Privacy policy

Controller: the operator of Fluxival. We process account data (name, email), organisation data, site readings and audit logs to provide the service.

Legal basis: contract performance and, where needed, legitimate interest (security, fraud prevention). Analytics cookies only with consent.

Retention: account and meter data while your subscription is active, plus legal retention. You can export or delete the organisation in Settings.

Sharing: hosting/database providers and Stripe (payments). We do not sell personal data. EU-region hosting and a signed DPA are operational commitments — only claim them when your Vercel/Postgres region and sub-processor list match.

Rights: access, rectification, erasure, restriction, portability and complaint to the competent DPA. Contact: privacy@aienergymanager.be.

Optional AI explanations (OpenAI) stay off unless AI_ASSIST_ENABLED=true. If enabled, prompts may leave the EU. AI never approves actions or controls hardware. Integration secrets are encrypted at rest.