Privacy notice

The data controller is ФОП Ковалько Ігор Олександрович, Ukraine. You can reach us about anything in this notice at support@solarplan.app.

This notice covers the SolarPlan website for homeowners and businesses, the installer platform and the admin tools we use to run them.

We only ask for what the step you are on needs. To keep your plan, we ask you to sign in before showing it — with Google, with Apple or with a one-time code sent to your email. Your phone number is confirmed with a one-time SMS code only when you ask installers for offers.

• Your address and property. The address you choose (or only the town, if that is all you give), its map location and a place identifier, the building you confirm on the map (its cadastral reference, or the point you pin) and what you tell us about the roof, and the property type. We use them to find your roof and the programmes that apply where you live.
• Your energy profile. What you need (solar panels, a battery or both), your electricity bill or yearly usage, your goals, battery preference, planned changes such as an electric car or heat pump, your timeframe and any notes you add.
• Your account — to save your plan. When you continue with Google or Apple, we receive from them your name (Apple sends it only the first time, and only if you share it), your email address, whether the provider has verified it, and a user identifier the provider gives us for SolarPlan. With Apple you can hide your email: we then receive a private relay address that forwards to you. When you continue with email, we receive the address you type and confirm it with a one-time code. We use this only to keep your plans, let you open them on any device, recognise you when you sign in again (we store a one-way fingerprint of the provider’s identifier, not the identifier itself) and send you the link to your plan. We never receive your Google or Apple password, contacts or other data, and we do not post anything on your behalf.
• Your phone number — when you ask for offers. The number you confirm with a one-time SMS code when you send a request to installers (or, if you made your account that way, when you sign in with it). It is stored on your account, so the next request needs no new code. We do not call you and share the number only with the installers who open your project after you consent. We store the codes and their limits only as one-way fingerprints, never in plain text. News about subsidies and deadlines in your region is sent only if you tick that separate box, and you can switch it off at any time.
• Your contact details — only when you ask for offers. Your name, email address, phone number and how you prefer to be contacted, together with a record of your consent.
• Installer business details. For companies on our installer platform: company and registration details, service areas, certifications, the contact people they give us, and their credit purchases.
• Usage information. Anonymous events such as “plan generated” or “request sent”, linked to a random session id. These events never contain your name, contact details or address. Google Analytics runs only if you accept it (see “Cookies”).

Roof geometry from Google is third-party content: we keep it only for a limited time, as the provider’s terms allow (currently up to 30 days), and rebuild it when needed. Satellite imagery is passed straight to your screen and is never stored. Building outlines and address data from public sources are open data about buildings, not about you; we keep a copy for a limited time so we don’t ask the public services for the same thing twice.

• Building your plan (solar panels, a battery or both) and showing matching incentives and financing

  Legal basis (GDPR)Steps you ask us to take — Art. 6(1)(b)

• Saving your plans to your account and signing you in (Google, Apple, a one-time email or SMS code)

  Legal basis (GDPR)Steps you ask us to take — Art. 6(1)(b)

• Confirming your phone number before your project goes to installers

  Legal basis (GDPR)Steps you ask us to take — Art. 6(1)(b)

• News about subsidies and deadlines in your region (only if you tick the box)

  Legal basis (GDPR)Your consent — Art. 6(1)(a). We record the text you saw, its version and when you gave it; you can withdraw it on My plans at any time.

• Sharing your project with installers

  Legal basis (GDPR)Your explicit consent — Art. 6(1)(a). We record the text you saw, when you gave it, which companies or how many it covered, and the version of this notice.

• Reading your optional notes or an installer’s quote with AI to fill in fields

  Legal basis (GDPR)Steps you ask us to take — Art. 6(1)(b)

• Installer accounts, verification, billing and card payments

  Legal basis (GDPR)Contract — Art. 6(1)(b); legal obligations — Art. 6(1)(c)

• Keeping the service secure, preventing abuse and controlling costs

  Legal basis (GDPR)Legitimate interests — Art. 6(1)(f)

• Understanding how the product is used, with anonymous events

  Legal basis (GDPR)Legitimate interests — Art. 6(1)(f). You can object at any time by writing to us (see “Your rights”).

• Google Analytics statistics (only after you click “Accept”)

  Legal basis (GDPR)Your consent — Art. 6(1)(a)

Installers — only after your consent. When you send a request, your project can be opened by up to 3 verified installers for a home or an apartment building and up to 5 for a business, or only by the companies you choose yourself. Until a company opens your project, it sees it without your name, contact details or address. Each company that opens it receives your name, contact details, address and plan; we tell you which companies opened it. If you choose a company that is not on SolarPlan yet, we invite it, and it receives your details only after it joins SolarPlan and opens the project. Each installer then handles your details as an independent company and may contact you directly about your project.

Service providers (processors) who handle data on our instructions:

• Vercel — hosting of the website and its servers. Supabase — database, file storage and sign-in for installers and administrators.
• Google Maps Platform — measured roof analysis (Solar API) when you send a request to installers, and, only where switched on, address suggestions and satellite imagery. Google receives the map location being looked up, never your name or contact details.
• Google (Sign in with Google) and Apple (Sign in with Apple) — only if you choose them. They confirm who you are and send us the details listed under “Your account”; your use of their sign-in is also covered by their own privacy policies.
• SMS providers — deliver the one-time codes: TurboSMS (where switched on, first as a Viber message, then by SMS) and, for some numbers outside Ukraine, Twilio. They receive your phone number and the code message.
• Resend — delivers our emails (one-time sign-in codes, the link to your plan and updates about your request) and receives the emails you send to our addresses. It receives your email address and the message.
• Cloudflare Turnstile, where switched on — a check against automated abuse of the one-time codes. It runs in your browser and receives technical data about the browser, not your phone number or email.
• European Commission Joint Research Centre, PVGIS — solar production estimates. It receives an approximate location and panel orientation only, never personal data.
• Spanish public map services — the Instituto Geográfico Nacional (CartoCiudad address search and PNOA aerial photos) and the Dirección General del Catastro (building outlines). Our servers send them the address text or map location being looked up, never your name or contact details. Aerial photo tiles are loaded by your browser directly from the IGN, which therefore sees your IP address and the map area on screen.
• OpenStreetMap-based services — Photon (address search outside Spain) and the Overpass API (building outlines). They receive the address text or map area being looked up, never your name or contact details; some building lookups are made by your browser directly, so the service sees your IP address. Satellite tiles from Esri are also loaded by your browser directly.
• Anthropic — reads free text you write or an installer’s quote document, only when they are provided, to turn them into structured fields. It also rewords the explanation of your plan from the plan’s figures, without your contact details.
• Google Analytics — only with your consent; see “Cookies” below.

Payments by installers. Companies pay for credit packs by card on the payment page of monobank; we receive the payment status, never the card details.

We do not sell your data and we do not use it for advertising.

SolarPlan combines open and licensed data from the providers below. Each is used under its own licence or terms, and we credit it as shown.

• Instituto Geográfico Nacional (IGN) / CNIG

  Used forAddress search (CartoCiudad) and aerial imagery (PNOA)
  Licence or termsCC BY 4.0 (scne.es)
  Attribution© Instituto Geográfico Nacional (IGN) – CartoCiudad / PNOA, CC BY 4.0, scne.es

• Dirección General del Catastro

  Used forCadastral cartography (building outlines and references)
  Licence or termsThe Catastro’s terms of use for cadastral data (catastro.hacienda.gob.es)
  Attribution© Dirección General del Catastro

• OpenStreetMap

  Used forMap data, address search outside Spain and building footprints
  Licence or termsOpen Database License (ODbL) (openstreetmap.org/copyright)
  Attribution© OpenStreetMap contributors

• Overture Maps Foundation

  Used forBuilding footprints
  Licence or termsBuildings data under ODbL, plus CC BY 4.0 credits for the other sources Overture lists (docs.overturemaps.org/attribution)
  Attribution© Overture Maps Foundation, © OpenStreetMap contributors and the other sources credited by Overture

• Esri World Imagery

  Used forSatellite imagery
  Licence or termsEsri terms of use (esri.com/legal)
  AttributionSource: Esri, Maxar, Earthstar Geographics, and the GIS User Community

• Google Maps Platform

  Used forAddress suggestions, geocoding, roof analysis (Solar API) and satellite imagery
  Licence or termsGoogle Maps Platform Terms of Service and Google’s attribution requirements (cloud.google.com/maps-platform/terms)
  AttributionGoogle logo and data attributions as shown on the map

• European Commission Joint Research Centre — PVGIS

  Used forSolar production modelling
  Licence or terms© European Union, reuse under the Commission’s reuse policy (CC BY 4.0) (PVGIS)
  Attribution© European Union, PVGIS (EU JRC), CC BY 4.0

Some providers above may process data outside the European Economic Area, for example in the United States. Where they do, the transfer relies on the EU–US Data Privacy Framework for certified companies or on the European Commission’s Standard Contractual Clauses.

• Your plan and energy profile

  Kept forUntil you delete the plan, or 24 months after your last visit

• Contact details shared for offers

  Kept forDeleted together with the plan

• Your account: name, email, confirmed phone number and how you sign in (Google, Apple, email, phone — with a fingerprint of the provider’s identifier and the dates)

  Kept forWhile you keep plans with us; deleted 36 months after your last sign-in, or on request

• One-time code records (fingerprints of the number or email, code and connection only)

  Kept for30 days from when the code was sent, for rate limits and abuse prevention; then deleted. We keep only monthly totals (how many codes were sent and confirmed), which cannot identify you

• Marketing consent records

  Kept forWhile the consent is active, then 3 years as proof

• Consent records

  Kept forKept as proof of consent for 5 years, without the project details

• Roof data from Google

  Kept forUp to 30 days, then refreshed or removed

• Satellite imagery from Google

  Kept forNot stored — shown on screen only

• Public address and building data (CartoCiudad, Cadastre, OpenStreetMap)

  Kept forAddress lookups up to 30 days, building outlines up to 90 days, then refreshed or removed

• Aerial photos from the IGN

  Kept forNot stored by us — loaded by your browser from the IGN

• Anonymous usage events

  Kept for400 days, then deleted

• AI processing log (a fingerprint of the input and the structured result — never the text or file itself)

  Kept for90 days, then deleted

• Installer accounts

  Kept forWhile the account is active, then 3 years for legal and tax obligations

You can ask to access, correct or erase your data, to restrict or object to how we use it, and to receive it in a portable format. Where we rely on consent, you can withdraw it at any time; this stops any further sharing but does not undo what happened before.

• Delete your plan yourself. Use “Delete this plan” on your plan page. This removes the plan, your energy profile and the requests made from it, with the contact details attached to them.
• Withdraw your consent by cancelling your request. Use “Cancel request” on your offers page. Your consent is then withdrawn for every company: none of them sees your personal data for that request any more.
• Stop subsidy news on My plans, at any time.
• Write to us at support@solarplan.app. We answer within one month.
• Installers who already received your details hold their own copy. You can ask them directly to delete it, and we can pass your request on.

If you are unhappy with how we handle your data, you can complain to a data protection authority, in particular in the country where you live: in Spain, the Agencia Española de Protección de Datos (aepd.es); in Ukraine, the Ukrainian Parliament Commissioner for Human Rights (ombudsman.gov.ua).

We use only what the service needs to work, plus a first-party analytics id that is not a cookie. Google Analytics cookies are set only if you accept them (below). There are no advertising cookies.

• sp_owner, sp_owner_linked

  PurposeProves this browser created your plans (or received them through your private link), so only you can see their private details and delete them
  Type and durationStrictly necessary cookies · up to 400 days

• sp_has_plans

  PurposeShows “My plans” in the menu; holds only “1”, no identifier
  Type and durationStrictly necessary cookie · up to 400 days

• sp_home

  PurposeKeeps you signed in to your account, so your plans open on this device
  Type and durationStrictly necessary cookie · 180 days, or until you sign out

• sp_oauth_google / sp_oauth_apple

  PurposeProtects the Google / Apple sign-in against forgery: links the provider’s answer to this browser (encrypted, one use)
  Type and durationStrictly necessary cookie · 10 minutes, deleted when the sign-in finishes

• sp_locale

  PurposeRemembers the language you chose
  Type and durationStrictly necessary cookie · 1 year

• sp_market

  PurposeRemembers the country you chose for the home page’s prices and programmes; holds only “UA”, “ES” or “EU”, and is set only when you choose
  Type and durationFunctional (preference) cookie · 1 year

• sp_pro

  PurposeKeeps an installer signed in (demo mode)
  Type and durationStrictly necessary cookie · 7 days

• sp_admin

  PurposeKeeps a SolarPlan administrator signed in (demo mode)
  Type and durationStrictly necessary cookie · 12 hours

• sb-… (Supabase)

  PurposeKeeps installers and administrators signed in when accounts are enabled
  Type and durationStrictly necessary cookies · until you sign out

• sp_consent

  PurposeRemembers whether you accepted or declined analytics cookies
  Type and durationStrictly necessary cookie · 6 months

• sp_sid

  PurposeRandom analytics session id, so events from one visit can be counted once
  Type and durationFirst-party session storage · deleted when you close the tab

• sp_onboarding, sp_entry, sp_address

  PurposeKeep your answers and the address you picked while you build a plan, without putting them in the page address
  Type and durationSession storage · deleted when you close the tab

• sp_quote_compared, sp_ai_ref

  PurposeMake sure a step is counted only once per visit
  Type and durationSession storage · deleted when you close the tab

• solarplan:plan-map-view, sp_pro_calculator

  PurposeRemember the 2D / 3D view of your plan and the inputs of the installer cost calculator
  Type and durationLocal storage on your device · until you clear it

• _ga, _ga_<id> (Google Analytics)

  PurposeCounts visits and pages anonymously — only after you click “Accept” in the cookie banner
  Type and durationAnalytics cookies, only with your consent · up to 13 months, removed when you decline

Data is encrypted in transit. Access to personal data is limited to the people and systems that need it, installers see a project’s contact details only after your consent and only once they open it, and every change made in our admin tools is logged. Provider keys never reach your browser.

Each version of this notice has a version number, shown at the top of the page. When you consent to share your project we record the version you saw. If we make significant changes, we will tell you before they apply. You can read our terms of use for how the service itself works.