matosic

Privacy policy

Cenit · Solar monitoring and stats

Who is responsible

Hrvoje Matosic, independent developer, at Av. División del Norte 1354, Mexico City. You can write to me at privacidad@hrvojematosic.com. That address is for everything on this page: your rights, withdrawing your consent, or any question.

One case is different. If you're the customer of an installer who uses Cenit, your data (your name, phone, address, quote, payments and CFE paperwork) is your installer's to decide on. The installer company is responsible for that data, and I only store and process it on its behalf so its dashboard works. What that means is further down.

What stays on your phone

All of this lives on your device and is never sent to me, unless you use one of the optional features further down.

• Your inverter credentials, for every brand Cenit connects to. The system encrypts them. On an iPhone, iPad or Mac they go in the Keychain. On Android they're sealed with an Android Keystore key that never leaves the phone.
• Your generation readings, panel by panel, in an SQLite database inside the app.
• Your consumption, your tariffs and your CFE bill readings, which you enter for the DAC calculation.
• Your preferences, like the theme, the type of home and the vehicle name.
• The photo of your bill, if you scan one. The text is read on the phone itself and the photo isn't uploaded anywhere.
• Your projects, if you're an installer: clients, site surveys, quotes, payments, the CFE paperwork, the installed equipment with its serial numbers and warranties, and the photos of each job. They live in the app and only leave it if you link the web dashboard.

The optional features below copy part of this somewhere else. iCloud sync copies your plants' settings and your logins to your own iCloud. The web dashboard receives your plant list with its daily totals and, since version 1.7, your projects. Your panel by panel readings, your CFE bill readings and the bill photo stay on the device either way.

On an iPhone, the app's data is part of your phone's own iCloud Backup if you have it on, like any other app. That backup is yours and I can't see it. On Android, Cenit stays out of Google Drive backups. If you move to a new phone by cable or Wi-Fi, your settings and history come along, but your passwords don't. You enter those again.

If you search for a place in the app, like your home or a client's roof, what you type goes to the system's map search (Apple's on an iPhone, Google's on Android) to find it. On an iPhone, the satellite map where you place a roof is Apple's too. None of that reaches me. The map of your plants is drawn by the app itself, with no map service behind it.

If you scan a roof's shade with the camera, the app uses your location to draw the sun's paths and correct the compass. It's kept with the scan, on the phone. It only leaves if the scan is part of a project and your company has the web dashboard linked.

When Cenit connects to your inverter's cloud, it goes straight from your phone to that brand's server, with your own credentials. I'm not in the middle and I don't see that data. What that brand does with it is governed by their privacy policy, not this one.

When you send a quote or share your day as an image, it goes through your phone's share sheet to the app you pick, like WhatsApp. That file doesn't reach me. The quote stays in your history inside the app, and only goes to the web dashboard if you linked it.

iCloud sync, with a plan

While you have a paid plan, or during the free first month, Cenit keeps things the same on every Apple device signed into your iCloud. What travels is each plant's settings (the system, tariffs, monthly consumption, place and service schedule), how the app looks, and your inverter logins.

It goes to Cenit's private space in your own iCloud account, not to a server of mine. The values are encrypted and only your own devices can read them. I have no access to your iCloud.

Your readings don't travel. Each device reads its own from the inverter's cloud. Your projects don't travel through iCloud either, and the web dashboard link doesn't pass from one device to another: each device links on its own.

Sync only runs while a plan or the free month is on, and only on a device signed into iCloud. There's no switch for it inside the app. To stop it, turn off iCloud for Cenit in your device's settings, or sign out of iCloud. When a plan ends, sync stops and what's already in your iCloud stays there. To delete it, open your iCloud storage settings, pick Cenit and delete its data.

The web dashboard, only if you link it

Installers can run their plants and projects from a browser at cenit.hrvojematosic.com. Nothing goes there from the app until someone signs in on the dashboard, gets a six-letter code and types it into the app under Settings → Web dashboard. The code lasts ten minutes and works once.

What a linked app sends

After each read, the app sends the dashboard its plant list. For each plant that's

• its name, the inverter brand and model, and its id in that brand's cloud
• what it's producing now, today's total and the daily totals the app has
• when it last reported, its time zone, and any problem or alarm the inverter reported
• its city, region, country and coordinates, as the inverter's cloud gives them
• its service schedule, with the start date, visits a year and the last and next visit

Since version 1.7 it also sends the company's projects, and receives the ones the others made. That includes

• clients: name, phone, email, address and notes
• each job's site survey, with its measurements, the shade scan and where it was taken
• quotes, with their plans, prices and payment terms
• the payments recorded on each project
• the CFE paperwork: each step with its dates and folio numbers, and the documents and photos in the file, like the bill, the account holder's ID, the stamped receipt or the new meter
• the installed equipment, with serial numbers and warranties
• the team's tasks and each project's messages, with the name of who wrote them
• the job photos

Photos and documents are stored inside the dashboard's database, on the server. The app also sends the device's name (like “iPhone de Alex”), whether it's an iPhone, a Mac or an Android phone, and the app version.

It never sends your inverter logins or passwords, your panel by panel readings, your CFE bill readings, the bill photo or your consumption.

Who sees a company's data

Everything that reaches the dashboard belongs to the installer company whose code was used. Each company only sees its own.

• Its administrators see everything the company has, invite people, remove projects, hand out tasks and decide which customer sees which plant.
• Its technicians see and work on every plant and every project, amounts included, and link their phones.
• A customer whose email an administrator added to a plant sees that plant, read only, after signing in. They don't see projects, other customers or money.

The company can also type things straight into the browser: clients, prices, visits, quotes, projects and photos. That isn't sent by the app, but it's stored in the same place and the same rules apply.

If someone leaves the company, their phone stops syncing. What that phone had already downloaded stays on it until they delete the app or link it to another company.

Links for customers

The company can make two kinds of link that open without an account. One shows a service visit, with the date, what will be done, who goes, the cost and whether it's paid. The other shows how a customer's CFE paperwork is going: the steps, which one it's on and how long CFE has taken, with the company's and the customer's names. That one shows no money, documents, photos or folio numbers.

Anyone who has the link can open it, so it's meant to go only to that customer.

Where it lives and who else touches it

The dashboard and its database run on a server I rent from a hosting company in the United States. I run it myself. Every night an encrypted copy of the database goes to a computer of mine.

Sign-in is handled by Clerk, a US company. Clerk keeps the email, name and password of each dashboard account, sends the sign-in codes and invitations, and keeps a record of sessions. The dashboard uses Clerk's cookies only to know you're signed in. There are no advertising cookies.

Like any server, the dashboard's sees the IP address of whoever connects. I only use it to stop abuse, like someone trying to guess codes. Everything travels encrypted.

I run the server, so I can technically reach this data. My own view shows how many plants, devices and overdue visits each company has, not its clients or projects. I only go into a company's data when it asks me for help, to fix a fault, or for security. I don't sell it or use it for anything but running the dashboard.

How to stop sending

Tap Unlink in Settings → Web dashboard. The app stops sending and the device is deleted from the dashboard. On the dashboard, an administrator, or the technician who linked the device, can also remove it from the Devices page.

Unlinking doesn't delete what was already sent, because it belongs to the company. For that, see how long it's kept and how it's deleted.

If you're an installer's customer

If your installer uses Cenit, what they record about you is kept in their company's dashboard: your name, phone, email and address, your quote, your payments, your CFE paperwork with its documents, the equipment they installed and the job photos.

For that data, the installer company is the one responsible. It decides what to record and what for, and it has to give you its own privacy notice and ask for your consent where needed, above all for your payment and property details. I'm its processor. I store that data and process it only so its dashboard works, following what the company decides, and I don't use it for anything of my own.

To see, correct or delete that data, ask your installer. If you write to me, I'll pass your request on to the company and help it answer.

Roofs and shade with Google

With a plan, the app and the dashboard can ask Google's Solar API for a roof's faces, how many panels fit and how much sun they get, and for a shade map. The app doesn't talk to Google directly. It sends my server the point on the map (latitude and longitude), and my server asks Google with its own key.

Google only gets that point. It doesn't get your name, your client's name, the written address or anything from your phone. What Google sends back is kept on my server for 30 days, tied to the building and not to who asked, so a second quote for the same roof doesn't cost another lookup. Separately I keep which account made each lookup and when, to count the month and match Google's bill. What Google does with the point is governed by its own terms.

Purchases

Plans are bought through the App Store or Google Play. Apple or Google take the payment and keep your payment details. I never see them.

If you have a plan, the app shows my server the purchase, signed by Apple or Google, when it needs to: for example when the app opens, after a purchase, or when it's linked to the dashboard. That's how it knows which plan you have and how many roof lookups you get. On Android, my server confirms it with Google Play. I keep the purchase number, the plan, when it ends and, if the device is linked, which company it counts for. It doesn't carry your name, your email, your Apple ID or your Google account.

On the App Store, Apple also notifies a server of mine when a plan is bought, renewed, refunded or cancelled. The notice carries the plan, the dates, the price, the store's country and Apple's transaction numbers. It doesn't carry your name, your email or your Apple ID. I use it to follow sales and refunds.

Anonymous usage, only if you agree

The app asks you once whether you want to send anonymous usage. If you say yes, every time you try to connect an inverter, and at most once a day when an account that's already connected stops syncing, exactly this is sent.

If anonymous usage is off and syncing fails, the app offers a Send me this error button to send that one report, with the same data. It only goes out if you tap it.

Nothing else goes in these reports. No identifier is sent. Not your name, not your email, not your inverter account, not the IDFA, not the IDFV, not the Android advertising ID, not an install identifier, not your location any more precise than the country, and not the exact time. There's no way to link two of these events to each other, let alone to you. That's why the App Store shows them as “Not Linked to You”, and Google Play as optional app activity that isn't shared with anyone.

These counts arrive at a server of mine on Cloudflare Workers and delete themselves after three months.

How to turn it off

Settings → Privacy → Send anonymous usage. It comes switched off, and that same switch turns it off again. The whole app works the same, on or off.

What data I handle, in short

• Your dashboard account: name, email, password (kept by Clerk), your company and your role in it.
• Linked devices: their name, what kind they are and the app version.
• Plants: name, equipment, production, alarms, location and service schedule.
• Your company's projects: its clients' identification and contact details, CFE paperwork documents (like an ID or proof of address), photos, and financial and property details like quotes and payments.
• Your purchases: the purchase number, the plan and when it ends.
• Roofs: the point on the map looked up with Google.
• When you connect: your IP address.

Cenit doesn't ask you for sensitive data, like health, religion or ethnic origin. Notes and messages are free text: don't use them for that.

What I use your data for

The purposes the service needs, without which it doesn't work:

• Giving you a dashboard account and letting you sign in.
• Keeping your company's plants and projects, syncing them with linked devices, and showing them only to the people your company lets in.
• Opening the links your company sends its customers.
• Checking which plan you have, counting your roof lookups and making them with Google.
• Keeping track of plan sales and refunds.
• Support, keeping the server secure, backups, and answering your rights requests.

The secondary purpose, which the service doesn't need:

• Anonymous usage counts, to know which brands people use and which ones fail. They only run if you say yes, and you turn them off in Settings → Privacy. If you'd rather not, the app works the same.

I don't use your data for advertising or for anything not on this list. If I ever want to use it for something else, I'll ask you first.

Who it's shared with

I don't sell your data or hand it to anyone to use for their own purposes. All there is are providers that help me run the service and only handle the data for that:

• The hosting company I rent the dashboard's server from, in the United States.
• Clerk, for the dashboard's sign-in, in the United States.
• Google, which only gets the point on the map of a roof when you ask about it.
• Cloudflare, which receives the anonymous counts and serves this page.

Apple and Google charge for plans on their own, under their own privacy policies. Some of these providers keep their servers outside Mexico.

Beyond that, I'd only hand data over if a competent authority asks for it under the law.

How long it's kept and how it's deleted

• On the phone. Signing out of each inverter in the app deletes its readings and its login. Deleting the app deletes the database, with any projects in it. On an iPhone, iPad or Mac the system can keep Keychain items after the app is gone, so sign out first if you want your logins removed too.
• In iCloud. You delete it from your iCloud storage settings.
• On the web dashboard. What's sent stays while the company has its account. Removing a client, a quote or a project, in the app or on the dashboard, deletes its contents on the server too. Photos and documents that were already uploaded stay stored until the company's account is deleted or you ask me to delete them. A project's messages can't be deleted from the app or the dashboard. If one needs to go, write to me.
• The whole account. To delete your dashboard account, or your company's with everything in it, write to privacidad@hrvojematosic.com from the account's email. For a company, an administrator has to write. I delete it and confirm.
• Backups. What's deleted can remain in the encrypted backups until they're replaced, within 30 days.
• Google. What Google answered about a roof is deleted after 30 days.
• Anonymous counts. They delete themselves after three months.

Some purchase records I may have to keep longer, for my tax obligations.

What I don't do

• I don't sell your data. It only reaches the providers that run things for me, described on this page, and the people you or your company let into the web dashboard.
• There are no ads and no third-party trackers.
• There are no third-party analytics or crash reporting SDKs inside the app. On Android, the bill scanner uses Google's ML Kit to read the text on the phone. Google says ML Kit can send it performance and usage metrics about the scanner itself.
• I don't track you across apps or websites, so your phone never asks you for tracking permission. There's nothing to track.
• You don't need a Cenit account to use the app. Only the web dashboard has accounts, for those who use it.

Your rights

Under Mexico's Federal Law on the Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares), you have ARCO rights. You can access, rectify, cancel or object to the use of your personal data, and revoke your consent.

In practice a lot of this is in your hands.

• Access and rectification. Everything on the phone is inside the app. What's on the web dashboard, its company can see and fix, and I can send you a copy.
• Cancellation. It's above, under how long it's kept and how it's deleted.
• Objection and revocation. The anonymous usage switch in Settings, and Unlink for the web dashboard.

To exercise them in writing, email privacidad@hrvojematosic.com with

• your name and an email to reply to
• an ID of yours, or your representative's with the document that shows they can act for you
• which right you want to exercise, and over which data
• anything that helps me find it, like your dashboard account's email or the company's name

I'll answer within 20 days. If it applies, I'll carry it out within the following 15 days. It's free. If you're an installer's customer, the request goes to your installer, as explained above, and I'll pass it on. Keep in mind that the anonymous counts carry no identifier, so there's no technical way to find “yours” among them.

If you think I didn't handle your request properly, you can go to the Secretaría Anticorrupción y Buen Gobierno, Mexico's authority on this.

Children

Cenit isn't aimed at children under 13 and doesn't knowingly collect data from them. The web dashboard is for adults.

Changes

If this changes, I update this page and the date below. If the change is important, I'll also say so in the app or on the web dashboard. If the app ever starts sending something new, I'll say so here first, and ask you inside the app when it needs your consent.

Using the web dashboard and the company features is also governed by the terms and conditions.