Privacy Policy

Datenschutzerklärung gemäß DSGVO / GDPR Privacy Notice

Last updated: 10 September 2026

1. Data Controller

Mohammed Ismail Pasha — PVMath
Straubinger Strasse 1, 93055 Regensburg, Germany
Email: contact@pvmath.com
Phone: +49 15 901 482 999

1a. Controller, Not Processor

We act as the controller for the personal data described in this policy (account data, billing contacts, support correspondence, and similar). That is the ordinary role for PVMath as a SaaS product.

The project data you store on the Platform — site coordinates, parcel boundaries, slope and terrain figures, layout geometry, capacity, yield and economic parameters — is primarily geospatial and technical. In ordinary use it does not identify natural persons. Labels or free-text fields can still relate to identifiable people in edge cases. We do not collect landowner names, addresses, or other third-party personal data as a product feature — please do not enter such data into free-text fields.

We do not design the Platform as an Article 28 processing service where customers upload third-party personal data for us to process on their documented instructions. If your organisation still requires a data processing agreement (for example for account/admin contacts or a specific contractual arrangement), contact contact@pvmath.com — a DPA is available on request. See Terms § 9b for the contractual position. Roles ultimately depend on the purposes and means of processing in each case.

Wir sind Verantwortlicher für die in dieser Erklärung beschriebenen personenbezogenen Daten (Konto, Abrechnungskontakte, Support u. ä.). Die Plattform ist nicht als Auftragsverarbeitung nach Art. 28 DSGVO für hochgeladene Drittpersonen-Daten ausgelegt. Ein Auftragsverarbeitungsvertrag ist auf Anfrage verfügbar — contact@pvmath.com; siehe AGB § 9c.

2. What Data We Collect

Account Data

When you create an account at app.pvmath.com, we collect your email address, optional name, and a hashed password. This is required to provide access to the platform.

Saved Project Data

If you save a project, we store project metadata you provide (project name, country, location label, site boundary coordinates, workflow settings, and analysis snapshots) in Supabase so you can reopen projects later. You can delete saved projects from your account.

Usage Data

We store counts of analyses and related product events for account administration, support, and product improvement. Paid plans are limited by named seats, not by analysis credits (see pricing). Legacy free accounts may still be limited to a small number of screenings without export.

Contact Form Data

If you submit the contact form on pvmath.com, we receive your name, email, company (optional), topic, and message. Submissions are transmitted via FormSubmit to contact@pvmath.com. We do not store form submissions in our application database beyond the email inbox and ordinary mail retention.

Data We Do NOT Collect

3. Legal Basis (GDPR Art. 6)

4. Third-Party Services

Supabase (Authentication, Database & Project Storage)

Account data, saved projects, and usage counts are stored in Supabase, hosted in the eu-central-2 (Zurich, Switzerland) region — a jurisdiction the European Commission recognizes as offering an adequate level of data protection under the GDPR. Privacy policy: supabase.com/privacy

Cloudflare Pages (Website Hosting)

The pvmath.com marketing website is hosted on Cloudflare Pages. Standard CDN and security logs may apply. Privacy policy: cloudflare.com/privacypolicy

Cloudflare Pages (React App Hosting)

The PVMath Pre-Engineering Automation Platform web app (app.pvmath.com) is hosted on Cloudflare Pages. Standard CDN and security logs may apply. Privacy policy: cloudflare.com/privacypolicy

Railway (API Hosting)

The PVMath API (api.pvmath.com) is hosted on Railway (Railway Corp., US). Analysis requests are processed server-side; only account and project data you save are persisted. Privacy policy: railway.app/legal/privacy

PVGIS JRC (Solar Data API)

Solar irradiation data is fetched from the EU Commission's PVGIS API. Only site coordinates (latitude/longitude) are sent — no personal data. Operated by the EU Joint Research Centre.

OpenTopoData / Copernicus DEM (Terrain Data API)

Terrain elevation data is fetched from OpenTopoData using the Copernicus EU-DEM and SRTM datasets. Only site coordinates are sent — no personal data.

Nominatim / OpenStreetMap (Geocoding)

Location search by name uses the Nominatim geocoding API, operated by the OpenStreetMap Foundation. Only search text is sent — no personal data. Privacy policy: osmfoundation.org/wiki/Privacy_Policy

FormSubmit (Contact Form)

The contact form on pvmath.com posts to FormSubmit (formsubmit.co) to route submissions to our inbox. Fields may include name, email, company, topic, and message. Privacy policy: formsubmit.co/privacy.pdf

Plausible Analytics

We use Plausible Analytics (cookieless, privacy-oriented) to measure aggregate page views and outbound link clicks on pvmath.com. No advertising profile is built. Privacy policy: plausible.io/privacy

Google Fonts

Marketing pages load fonts from Google Fonts. Your browser may request font files from Google servers; Google may process technical connection data (e.g. IP address) according to Google’s policies. Privacy policy: policies.google.com/privacy

Stripe (Payments)

Paid subscriptions may be processed by Stripe. Card details are handled by Stripe; we receive billing identity and payment status needed to activate your plan. Privacy policy: stripe.com/privacy

Brevo (Transactional Email)

Account and product emails (e.g. trial or team invites) may be sent via Brevo. Privacy policy: brevo.com/legal/privacypolicy

5. Data Retention

Account and saved project data are retained for as long as your account is active. You may request deletion at any time by emailing contact@pvmath.com. Accounts inactive for more than 24 months may be deleted automatically.

6. Your Rights (GDPR Art. 15–21)

Under GDPR you have the right to:

To exercise any of these rights, contact us at contact@pvmath.com. We will respond within 30 days.

You also have the right to lodge a complaint with the competent supervisory authority. In Bavaria, Germany: Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), lda.bayern.de

7. Security

Passwords are hashed and never stored in plain text. All data transmission between your browser and our services is encrypted via HTTPS/TLS. We do not sell, rent, or share personal data with third parties for marketing purposes.