← Vatra

Privacy Policy

Last updated: 3 November 2026

1. Who we are

Vatra is operated by its operator ("we", "us"), who decides why and how your personal data is used (the "controller"). Contact for any privacy question or request: vatra@vatrabox.com.

2. What we collect

Account data: username, name, email address, country, language, phone number and postal address if you give them, tax identifier if you give it, and an encrypted form of your password. House data: the configuration you enter (rooms, equipment, tariffs, schedule, approximate location used for weather and time zone), readings and states of connected devices (for example temperatures, power, energy, on/off state), decisions taken by the controller, and history of these. Device credentials you enter (for example keys for a device maker's interface) are stored so the controller can talk to your devices. Technical data: IP address, browser type and request logs on our servers, kept for security and operation. Notification data: if you enable notifications, the address that your browser's push service gives us for your device.

3. Why we use it and on what basis

To provide the service you asked for: create and secure your account, read and control your devices, compute forecasts and optimised settings, show history and savings (contract). To send service emails such as confirming your email address, resetting a password, security alerts and important notices (contract and our legitimate interest in running a secure service). To send push notifications you switched on (your consent, which you can withdraw in the application). To keep the service secure, prevent abuse and fix faults (legitimate interests). To comply with law, for example accounting and tax records, where applicable (legal obligation). We do not sell your data and we do not use it for advertising.

4. The optimisation service

To compute optimised settings, the controller sends the optimisation service a model of your house (configuration and recent behaviour), a device identifier and your account name, first and last name, email address and the house name so that the service can be operated and, where agreed, charged. It does not receive your password or device credentials.

5. Who receives data

Only the service providers we need, under their own data-protection commitments: cloud hosting and email delivery (Amazon Web Services); weather and geocoding data (Open-Meteo, which receives the coordinates or place name used for the request); browser push-notification services of your browser vendor (they receive the notification content and your device's push address); and the makers' interfaces of devices you connect, which receive the commands you or the controller send to those devices. People you share a house with can see that house's data. We disclose data to authorities only when the law requires it.

6. Transfers outside your country

Some providers may process data in other countries, including outside the European Economic Area and the United Kingdom. Where the law requires, we rely on recognised safeguards such as adequacy decisions or standard contractual clauses.

7. How long we keep it

We keep account and house data while your account exists. When you ask us to delete the account we delete or anonymise the personal data within a reasonable time, except what we must keep by law (for example billing records) or need to defend a legal claim. Server logs are kept for a limited time. Backups are overwritten on a regular cycle.

8. Your rights

Depending on where you live (for example under the GDPR or the UK GDPR) you can ask us for access to your data, correction, deletion, restriction or objection to some processing, and a portable copy; you can withdraw consent at any time without affecting earlier processing. Write to vatra@vatrabox.com and we will answer within one month. You can also complain to your data-protection authority.

9. Cookies and local storage

We use only what is needed for the service to work: a session cookie that keeps you signed in, and local storage in your browser for the chosen language and similar preferences. We do not use advertising or tracking cookies and we do not use third-party analytics.

10. Security

Passwords are stored only as salted hashes. Connections use HTTPS. Access to servers is restricted and logged. No system is perfectly secure; if a breach affects your data we will notify you and the authorities as the law requires.

11. Children

The service is not intended for people under 16 and we do not knowingly collect their data.

12. Changes

We may update this policy. The date at the top shows the latest version; for material changes we will notify you before they apply.