encrypt traffic in transit (HTTPS for the app and website, TLS for the dongle's MQTT connection), hash passwords, restrict database access to systems that need it, and keep audit logs of account administration.
No system is perfect. If a data breach seriously endangers your rights, we notify you and the supervisory authority as the GDPR requires.
9. Cookies
The website uses necessary cookies to function, and analytical and marketing cookies only with your consent. The one marketing cookie is the Meta Pixel, which measures how many visitors from our Facebook and Instagram adverts go on to the App Store or Google Play. You can change your choice at any time via the cookie settings link in the footer. Our cookie policy describes each cookie in detail.
10. Children
Lyvra is not intended for children under 16 and we do not knowingly collect their data. If you think a child has given us personal data, contact us and we will delete it.
11. Changes to this statement
We update this statement as the service changes. The date at the top always shows the current version. If a change materially affects how we use your data, we will tell you in the app or by email.