Privacy policy.
Short version: we collect as little as possible, never sell it, and tell you exactly what we have and where it is.
Effective date: the Cerloq One launch · Last updated: 27 October 2026
Who we are
Cerloq B.V. (in formation), Amsterdam, the Netherlands; KvK number and registered address follow on registration. Reach us through the contact page (choose “Privacy and your data”).
What we collect from the device
Cerloq One sends only the following to our servers:
- Indoor temperature and humidity readings (every 5 minutes)
- The hours it saved: when it switched an unused AC off, and for how long (whether someone is in the room is worked out on the device and used there; it is never sent as a live presence feed)
- AC commands: which button was sent and when (we do not measure the AC’s electricity use)
- Alerts: someone inside while you armed it, mould risk, a sensor fault
- Device health: firmware version, free memory, uptime
What we do not collect: audio, video, raw radar data, live guest presence, or anything that identifies a guest. There is no microphone or camera in the device.
What we collect from you
- Your email address, to sign in, and your name if you add it
- Each apartment’s name, its town or village, a position rounded to about 1 km and its time zone, for the weather and the clock (never a street address)
- Your AC’s model and size, and your electricity price if you add it, for the savings estimate
- Your phone’s notification token, so alerts reach it
- What you send through this website’s forms: your email and, depending on the form, your name, country, the quantity and plan you reserve, or your message
Where your data is
- Supabase, Frankfurt (Germany): the database with your account, apartments, readings and savings.
- Google Cloud, United States: the server that receives the devices’ messages and answers the app.
- Google Firebase: sign-in (Firebase Authentication) and notifications to your phone (Firebase Cloud Messaging).
- Cloudflare R2, Western Europe: nightly backups, kept 7 days, and the firmware update files.
- MET Norway: weather forecasts. It receives only a grid point near your apartment, never who you are.
- GitLab: hosts this website, fonts included: no page loads anything from a third party.
Where data is handled outside the EU, it is covered by the provider’s data-protection terms, which include the EU’s standard contractual clauses. Every message travels encrypted. Payments do not exist yet; the provider will be named here before they start.
What we never do
- Sell your data to anyone, ever.
- Share it with advertisers, brokers or third-party trackers.
- Record audio or video: there is no microphone or camera in the device.
- Show you, or anyone, a live feed of your guests: the radar’s verdict never leaves the device as one.
Cookies and analytics
This website sets no cookies and uses no trackers, analytics or advertising pixels. The web app keeps your sign-in and your settings (language, appearance) in your browser’s storage, and a copy of itself so it opens quickly: nothing that tracks you. It loads everything from our own server except Google Firebase’s code for sign-in and notifications (above).
Your rights under GDPR
You can:
- See the data we hold about you, and get a copy: ask through the contact page.
- Delete your account and everything with it, in the app (Settings). It is immediate and permanent.
- Correct anything that is wrong.
- Complain to the Autoriteit Persoonsgegevens, the Dutch data-protection authority.
How long we keep it
- Temperature and humidity readings: 30 days.
- The savings and AC history: for as long as the device is yours. Removing a device clears its history.
- Your account: until you delete it; then at once.
- What this website’s forms sent: until we have handled it, two years at most.
- Backups: 7 days.
Changes to this policy
If we change anything material, we tell you 30 days ahead. The “Last updated” date at the top of this page is the one that counts.
Contact
Privacy questions: the contact page, topic “Privacy and your data”.