PRIVACY

Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Dr. Alexander Mackensen
Wieslinger Weg 3
71116 Gärtringen
Germany
Email: hallo@gw4.me

Access data and server log files

When you visit this website, our provider automatically collects information about your visit and stores it in so-called server log files. This includes, in particular, browser type and version, operating system used, referrer URL, host name of the accessing computer, time of the server request and the IP address. This data is not assigned to specific persons. This data is not merged with other data sources.

Legal basis is Art. 6 (1) lit. f GDPR (legitimate interest in the technically error-free and secure operation of the website).

Contact enquiries

When you contact the provider (for example by contact form or email), the information provided will be stored for the purpose of handling the enquiry and in case follow-up questions arise. This data will not be shared without your consent.

Legal basis is Art. 6 (1) lit. b GDPR (contract initiation) or Art. 6 (1) lit. f GDPR (legitimate interest in responding to the enquiry).

Hosting

This website is hosted on the servers of an external provider. Personal data collected on this website is stored on the hoster's servers. The processing is carried out for the purpose of secure, fast and reliable operation of the website.

Legal basis is Art. 6 (1) lit. f GDPR. A data processing agreement pursuant to Art. 28 GDPR is in place with the hoster.

Contact form

The contact form on this website transmits nothing to us and nothing to anyone else. Your browser assembles the fields you fill in (name, email address, organisation if provided, message) into a prepared email draft and hands it to your own email program. There is no transfer to a service provider, no transfer to a third country and no storage on this website.

Your details are processed only once you send the message yourself and it arrives in our mailbox at our email provider. We use them solely to handle your enquiry and keep the correspondence for as long as this is necessary for handling it and for meeting statutory retention obligations.

Legal basis is Art. 6 (1) lit. b GDPR (contract initiation) or Art. 6 (1) lit. f GDPR (legitimate interest in answering enquiries). Until 26 August 2026 the form was operated through the service FormSubmit (Devro Labs, USA); that integration has been removed without replacement.

Account creation, password login and sign-in via email link

The standard login for the app app.gw4.me uses your email address and a password. We store your password exclusively in cryptographically hashed form (technical and organisational measure pursuant to Art. 32 GDPR); it is never stored or displayed in plain text. In addition, we offer sign-in via a one-time link that we send to you by email; this is a convenience option and is technically the same link as the confirmation link used during account creation. When you enter your email address on the sign-in page and request the email link, we process the following data:

• Email address — as the identifier of your account.
• IP address — to detect spam and to enforce the rate limit (3 requests per email/hour, 20 per IP/hour).
• Timestamp of the request and of the later use of the link — for security and audit purposes (single-use protection).

How your account is created: As soon as you submit your email address and it is not yet known to us, we create an as-yet-unconfirmed account (email as identifier, initially without a password). We send a confirmation link to that address. By clicking the link you demonstrate access to the mailbox, the account is deemed confirmed and you are signed in for the first time (double opt-in: the active entry and the active link click are the two confirmation steps). You then set a password of at least 12 characters, which completes account creation. A password must be set in order to sign in via the regular password page.

Storage period:

• Unconfirmed accounts (the confirmation link was never opened and no password was set) do not permit sign-in. They remain stored until deletion takes place; you may request deletion at any time, informally, at hallo@gw4.me (Art. 17 GDPR).
• Identifiers of links that have already been used are stored to prevent them from being used again.
• Active accounts remain in place until you request deletion or delete the account yourself.

Legal basis: Art. 6 (1) lit. b GDPR (contract initiation and performance) and Art. 6 (1) lit. f GDPR (legitimate interest in spam and abuse protection for the rate limits).

Security properties of the link: The confirmation and sign-in link is valid for 10 minutes, can be used only once and is HMAC-SHA-256 signed. A separately requested link to reset your password is valid for 1 hour for security reasons. If you lose access to the email mailbox on file, please contact hallo@gw4.me.

Shared use and invitations

Anyone who operates a GRIDWORK system (main user) can invite other people as co-users — by QR code or by email to an address that the main user gives us.

What we process: the system, the access level (“View” or “View and change settings”), who sent the invitation, the invitation route, points in time and — only for an email invitation — the email address of the invited person. We do not store the invitation code itself, only an irreversible fingerprint of it.

Source of the address: the email address of an invited person comes from the main user. The main user assures us that they may give it to us for this purpose.

Purpose and legal basis: towards the main user and the co-user we perform the contract (Art. 6 (1) lit. b GDPR). We process the address of an invited person who does not yet have an account on the basis of our legitimate interest in delivering the invitation requested by the main user (Art. 6 (1) lit. f GDPR) — solely for that purpose, never for advertising. There is no reminder or follow-up email.

What becomes visible: the main user sees when and for how long a co-user charges at their system and how much electricity they draw. Other co-users do not see this. Co-users do not see individual charging sessions of other people.

Storage period: an invitation by QR code is valid for one hour, by email for seven days. We delete the email address as soon as the invitation has been accepted, declined or withdrawn, and no later than one day after it expires; we remove the invitation itself after 30 days. Who has access, since when and granted by whom remains visible to the main user as a record. When access ends, the charging sessions of the former co-user are no longer attributed to them for anyone; the energy quantities remain as a total at the system.

Recipients: we send the invitation email via our email service provider (see “Hosting” / “Email notifications”).

Your rights: invited persons may object to the processing at any time and request access or erasure; otherwise the section “Your rights” applies. A message to hallo@gw4.me is enough.

Email notifications

In your account at app.gw4.me you decide per occasion whether GRIDWORK gets in touch (system not reporting in, charging session failed, monthly report, product news). We store your choice per occasion and route, the time of your last decision and — for product news — the time of your consent. Delivery goes to the email address you confirmed.

Legal basis: Art. 6 (1) lit. b GDPR (operational messages as part of the service) and Art. 6 (1) lit. a GDPR (consent for product news, withdrawable at any time). Retention: until you change your choice or delete your account.

Browser messages (push notifications)

In addition to email you can have messages shown in your browser. This feature is optional and off by default. It only becomes active once you explicitly agree in your account and your browser then grants permission. There is no pre-ticked box.

What we store:

• The delivery address (endpoint) of your browser — the address the delivery service uses. It contains an identifier of your device or browser profile.
• Two subscription keys (p256dh and auth) — we use them to encrypt the message content so the delivery service cannot read it.
• Timestamps of setup, of your consent and of the last successful delivery.

We explicitly do not store a browser identifier (user agent), IP address or device name for this purpose — they are not required for delivery (Art. 5 (1) lit. c GDPR, data minimisation).

Purpose: solely to deliver the messages you selected. No audience measurement, no profiling and no advertising takes place over this route.

Recipients: The message is delivered via the push service of your browser's maker — depending on the browser Google (Firebase Cloud Messaging, Google Ireland Ltd./Google LLC), Mozilla (Mozilla Corporation), Apple (Apple Inc.) or Microsoft. That service learns the delivery address and the time; the content is encrypted for it (end-to-end per RFC 8291). Depending on the maker, a transfer to the USA may take place, based on standard contractual clauses or the EU-US Data Privacy Framework adequacy decision. The message content holds no personal data: only the occasion, a fixed message text and the link to your account are transmitted.

Retention: until you withdraw, at the latest until your account is deleted. If the delivery service reports that the subscription no longer exists (for example because you revoked permission in the browser or deleted the browser profile), we delete the entry automatically.

Withdrawal: at any time in your account under “Notifications” via the Withdraw and delete button. Withdrawal deletes the stored entry immediately and completely; it does not merely mute it. You can additionally revoke the permission in your browser settings. The lawfulness of processing carried out up to that point remains unaffected.

Legal basis: Art. 6 (1) lit. a GDPR (consent) and § 25 (1) TTDSG for accessing information on your device. Without your consent nothing is stored and nothing is delivered.

Connection to your electricity supplier (Tibber)

If you have an electricity contract with Tibber, you can store your personal Tibber access token in the app app.gw4.me under Systems › Charging › “Electricity tariff” (tariff type “dynamic”). This is optional; without it, the app uses the exchange price plus your surcharge, your entered tariff, or no electricity price. Only the main user of the system can store and remove the token. People you have invited to your system only see whether and since when a token is stored, and the electricity prices the system plans with — they never see the token itself.

Purpose: we use it solely to read the electricity prices of your Tibber contract for today and tomorrow, to plan your vehicle's charging into the cheap hours and to estimate the cost. The token would technically also give access to further data at Tibber (such as your consumption, address or name); we do not request or store it.

What we store: the token — encrypted, assigned to your system — and the time it was stored. We keep the retrieved prices in memory for at most 15 minutes. The token never appears in plain text in any display, log or data export; our support only sees whether one is stored.

Recipient: for each request we send the token over TLS to Tibber's interface (Tibber Deutschland GmbH, Strelitzer Str. 60, 10115 Berlin, Germany). Tibber learns that and when GRIDWORK retrieves prices of your contract. Tibber is itself responsible for processing your data at Tibber.

Retention and deletion: until you remove it on the “Electricity tariff” card in the line “Tibber access token stored” with “remove”, until you are no longer the main user of the system, or until your system is deleted. If you transfer your system to another person, we delete your token immediately — it belongs to your electricity contract and does not pass to the new person; they can store their own. If you delete your account, we delete the token at the latest 30 days after the account deletion: together with the system if you were its only user, otherwise on its own. You can also revoke the token at Tibber at any time; the app then receives no prices and calculates without them.

Legal basis: Art. 6(1)(b) GDPR.

Weather data for the PV forecast

If you have stored a location for your system in the app app.gw4.me, GRIDWORK uses it to calculate a forecast of your PV generation for the day. For that the app needs an estimate of the solar radiation at your location. Our server obtains this from the service Bright Sky (brightsky.dev), which provides weather data of the Deutscher Wetterdienst (DWD, German Meteorological Service).

Alternative source: instead of Bright Sky we can set the weather service Open-Meteo (OpenMeteo GmbH, Bürglen, Switzerland), for example if Bright Sky fails permanently. Only one of the two services is set at any time; a switch does not happen by itself. Everything in this section applies to Open-Meteo in the same way.

What is transmitted: only a rounded location coordinate of your system. We round it to two decimal places, which corresponds to a grid of roughly one kilometre. We store the coordinate you enter only in this rounded form, and only in this rounded form is it sent to the weather service. Not transmitted are your address, your name, your email address, any customer or device identifier, and your IP address — the request is made from our server, not from your browser.

Purpose: calculating the day-ahead forecast for your photovoltaic system and, derived from it, the charging suggestions. Without a stored location we produce no forecast and transmit nothing.

Storage period: we keep the weather service's reply only in the working memory of our server, assigned to the rounded coordinate, not to your account, and not in a database. After 10 minutes we fetch it anew; if the weather service fails, we keep using the last reply for at most three hours and mark it as outdated. We store the location coordinate of your system for as long as you keep it on file — you can change or remove it at any time in the settings under “Location of your system”; it is removed when your account is deleted (for backup copies see Encryption).

Source attribution: Data basis: Deutscher Wetterdienst, own elements added. GRIDWORK converts the irradiance forecast into an expected PV output. Licence and details are in the imprint under “Sources”.

Recipients: Bright Sky (brightsky.dev) is a free access point to the open data of the Deutscher Wetterdienst, run by an individual. Open-Meteo is operated by OpenMeteo GmbH in Switzerland; the European Commission has adopted an adequacy decision for Switzerland. Bright Sky does not state where its servers are located or whether it logs requests. For that reason we send it only the rounded coordinate. The recipient also sees the internet address of our server, not yours. We have no data processing agreement with either service because they receive no data that makes you identifiable.

Legal basis: Art. 6(1)(b) GDPR — the forecast is part of the service you requested, and for it we process the location you have stored. For the request to the weather service, the short-term cache and the alternative source we also rely on Art. 6(1)(f) GDPR: our legitimate interest is a reliable location-based PV forecast. We protect your interests by sending only a coordinate rounded to about one kilometre, without any identifier of your person, by not storing it assigned to your account, and by letting you remove the location at any time, which ends the requests. Bright Sky and Open-Meteo are not our processors but recipients of a request that does not make you identifiable. Should another weather service be added or the procedure change, we will change this section beforehand.

AI assistant in the app

Signed-in customers can use a chat assistant in the app app.gw4.me. It is built on a large language model. Using it is entirely optional: if you never open the chat, no data is processed along this route. Before you send your first message we tell you that you are writing to a machine, and an “AI” marker stays visible throughout the conversation (Art. 50 of Regulation (EU) 2024/1689, the AI Act).

Your consent: Before you use the assistant for the first time, we ask for your explicit consent in the chat. Without it the assistant stays locked and nothing is sent to the provider of the language model; everything else in GRIDWORK works as before.

Purpose: answering your questions about your account, your devices and charging optimisation. The assistant cannot change or switch anything on your installation — it has no access to the charging control. Safety questions, billing questions and faults you report are handed to a human; how your question reaches us in that case is described under “Retention” below. Detection works from a fixed list of keywords, not from understanding what you mean — so a question may be handed to a human even though you did not intend that. No automated decision with legal effect within the meaning of Art. 22 GDPR takes place.

What is sent to the provider:

• the text of your question,
• up to six previous messages of the same conversation — your questions and the assistant's answers, which may contain values from your system, such as the current surplus,
• excerpts from our knowledge base — general help texts, no customer data.

What is not sent: the readings of your installation shown on the dashboard (generation, surplus, state of charge, vehicle status), the list of your devices, your account name and your email address. That data is evaluated on our own server only.

What we remove first: email addresses, IBAN, phone numbers, postal addresses, postcode and town, coordinates, vehicle registration numbers, your surname and passwords, PINs and access keys are replaced by fixed markers; these values do not come back. Device identifiers are replaced by a numbered cover name ([GERAET-1]). The mapping exists only in memory for that single request and is written back into plain text in the answer — otherwise the assistant could not refer to your device by name.

Please note: this is a pattern filter, not anonymisation. Anything you write freely that does not match one of those patterns is passed on. Numeric readings such as kilowatt hours, kilowatts or percentages are deliberately left in plain text, because otherwise your question could not be answered. So please do not type anything into the chat that you would rather not have transmitted; for everything else you can reach us at hallo@gw4.me.

Recipient: The recipient is the provider of the language model, Anthropic. Processing also takes place in the USA. The transfer is encrypted (TLS) and goes directly from our server to the provider's interface. One further recipient is added if your question is handed to a human: it then reaches our mailbox through our email provider, 1&1 IONOS SE, Montabaur, Germany (a processor under Art. 28 GDPR, servers in Germany). Details under “Retention” below.

Basis for the transfer to the USA: There is no adequacy decision for the USA that we rely on. We use the provider through a commercial access (API). Its terms incorporate a data processing agreement under Art. 28 GDPR that contains the EU standard contractual clauses (Art. 46(2)(c) GDPR). In addition, the transfer is based on your explicit consent (Art. 49(1)(a) GDPR), which we ask for before first use. The level of data protection there is not the same as in the EU: access by US authorities cannot be ruled out, and enforcing your rights may be harder than within the EU.

What remains open: Our own transfer impact assessment and the data protection impact assessment exist as drafts and are not yet signed. The provider-side opt-out from storage (“Zero Data Retention”) is not yet active. We will complete both by 31 December 2026. We state this openly so that you can decide for yourself whether to use the assistant.

Retention:

• Record of your consent: We store that and when you consented or withdrew — with your customer ID, your account, the time and the version of the text you agreed to, never the content of your conversations. We keep it for 12 months after your account is deleted, blocked for any other use, then delete it.
• Record of the AI disclosure: as soon as you open the chat — that is, before your first message — we record in our security log that the notice about the use of AI was shown to you: the time, a keyed checksum of your account name (cannot be reversed without our key), your customer identifier, the session identifier, an identifier of the notice text shown, and one truncated checksum each of your IP address and your browser identification. We do not store your account name, the IP address or the browser identification themselves, and the content of your conversation is not recorded there either. We delete each entry 12 months after it was made. Entries made before 17 October 2026 still contain your account name itself; they too are deleted 12 months after they were made.
• With us: the conversation is not stored permanently on our servers. We only record contentless metadata — time, account, where the answer came from and how many turns were involved, never the text of your message. It is different when your question is handed to a human (safety, billing, or a fault you have reported): in that case we send the text of your question — in the minimised form described above — together with your customer identifier by email to our own mailbox hallo@gw4.me — safety questions to our own security mailbox sicherheit@gw4.me — so that a person can answer it. That email is held by our email provider (1&1 IONOS SE) and is kept for as long as we need it to handle your request and to meet statutory retention duties — it is therefore stored permanently, unlike the conversation itself. In addition we keep the minimised question as a fault hint in memory (at most 500 entries, visible to operations only, lost when the service restarts). For questions about safety we base this email on our legitimate interest in averting a danger to persons or property that you have described (Art. 6(1)(f) GDPR); for billing questions and reported faults on the performance of our contract with you (Art. 6(1)(b) GDPR) — not on your consent to the assistant.
• In your browser: the visible history is kept in your browser's sessionStorage so that it survives navigating between pages. We clear it when you sign out; at the latest it is discarded when you close the browser tab. If you share a device with others, please close the tab once you are done.
• With the provider: the provider-side opt-out from storage (“zero data retention”) is not yet active. How long the provider keeps transmitted content therefore follows the provider's terms as in force at the time; we have not separately agreed any shorter period beyond that. The storage limitation applying there is the term of our agreement. Within 30 days of its end the provider must delete all customer data — including copies held by its subprocessors; excepted is data it must retain by law, needs to resolve a dispute with us, or needs to combat harmful use of the service (Section H of the data processing addendum, version of 24 February 2025). Whether and how the provider uses transmitted content to train its models likewise follows those terms; for the commercial access we use, the contract provides for processing only in order to deliver the service.

Withdrawal: Consent is voluntary. You can withdraw it at any time with effect for the future — in the assistant via “Withdraw consent” or in your account under “Privacy” → “AI assistant”. The assistant is then locked again; processing up to that point remains lawful. Deleting your account counts as withdrawal. In so far as we rely on a legitimate interest, you may object to the processing at any time under Art. 21 GDPR — informally at hallo@gw4.me. Your other rights to information, rectification, erasure, restriction, data portability and to lodge a complaint with the supervisory authority remain unaffected; see the section Your rights.

Legal basis: Art. 6(1)(a) GDPR (your consent) for the transfer to the provider; for the transfer to the USA Art. 46(2)(c) and additionally Art. 49(1)(a) GDPR; for the record of consent Art. 7(1) with Art. 6(1)(c) GDPR; for abuse protection and cost limits Art. 6(1)(f) GDPR; for the AI disclosure log Art. 6(1)(c) GDPR with Art. 50 of the AI Act and Art. 6(1)(f) GDPR. Since 13 June 2026 the assistant has processed customer conversations via this provider, since 9 October 2026 only with consent.

Access by support (admin session takeover)

When you ask us for support, or when we need to clarify a technical case on your account, a team member with global admin rights may temporarily switch into the view of your account (session takeover). Its only purpose is support — for example to reproduce a fault you reported.

Viewing and settings — nothing else: during a takeover, our team can view your account and change settings of your installation that you can also change yourself — for example the name and location of the system, your tariff details, details for the charging plan or the settings of a device. Technically blocked remain charging commands to your wallbox (start, stop, charging current, charging mode, phase switching), any deletion, changes to your account (for example password, email address, consents), to access and rights, as well as pairing and unpairing devices. If your account only has read access to a system, our team cannot change anything there either.

Time-limited: a takeover lasts at most 30 minutes and then ends by itself. Our team states a purpose before every takeover and can end it earlier at any time.

What we record: the start and end of every takeover, and every setting our team changes during it, are recorded in your own customer log (category “impersonation”): the time, the acting admin account, the stated purpose and, for a change, the setting concerned with its old and new value (passwords and keys never appear there, only the note “hidden”). As the main user, you can view these entries in your account under “Log”. In addition, we keep a separate, internal operations log of the same event (admin, affected account, purpose, time). If one of these entries cannot be written, the takeover does not take place or the change is not carried out — there is no silent access.

Retention: the entry in your customer log is deleted after 36 months, the internal operations entry after 180 days.

Legal basis: Art. 6 (1) lit. b GDPR (support as part of the contractual service) as well as Art. 32 GDPR and Art. 5 (2) GDPR (accountability for this access); for the logging itself additionally Art. 6 (1) lit. f GDPR (legitimate interest in traceable, secure support access).

Cookies

This website does not use tracking or analytics cookies, no audience measurement, no profiling services and no advertising networks. Only strictly necessary cookies are used, required for operating the login area (app.gw4.me):

• gw_session — session identifier, signed, HttpOnly, SameSite=Lax, domain .gw4.me. Validity: 8 hours when you sign in from a device unknown to us. On a device you have already signed in from successfully, the sign-in lasts up to 400 days; if you use that device regularly, the period is renewed in the background so that you do not have to sign in again and again.
• gw_device — recognition of a device you have already signed in from. Signed, HttpOnly, SameSite=Lax, domain .gw4.me. Validity: 400 days. The cookie does not sign you in — it only carries the statement “this device has signed in with this account before”, and only that statement unlocks the long period above. For this we store your sign-in name, a random device identifier and the point in time. When you sign out, we remove the recognition for that device.
• gw_role — role marker (user or admin) used solely to control the navigation (e.g. the admin menu). SameSite=Lax, domain .gw4.me. Contains no personal data.
• gw_imp — set only during a session takeover by support (see Access by support) and only in the browser of the acting admin, never for customers: signed identifier of the takeover (admin account, affected account, purpose, start, expiry), HttpOnly, SameSite=Lax, domain .gw4.me. Validity: duration of the takeover, at most 30 minutes; it is deleted when the takeover ends.
• gw-theme — stored locally (localStorage) for the chosen appearance (Sunrise / Moonrise), not transmitted as a cookie.

Legal basis: § 25 (2) No. 2 TDDDG (strictly necessary for the service you expressly requested) or Art. 6 (1) lit. f GDPR. The long period on recognised devices serves your convenience and your security alike: an unfamiliar or fresh device deliberately stays on the short period of 8 hours.

Encryption

This website uses SSL/TLS encryption for security reasons and to protect the transmission of confidential content. An encrypted connection is indicated in the address bar of the browser.

Reporting a security vulnerability: if you have found a security vulnerability, please write to sicherheit@gw4.me; the procedure is set out in our vulnerability disclosure policy.

Backup copies: so that nothing is lost after an outage, we back up the app’s data regularly and in encrypted form. A deleted entry may therefore still be contained in a backup copy for up to 12 months; we only read from it to restore operation after an outage.

Your rights

You have the right to free information about your stored personal data, its origin and recipients, and the purpose of the data processing (Art. 15 GDPR) as well as the right to rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), objection (Art. 21) and data portability (Art. 20). In addition, you have the right to lodge a complaint with the competent data protection supervisory authority.

Contact for privacy matters

For privacy-related enquiries please contact: hallo@gw4.me