Privacy policy

Operator

BESSPLAN, Scale Energy GmbH

Address

Auguststraße 1, 10117 Berlin, Deutschland

Represented by

Elias Aruna, Christoph Kößler, Nikolas Fendel

Court of registration

Amtsgericht Charlottenburg (Berlin), HRB 260460 B

Phone

015158332394

E-Mail

info@scale-energy.eco

We have not appointed a data protection officer, and are not required to. Questions about data protection go to the address above.

When you open the site, your browser sends technically necessary data to our hosting provider: IP address, date and time, the address requested, status code, volume transferred, referrer and details about your browser and operating system. We need this to deliver the page, detect faults and defend against attacks.

The legal basis is our legitimate interest in a secure, functioning site, Art. 6(1)(f) GDPR. The provider deletes these logs after 30 days at the latest.

BESSPLAN stores your choice from the consent notice (up to 180 days), the origin of a specific enquiry, and — as long as you are not signed in — your project data in your browser’s local storage. The tool does not work without it, and the data does not leave your device.

The legal basis is § 25(2)(2) TDDDG: the storage is strictly necessary for the service you explicitly requested, so no consent is required. You can clear local storage at any time in your browser settings.

PostHog analytics and Meta marketing measurement can be selected separately in the consent notice. Each runs only with your explicit consent. As long as you have not agreed, or have chosen “Essential only”, no measurement script is loaded and no analytics cookie is set.

Where we do measure, we use PostHog on servers in the European Union. What is measured are pages viewed, steps in the tool and where the visit came from, for example the ad you arrived through. We use this to understand which content is needed.

On the Speicherplaner page we count, without cookies and without storing anything in your browser, which steps a page view reaches: page loaded, form visible, phone field tapped, request sent. We store a random identifier valid only for that single page view, the campaign details from the link and whether a mobile device is used. We do not store IP addresses, browser identifiers or anything you type. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is understanding where visitors leave the page. Counting data is deleted after twelve months.

The legal bases are § 25(1) TDDDG and Art. 6(1)(a) GDPR. You can withdraw consent at any time with future effect via “Cookie settings” in the footer of every page. We delete measurement data after twelve months.

If you use the contact form or request a callback, we process: name, email address, phone number, company, your message, the origin of the request (form, callback) plus campaign markers (utm_source, utm_medium, utm_campaign, utm_content, utm_term) and the page you submitted from.

The purpose is answering your enquiry and, where a concrete project is involved, preparing a contract. The campaign markers tell us which ad or article you came through; they contain nothing about you personally.

The legal basis is Art. 6(1)(b) GDPR for contract-related enquiries, otherwise our legitimate interest in replying, Art. 6(1)(f) GDPR. We delete enquiries three years after the last contact at the latest, unless commercial or tax retention duties apply.

For your requested demo we store your name and email address, a personal demo link, processing status and campaign origin. Gmail sends the link to the address provided. It is valid for 72 hours and only opens a sample-data demo, never customer projects. The basis is performing your request, Art. 6(1)(b) GDPR.

Only if you explicitly select and consent to an AI callback do we send your phone number, name, email, any company and project-interest details, and demo and purchase links to fonio GmbH. An AI assistant calls you about BESSPLAN and can change the demo view. One unanswered call may be retried. The basis is your separate consent, Art. 6(1)(a) GDPR.

The assistant processes your voice for the conversation. fonio stores the call as an audio recording with a text log for 30 days for quality assurance. The assistant points this out at the start. If you object, the call ends and the recording and log are deleted automatically. BESSPLAN receives the outcome and a short summary of the project interest discussed; our backend does not receive recordings or full transcripts. We send the purchase link only with your separate consent. Consent text, version, time and an IP-address hash generated with a secret key are retained for evidence and abuse protection.

You can stop further callbacks and purchase emails using the unsubscribe link in our messages or by contacting info@scale-energy.eco. Expiry of the demo link does not automatically erase the enquiry or consent record. Enquiry retention follows section 5; necessary records are retained only as needed to handle the request, establish legitimate legal claims or satisfy statutory duties.

fonio privacy information · fonio: data processing and subprocessors

For an account we process your email address, sign-in times and, if you use a password, its hash. Online checkout also supports a personal single-use sign-in link: your click confirms your email and signs you in. Inside the account we store your projects: site details, consumption and load profile data, sizing, documents, tasks and share links. This data is tied to your account, and the database enforces at row level that only you can see it.

If you create a share link, anyone who has it can see the shared state. The link contains a genuine random value and cannot be guessed; you can revoke it at any time.

The legal basis is Art. 6(1)(b) GDPR. We delete account and projects when you delete the account, and at the latest twelve months after the last sign-in. We do not pass load profiles to third parties without your explicit consent.

For invoice-based contracts we process the verified account email, company, German billing address, authorised signatory’s full name, plan, enquiry origin and accepted versions of the service agreement and data processing agreement. The typed-name confirmation, consent to PDF invoices by email, timestamp and keyed pseudonymous IP evidence document acceptance. Immutable snapshots and PDFs are stored in our Supabase database and emailed as attachments through Gmail. An internal activation task contains the required contact details. Access is manually activated within up to 48 hours after signature. Signature, access activation and confirmed bank payment remain separate statuses.

Invoice payments are made by bank transfer. Contract documents and cancellation are available in account settings. Separately offered card checkout uses Stripe, which receives required account, company and plan details and an internal account identifier and reports payment status. Card details are entered directly at Stripe. Processing is based on Art. 6(1)(b) GDPR; statutory invoice and contract records are also processed under Art. 6(1)(c) GDPR for the applicable retention periods.

Central registration and sign-in use our existing account provider Auth0 (Okta), processing email address, verification status, account ID and login data. Only email addresses verified by Auth0 are linked to the corresponding Supabase account. The access token for economic calculations is used only on the server. Where central sign-in is not enabled, a requested email sign-in link is available instead. Team invitations are sent at the project owner’s request; invitees verify their own accounts.

Sign-in, demo and requested purchase emails are sent through Gmail (Google Ireland Limited). Google processes recipient address, subject, content and delivery data. Personal single-use and demo links form part of the requested message. We rate-limit sign-in messages using email and IP hashes; these limit records expire after one hour.

Stripe privacy policy · Google privacy policy · Okta/Auth0 privacy policy

For economic and grid fee calculations we pass your consumption and plant data to a computation service on Scale Energy’s own infrastructure (api.quant.scale-energy.eco). We do not transmit personal contact data with it.

The guided intake includes an assistant that sends your input to an AI service by Anthropic through the Vercel AI Gateway. What is transmitted is the intake conversation. Do not enter anything there that does not belong in the sizing. The providers do not use the content to train their models.

The legal basis is Art. 6(1)(b) GDPR — both are part of the service you request by using the tool.

We run ads on Facebook and Instagram. In them you can fill in a form directly inside the app (an “instant form”). Doing so transmits to us: name, email address and phone number, plus which campaign, ad and form the enquiry came from.

For delivering the ads and collecting the form data we are joint controllers with Meta Platforms Ireland Ltd. (Art. 26 GDPR). Meta provides reach and the form, and processes usage data under its own rules; we process what you enter in the form. The essence of the arrangement with Meta and Meta’s own privacy notice are at facebook.com/legal/terms/businesstools and facebook.com/privacy/policy.

The legal basis for processing your form entries is Art. 6(1)(b) GDPR, otherwise our legitimate interest in getting in touch, Art. 6(1)(f) GDPR. We retrieve the form data from Meta and delete it there afterwards; on our side the same period applies as for contact form enquiries. On selected public marketing and checkout pages we use the Meta Pixel after separate marketing consent.

The Meta Pixel from Meta Platforms Ireland Limited measures page views, successful demo requests, initiated checkouts and server-confirmed payments to attribute results to our Facebook and Instagram ads. Meta may receive IP address, browser and device details, public pages viewed, event identifiers and purchase amount and currency. Meta may link this information to a Meta account and process it for its own advertising purposes.

Without explicit marketing consent, the pixel is not loaded and no pixel events are sent. Prior analytics-only consent is insufficient. We do not send names, email addresses, phone numbers, load profiles or project contents; Advanced Matching, automatic form collection and server-side Conversions API are not enabled in this integration. Pixel measurement is blocked on private project pages and pages containing personal demo or sign-in tokens.

With consent, Meta may use the _fbp and _fbc cookies. We also keep event identifiers in your browser for up to 90 days to avoid duplicate purchase reports. The legal bases are § 25(1) TDDDG and Art. 6(1)(a) GDPR. You can withdraw marketing consent in Cookie settings at any time; we then stop future events and remove accessible Meta cookies. Further processing and retention of data already transmitted follows Meta’s privacy policy. Transfers to the USA are possible; see section 11.

Meta privacy policy · Meta Business Tools and responsibilities

Enquiries from the contact form and from ads are created in our customer management system so that someone is responsible and nothing is left lying around. The handover runs through an automation service, the notification by email. The next section names the services involved.

The legal basis is Art. 6(1)(b) and (f) GDPR. We do not use your data for third-party advertising and we do not sell it.

We have data processing agreements under Art. 28 GDPR with every provider listed below that processes data on our behalf. Beyond that we only disclose data where the law requires it.

• Vercel Inc.Hosting, delivery, server logs, file storageEU region, parent in the USA
• Supabase Inc.Database, sign-in, contact enquiriesUSA
• Auth0 / OktaRegistration, email verification and central sign-inExisting Auth0 tenant configuration; group in the USA
• PostHogAnalytics, only after consentEU (eu.i.posthog.com)
• Anthropic PBC über Vercel AI GatewayLanguage model in the intake assistantUSA
• Meta Platforms Ireland Ltd.Ads, forms and consent-based pixel measurementIreland, group in the USA
• Pipedrive OÜCustomer management, handling the enquiryEU (Estonia)
• n8n GmbHAutomated handover of enquiriesEU (Germany)
• Google Ireland Ltd.Gmail: requested demo, sign-in and purchase emails; enquiry handlingIreland, group in the USA
• fonio GmbHOptional AI callback and conversation outcomeAustria; technical providers under fonio DPA
• StripePayment, invoices and subscription managementIreland; international processing under Stripe policy
• Scale Energy GmbHComputation service for sizing and grid feesGermany

Some of the services named belong to groups in the USA. Where data reaches the USA, we rely on the European Commission’s adequacy decision (EU-US Data Privacy Framework) if the recipient is certified there, otherwise on the Commission’s standard contractual clauses with additional safeguards. On request we will name the specific basis per service.

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18) and data portability (Art. 20 GDPR). You may object to processing based on legitimate interest (Art. 21 GDPR). Any consent you have given can be withdrawn at any time with future effect.

An informal message to info@scale-energy.eco is enough for all of this. On request we provide a full export of your project data and delete it completely.

You may also complain to a supervisory authority. Ours is the Berlin Commissioner for Data Protection and Freedom of Information, Alt-Moabit 59–61, 10555 Berlin, Germany.

The calculations in BESSPLAN are results, not decisions about you. There is no automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

If the way we process data changes, this notice changes with it. The date above tells you which version you are reading.