Legal

ThingsApp Privacy Policy

Last updated: April 25, 2026

This Privacy Policy describes how Umweltify (“Umweltify”, “we”, “us”) collects, uses, and protects your data when you use ThingsApp and related services in the Umweltify Digital Ecosystem. By using ThingsApp you agree to the practices described here. If you do not agree, please discontinue use of the app.

1. Who We Are

Umweltify is the controller responsible for personal data processed through ThingsApp.

2. What We Collect

We collect the minimum data needed to verify your green status and run the app:

• Account identifiers — when you sign in via Green Login: a user ID, email address, and authentication tokens issued by our identity provider.
• Device identifiers — operating system, app version, and a persistent device ID so we can attribute verified status to the correct device.
• Network signal — the Green-Fi signal we detect on your local network to confirm renewable supply.
• Electricity & emissions metrics — energy usage, location-based and market-based emissions calculated for your device.
• App usage data — basic interaction events (features used, errors encountered) used to maintain and improve the app.

We do not intentionally collect special categories of data (e.g. health, biometric, political opinions), and we do not profile you for advertising.

3. How We Use Data

1. Verify your green status and assign a climate state to your device.
2. Operate the Umweltify Digital Ecosystem — connect your verified status to ClimateIn, GEMS, and partner services so you can unlock rewards.
3. Show you insights about your energy use and emissions, and suggestions for staying green.
4. Maintain & improve the app — diagnose errors, fix bugs, plan features, and harden security.
5. Comply with legal obligations and respond to lawful requests.

We do not sell your data and we do not use it for advertising or marketing.

4. Lawful Basis

Where the EU GDPR or comparable laws apply, we rely on the following bases:

• Performance of a contract — to provide the ThingsApp service you signed up for.
• Legitimate interests — to keep the service secure, prevent abuse, and improve the product, where these interests do not override your rights.
• Consent — for any processing where consent is required (e.g. optional analytics). You can withdraw consent at any time.
• Legal obligation — where we must process data to comply with applicable law.

5. Sharing & Sub-Processors

We share data only with parties that help us run the service, under written agreements that require them to protect it:

• Identity provider for Green Login authentication.
• Cloud hosting and database providers for storing and processing your data.
• Analytics & error monitoring tools used in privacy-respecting configurations.
• ClimateIn, GEMS, and reward partners — only the data needed to grant you a verified status and the rewards you have earned.
• Public authorities when required by law.

A current list of sub-processors is available on request via hello@umweltify.com.

6. International Transfers

We operate globally, and your data may be processed in countries other than your own. Where data leaves the EU/EEA (or your local jurisdiction with similar protections), we use appropriate safeguards — such as Standard Contractual Clauses, adequacy decisions, or equivalent mechanisms — to keep your data protected to the same standard.

7. Retention

We keep personal data only as long as needed for the purpose it was collected:

• Account data — for as long as your account is active, plus a short period after closure for accounting and dispute handling.
• Device verification & status data — while your device is connected; older state is aggregated or deleted.
• Logs & usage data — typically up to 12 months, then aggregated or deleted.
• Backups — kept on a rolling schedule and overwritten in line with our backup policy.

When data is no longer needed, we delete it or irreversibly anonymize it.

8. Your Rights

Wherever you live, you may have the following rights regarding your personal data:

• Access — request a copy of the data we hold about you.
• Rectification — ask us to correct inaccurate data.
• Erasure — ask us to delete your data (subject to legal exceptions).
• Restriction — limit how we process your data in certain situations.
• Portability — receive your data in a structured, machine-readable format.
• Objection — object to processing based on legitimate interests.
• Withdraw consent — for any processing based on consent.
• Lodge a complaint with your local data protection authority.

To exercise any of these rights, email hello@umweltify.com. We will respond within the time required by applicable law (typically 30 days).

9. Security

We protect your data using technical and organizational measures, including encryption in transit and at rest, access controls, regular updates, and audit logging. No system is perfectly secure — if you believe your account or data has been compromised, please contact us immediately at hello@umweltify.com.

10. Local Storage & Cookies

ThingsApp stores small amounts of data on your device (e.g. authentication tokens, cached settings) so you do not have to sign in every time and so the app works offline. We use only the storage strictly necessary to run the service. Where optional analytics or non-essential storage is used, we ask for your consent first and you can withdraw it at any time from the app settings.

11. Changes to This Policy

We may update this Privacy Policy as the product or applicable laws change. For material changes, we will notify you at least 30 days in advance via in-app notice or email; you may close your account during that window if you disagree. Non-material edits (clarifications, formatting) take effect when published.

12. Contact

For questions about this Policy or your data, contact us:

Changelog

• April 25, 2026 — Major rewrite: honest account-data disclosure, full GDPR/global rights set, lawful basis section, sub-processor & transfer details, plain-English summary, in-page navigation.
• November 2024 — Initial Privacy Policy.