Privacy Policy
Last updated: 31 July 2026
Who we are
Voltessa is operated by Consensu EOOD (trading as "Voltessa"), registered in Sofia, Bulgaria (EIK 207238821, registered address: Pozitano Str. 14, 1301 Sofia, Bulgaria). We are the data controller for the personal data described in this policy.
Voltessa is an AI-powered platform that operates solar (and, in the future, other renewable) energy assets on behalf of their owners — including automatic export stop/resume decisions driven by electricity market prices — rather than only providing a monitoring dashboard.
Data we collect
Account and profile data: your name, email address, profile image, phone number, and (if you sign in with a password) a securely hashed password. If you sign in with Google, we receive your name, email, and profile picture from Google.
Organization data: your organization's name, and — if you are a Plant Owner — billing/invoicing details (company name, tax identification number, address, invoice email) and energy market settings (country, electricity supplier, distribution network operator).
Plant and device data: if you connect a solar plant via Huawei FusionSolar, we retrieve and store plant/device telemetry (production, consumption, export/import readings) and daily production/consumption figures, so we can display them to you and, where you enable it, make automated export-mode decisions.
Energy Trader data: if you register as an Energy Trader, we collect your trader profile (company name, distribution operator) and which Plant Owner organizations you are assigned to view, on a read-only basis.
Administrative and security data: if you interact with a Platform Administrator (our own staff), actions taken on your account are recorded in an internal audit log, and any support access to your account ("impersonation") is logged with a timestamp and the admin who performed it.
Cookie and consent data: which cookie categories you have consented to, and a history of that choice — see "Cookies" below and our Cookie Policy.
Why we process your data
To provide the service to you (performance of a contract): creating your account, operating your connected plants, running automation you've enabled, and Energy Trader read-only access you've been assigned.
To comply with a legal obligation: for example, retaining certain financial/accounting records for the period required by Bulgarian law, or demonstrating that a cookie consent decision was validly obtained.
For our legitimate interests: keeping the platform secure, maintaining an audit trail of administrative and automated actions so they remain explainable, and improving the service — always balanced against your rights and expectations.
With your consent: non-essential cookies (Functional, Analytics, Marketing) — see "Cookies" below. You can withdraw this consent at any time with no effect on the service itself.
Cookies
Voltessa uses strictly necessary cookies to keep the platform working (signing in, remembering security state), and — only with your consent — a small number of functional cookies for an embedded scheduling widget. We do not currently use analytics or marketing cookies. The full list of cookies, what each one does, and how to change your choice at any time is in our Cookie Policy.
How long we keep your data
| Data category | Retention period | Legal basis |
|---|---|---|
| Account and profile data (name, email, phone, organization membership, role) | Until you delete your account. | Necessary to provide the service to you (performance of a contract). |
| Organization billing/invoicing details | Until account deletion, except that specific financial or accounting records may need to be kept for longer where required by Bulgarian accounting and tax legislation (the Accountancy Act and the Tax-Insurance Procedure Code) — in that case, those specific records are kept for the legally required period instead. | Necessary to provide the service; compliance with a legal obligation where applicable. |
| Plant operational and telemetry data (device readings, daily production/consumption figures) | For as long as your FusionSolar connection is active, and for up to 12 months after the connection is disconnected or your account is deleted — unless a longer period is required by law or you ask us to keep it for longer. | Necessary to provide the service; legitimate interest in supporting you after you leave. |
| Public electricity market price data | Indefinite — this is public market data, not personal data. | Not personal data. |
| Automation decision log (export-mode changes, failures, reconciliation events) | 24 months. | Legitimate interest in being able to explain and audit automated decisions affecting your plant. |
| Administrative audit log (Platform Administration actions) | 24 months. | Legitimate interest in security and accountability for administrative actions. |
| Cookie/consent decision history | 24 months per recorded decision. We keep every individual consent decision for its own 24-month period rather than discarding earlier decisions when you update your preferences, so we can demonstrate what you consented to and when. | Legal obligation to demonstrate consent was validly obtained (GDPR accountability principle). |
| Support impersonation sessions (Platform Admin support access) | 24 months. | Legitimate interest in security and accountability for support access to your account. |
| Email verification tokens | 24 hours, or until used, whichever is sooner (existing technical expiry). | Necessary for account security. |
| Password reset tokens | 60 minutes, or until used, whichever is sooner (existing technical expiry). | Necessary for account security. |
| Deleted-account audit record | Indefinite. This record contains no personal data — see the Privacy Policy's "Deleting your account" section — so the standard time limits above do not apply to it. | Legal obligation to demonstrate that a deletion request was honored (accountability), without retaining the personal data that was deleted. |
See our full Data Retention Policy for the complete schedule and rationale.
Who we share your data with
We use the following providers to operate Voltessa. Each is contractually bound to process data only as we instruct.
Managed PostgreSQL database infrastructure operated by our hosting providers
Primary application database — stores account, organization, plant, telemetry, automation, and consent records.
Vercel Inc.
Hosts and serves the Voltessa web application (Next.js).
Google LLC
Google Sign-In (OAuth) — used only if you choose to sign in with Google.
Resend
Delivers transactional emails (email verification, password reset).
ntfy.sh
Delivers push notifications about automation events (export-mode changes, automation failures). Notification content covers plant/automation status only, never personal data.
Scaleway
Hosts the infrastructure that connects to your Huawei FusionSolar account on your behalf (the FusionSolar gateway proxy) and runs the scheduled telemetry, market-price, and automation jobs.
Huawei FusionSolar
Where you connect a plant, Voltessa retrieves plant and device telemetry from your own FusionSolar account, which you authorize via OAuth.
Calendly
Scheduling widget on our marketing site, loaded only if you click "Request Demo" and consent to Functional cookies.
International transfers
Some of the providers listed above may process data outside Bulgaria. Where that happens, the transfer is covered by the safeguards required under Chapter V of the GDPR (such as Standard Contractual Clauses or an applicable adequacy decision), as provided in our agreement with that provider.
Your rights
Under the GDPR, you have the right to access the personal data we hold about you, request its correction, request its erasure, request that we restrict or object to certain processing, and request a portable copy of it. You can exercise any of these rights by contacting us at privacy@voltessa.ai — as of this version of the policy, these requests are handled manually rather than through a self-service tool, and we aim to respond within one month.
You can update your own profile information (name, phone) at any time from Settings, and delete your own account at any time from Settings → Danger Zone — see "Deleting your account" below.
You have the right to lodge a complaint with a supervisory authority. As we are registered in Bulgaria, the competent authority is the Commission for Personal Data Protection (CPDP), www.cpdp.bg.
Deleting your account
When you delete your account (Settings → Danger Zone), your account and profile data, sign-in credentials, and per-user preferences are permanently deleted. We separately record that a deletion happened, in a form that contains no personal data at all — no name, email, phone, address, IP address, browser information, or any profile field — so that we can demonstrate deletion requests are honored without keeping the very data we deleted. This record cannot be used to identify who was deleted.
Deleting your own account does not delete your organization or its plant/telemetry/automation data, since that data belongs to the organization (which may have other members), not to any one account.
Data security
We apply industry-standard safeguards to protect your data, including encrypted connections, hashed passwords, and access controls that limit which staff can view or act on your account and organization data.
Children's privacy
Voltessa is a business-to-business service directed at plant owners and energy professionals. It is not directed at, and we do not knowingly collect personal data from, children.
Changes to this policy
If we make a material change to this policy (for example, adding a new category of processing or a new sub-processor), we will update the "Last updated" date above and, where the change affects cookie consent, treat any previously recorded consent as expired so you're asked again under the new terms.
Contact
Questions about this policy, or requests regarding your personal data, can be sent to privacy@voltessa.ai.