Privacy policy

Eneralo processes electricity meter data and contract details in order to calculate and explain a user's electricity costs. This policy states which data are collected, the purpose of each, which processors receive them, and how a user may access or erase them.

The controller of the personal data described here is Red Mechanic AB, registration number 556178-9511, Stockholm, Sweden, which operates Eneralo. "We" in this policy means Red Mechanic AB.

Cookies

This website sets no cookies. It uses no analytics, tracking pixels, advertising or third-party scripts, and the typeface is served from our own domain. Nothing is stored on the visitor's device. Nothing you enter, on this site or in the application, is shared with anyone. The services listed below act only on our instructions and receive only what their task needs. Consent is therefore not required under the ePrivacy Directive.

The application at app.eneralo.com sets a single cookie, _enerlytic_key, which maintains the authenticated session and the selected language. It is set with the Secure, HttpOnly and SameSite=Lax attributes, is not accessible to other domains, and is not used for tracking or profiling. It is strictly necessary for the service the user has requested. If the user chooses a light or dark appearance, that choice is kept in the browser's local storage; it never leaves the device. No other cookies or client-side storage are used.

Data collected

Two categories of data are processed, depending on how the service is used.

Waiting list

• Email address — to notify the user when the service becomes available to them.
• Country — to determine which market to open next.
• The names of the grid company and electricity supplier, as entered — to determine which providers to support next.
• A record of each message sent to the address — sent, delivered or bounced — to know whether our messages arrive.

No further data are collected at this stage. No name, postal address or postcode is requested.

User account

• Email address, and the password stored solely as a bcrypt hash. The password cannot be recovered or read by us.
• Metering point identifier, as stated on the grid invoice.
• Grid tariff and supply contract, required to reconstruct the invoice.
• Postcode, if provided. This field is optional. It is used solely to determine the outdoor temperature for the surrounding area at a resolution of approximately ten kilometres. It is not used to establish a street address.
• Consumption readings uploaded by the user or retrieved on the user's instruction. These constitute the primary data the service processes.
• The files the user uploads, kept as they were uploaded, next to the readings taken from them, so they can be read again if the way Eneralo reads them is improved. Only files that were read and imported are kept. The files accepted today carry readings, a metering point identifier, invoice amounts and invoice numbers; no names or addresses.
• A file Eneralo cannot read yet, only if the user chooses to share it so that Eneralo can learn to read that kind of file. It may carry a name or an address. It is kept with the home, opened only by Eneralo's founder to build the reader, and every opening is logged. The user can remove it at any time; once Eneralo can read it, it is imported like any upload, or deleted if its kind is not one Eneralo keeps. The basis is the user's consent.
• Details about each home, if provided: a label chosen by the user, its heated area, the type of heating and the main fuse size — used to estimate the bill and to explain consumption.
• Invoices the user uploads: their periods, amounts and payment reference numbers, to check them against the consumption.
• What the user writes or chooses in the application: comments on findings, notes on changes made at home, periods away, explanations of invoice differences, and report settings.
• What Eneralo calculates from the readings — forecasts, findings, savings, comparisons. It belongs to the home and is deleted with it.

Legal basis

Each category of data is processed on one of the bases the General Data Protection Regulation provides:

• The waiting list: consent, given when the address is entered and withdrawn with the link in every message.
• Account data, readings, uploaded files, contract details, the postcode and what Eneralo calculates from them: necessary to provide the service the user has asked for — calculating and explaining their electricity costs — which is the agreement between the user and us.
• Delivery records for email and the log of administrative access to a person's data: our legitimate interest in knowing that our messages arrive and in the security of the data; neither is used for anything else.

Data not collected

The following are not requested and are not stored:

• Name.
• Street address. A site is identified by a label chosen by the user.
• Payment card or bank details.
• Credentials for the user's grid company or supplier.
• Behavioural data, usage analytics or any form of profiling.

Processors and recipients

Personal data are not sold, rented, shared for commercial purposes or used for advertising. Four processors are engaged in the operation of the service, each receiving only the data necessary for its function:

• Hetzner Online (hosting) runs the server that stores the service's data, in its data centre in Nuremberg, Germany.
• Resend (email delivery) receives the recipient address and the content of the message.
• Open-Meteo (temperature data) receives a coordinate rounded to approximately ten kilometres. It receives no postcode and no identifying information.
• OpenStreetMap (finding a position from a postcode): to compare your consumption with the weather where you live, Eneralo needs a rough position for your postcode. It first looks in its own list of postcodes; only if the postcode is missing there does it ask OpenStreetMap, sending the postcode and the country and nothing else. The position is then rounded to about 10 km before the weather is fetched.

No other party receives personal data. No analytics provider, advertising network or data broker is engaged.

Storage and location

Data are stored on a server in Nuremberg, Germany, within the European Union. Consumption readings and the uploaded files are held in a separate file for each home, distinct from account and configuration data.

How the data are protected

Consumption readings show when electricity is used in a home, and so can show when someone is at home — the same as the electricity company already knows. We protect the data as well as we reasonably can and keep improving how: every connection to Eneralo is encrypted; the server accepts only web traffic and administrator logins with a key, never a password; only Eneralo's founder can reach the data; and every time we open a person's data through our administration pages, it is recorded. We do not ask for your name. An email alias works fine: then your address tells nobody who you are.

Backups

A backup of all data is made every night. It is kept for 7 days on the server, and copied to a second machine in Sweden, run by Eneralo's founder, where each copy is kept for 30 days. After that it is deleted.

Rights of access and erasure

Under the General Data Protection Regulation, users have the right to access, port and erase their personal data. The following are available without contacting us:

• All data held for a site can be viewed within the application: the bill, findings, invoices and settings each on their own page.
• A complete export — readings, findings, invoices, prices and configuration — can be downloaded as a single file from Settings.
• Delete my account, in the application's Settings, removes the account and everything about the user's homes at once — readings, uploaded files, invoices, findings, notes and settings. It is confirmed with the password and needs no contact with us. What remains is a record that an account was deleted, with no personal data. Copies in backups disappear within 30 days as the backups are replaced; the email service keeps its delivery logs for its own limited period.
• A waiting-list entry may be removed at any time using the link included in every message sent. The link requires no password and remains valid.

A waiting-list entry is kept until the person is invited and opens an account, or removes it. An account and everything about its homes are kept until the user deletes them, which can be done at any time as described above.

Anyone who believes their personal data are handled in breach of the General Data Protection Regulation has the right to complain to the Swedish Authority for Privacy Protection, IMY: imy.se. We would rather hear about it first, at the address below.

Contact

Enquiries relating to this policy, and requests under the General Data Protection Regulation, should be directed to [email protected].

Last updated 10 October 2026. Eneralo is in early access and this policy will be revised as the service develops. No additional category of personal data will be collected without this page being updated beforehand.