Privacy Policy

This policy explains what personal data VoltMira processes, why, who helps us process it and what you can do about it. Our database and application servers are in the EU, we use no advertising trackers, and we never sell your data or your clients’ data.

1. Who we are

VoltMira is quoting and sales software for solar installers in Moldova and Romania. It is operated by its founder, Bogdan Toctarov, pending formal incorporation. The registered company name and address will be published here once incorporation completes. For any privacy question or request, write to voltmiraenergy@gmail.com.

We act in two roles. For installers’ own accounts and for visitors to voltmira.com, VoltMira is the controller. For the information installers enter about their clients and leads, the installer is the controller and VoltMira is their processor, acting only on their instructions.

2. What we process

• Installer accounts: name, email, company details, logo and profile photo, team roles, and either your password (stored only as a hash by our sign-in provider) or the name and email of your Google account if you sign in with Google. Billing details are collected and held by Paddle; we never see full card numbers.
• Installers’ clients: names, phone numbers, email addresses, property addresses and map coordinates, electricity consumption and bills, roof and system details, prices, proposals, notes, site photos, and the name and signature a client gives when accepting a proposal.
• People who use an installer’s website widget or chat assistant: what they type (address, monthly bill, name, phone or email, preferred survey times) and the conversation itself. Contact details go to the installer only after the person agrees to it in the chat.
• Proposal activity: when a client opens a proposal link, we record opens, time viewed, interactions with the quote (such as the battery or financing toggles), questions asked to the proposal assistant, any discount or option it recorded, and acceptance. This is shown to the installer who sent the proposal and is never used for advertising.
• Deal room documents and bank links: documents an installer files on a plant’s permit checklist are kept in private storage that only their company can read. When they share a read-only link with a bank, we record when it was opened, what was opened or downloaded, the questions asked through it, the browser type, and a keyed hash that tells one visitor from another. The IP address itself is not stored. This is shown only to the installer who shared the link.
• Connected inverter accounts: if an installer connects a Huawei FusionSolar, Solarman or Growatt account, we store its login credentials encrypted with AES-256-GCM and use them only to fetch production readings for that installer’s systems.
• Technical data: request logs, IP addresses (held briefly for rate limiting and abuse prevention) and a shortened browser user-agent string, used for security and for the “proposal opened” alert.
• Visitors to voltmira.com: aggregate page statistics collected without cookies. An address typed into the homepage roof check is used only to answer that check and is not saved.

3. Why we process it, and on what legal basis

We rely on the EU General Data Protection Regulation (GDPR) and, in Moldova, Law no. 133/2011 on personal data protection.

• Providing the service you signed up for (accounts, quotes, proposals, alerts and support): performance of our contract with you.
• Processing your clients’ and leads’ data on your instructions: our contract with you as your processor (GDPR Article 28). The lawful basis for collecting that data is yours, as its controller.
• Keeping the service secure (rate limiting, bot protection at sign-in, error monitoring): our legitimate interest in a safe, working service.
• Billing and tax records: legal obligation.
• Measuring how the website is used, in aggregate and without cookies: legitimate interest.
• Service emails (proposal alerts, invitations, password resets): contract. We send no marketing email without your consent.

4. AI features

Some features use Claude, an AI model provided by Anthropic, through Anthropic’s commercial API:

• Bill reading: a photo or PDF of an electricity bill is sent to Anthropic to read the consumption, meter number and supplier. VoltMira does not store the file, and the installer reviews the result before it is applied.
• Energy yield studies: when a user reads a wind or solar study from its PDF, the browser picks the pages with the energy results and only their text is sent to Anthropic to read the figures (for a scanned study, only the pages the user chose). VoltMira does not store the file, and the user reviews every value before it is applied.
• Parts list: the installer’s description of a system and their own catalog are sent to draft a bill of materials.
• Proposal assistant: a client’s questions and the figures from that proposal are sent to answer them. If the installer turns on negotiation, the assistant may record a discount or one of the alternative options the installer attached, but only within limits the installer set, and our server checks every such offer against those limits.
• Lead assistant: messages on the installer’s website chat or Telegram bot are sent to answer the homeowner and prepare an estimate.

Under Anthropic’s commercial terms, data sent through its API is not used to train its models. The assistants say they are AI, and none of them makes a decision with legal or similarly significant effect on anyone: prices, contracts and site surveys are confirmed by the installer.

5. Who helps us

These providers process personal data for us, each only to deliver its part of the service and under its own data processing terms:

Only when an installer connects them:

6. Where your data is, and transfers outside the EU

Our database (Supabase) and application servers (Vercel) are in the EU, in Stockholm, Sweden. Some providers are based outside the EU, notably Anthropic, Resend and Sentry in the United States and Paddle in the United Kingdom. Where personal data leaves the EU, the transfer relies on an adequacy decision of the European Commission (such as the one for the United Kingdom, or the EU-US Data Privacy Framework for certified companies) or on the Commission’s Standard Contractual Clauses. Write to us for a copy of the safeguards that apply.

7. How long we keep it

• Account and workspace data, including clients, leads and proposals: while the account is open, then deleted within 30 days of closing it.
• Proposal activity: up to 24 months, then deleted.
• Leads from the chat assistant, with the summary it prepared: in the installer’s workspace until the installer deletes them or closes the account.
• Bill files sent for reading: not stored by VoltMira.
• Live demo workspaces: sample data only, deleted automatically after a short period.
• Rate-limit counters: expire automatically within a day at most.
• Billing records: as long as tax law requires; Paddle keeps them as merchant of record.
• Backups: a rolling 30-day window.

8. Cookies and local storage

We use no advertising or tracking cookies. The only cookies set are strictly necessary: keeping you signed in, completing a purchase with Paddle, and bot protection at sign-in. Your theme and language choices are remembered in your browser’s local storage and never leave your device. See the Cookie Policy for the full list.

9. Your rights

You can ask to access, correct, delete or export your personal data, to restrict or object to its processing, and to withdraw any consent you gave. Account owners can delete their account and all its data at any time from Settings. For anything else, write to voltmiraenergy@gmail.com; we reply within one month.

If you are a client or lead of an installer who uses VoltMira, the installer controls your data, so please contact them first. We will help them answer you, and if you write to us directly we will pass your request on.

You can also complain to a data protection authority: ANSPDCP in Romania, the National Center for Personal Data Protection (CNPDCP) in Moldova, or the authority where you live in the EU.

10. Security

Data is encrypted in transit (TLS) and at rest. Each company’s data is isolated with row-level security, service keys follow least privilege, credentials for connected accounts are encrypted with AES-256-GCM, and backups run daily. No system is perfectly secure; if a breach puts your data at risk we will tell affected account owners and the competent authority as the law requires.

11. Children

VoltMira is a business tool and is not directed at children under 16.

12. Changes to this policy

We will email account owners at least 14 days before any material change. The date at the top of this page always shows the current version.