Privacy Policy

Elvy AB (company reg. no. 559435-0737) is the controller for the processing of your personal data and is responsible for ensuring it complies with applicable data protection law, in particular the EU General Data Protection Regulation (GDPR).

This policy applies when you visit our website or use the Elvy app, submit an expression of interest or become a customer, when one of our sales partners or a friend refers you in the app, when a company applies to become an installation partner, and when you apply for a job with us. If you have questions about how we process your data, you can reach us using the details below.

When you submit an expression of interest or sign up for a subscription, we collect the details you provide: name, address, email and phone number. We use them to prepare a proposal, contact you and deliver the service. The details are stored in our lead database with Google Cloud (Firestore, within the EU) and are then handled in our CRM (HubSpot). We also send a confirmation to your email address via our email provider (Resend).

To tailor your proposal, we retrieve information about your home, such as property type and address details, from external property and address sources based on the address you enter.

When you submit an expression of interest, we may use an automated tool to sort expressions of interest by the details you gave in the form, such as house type and electricity use. This only affects the order in which we contact you. It never affects your price, your terms or whether you get an offer. The tool is provided by a data processor in the United States. It receives only those form details, never your name or contact details, and the transfer is protected by the European Commission's standard contractual clauses.

If one of our sales partners passes your details on to us, for example during a visit to your door, the salesperson fills the details in together with you on the spot: name, address, phone number and email address, plus details about the house such as heating, roof, solar panels, annual consumption and main fuse. You can also take a photo of the grid bill, which is then uploaded to our platform provider (Vercel, within the EU) at an address that cannot be guessed. The salesperson asks for your consent before the tip is submitted. After that the tip is handled as an expression of interest: it is stored in our lead database with Google Cloud (Firestore, within the EU) and announced internally in our work chat (Slack), and you receive an email from us. The salesperson receives a copy of the tip via our email provider (Resend) if they work for one of our partner companies. If the database cannot take the tip, it is sent to our inbox instead, so that it is not lost.

If you apply to become an installation partner, we collect details about the company (company name, registration number, office address, credentials and information about the business) and about the contact person (name, role, email address and phone number). What you enter in the first step is saved as you continue, that is before you tick the box in the final step, so we can follow up even if the application is never submitted. The legal basis is legitimate interest: being able to respond to a started application from a company. The application goes to our inbox via our email provider (Resend), is announced internally in our work chat (Slack) and may be passed on to the receiving system we use for partner applications.

If you apply for a job with us, we collect what you enter in the application: name, email address, phone number, cover letter and CV. Which fields are required depends on the role. The application is stored in our recruitment system (Teamtailor), where the people hiring for the role read it. The CV file is first uploaded to our platform provider (Vercel, within the EU) at an address that cannot be guessed, so Teamtailor can fetch it. Please avoid sensitive information, such as health, in the cover letter.

In the final step of the application you draw your service area on a map loaded from Google Maps. Google then receives your IP address and what you search for in the map. If you would rather not use the map, you can describe the area in words in the field below it.

The Common questions and Customer service pages carry a film hosted on YouTube. The film is not loaded until you press play yourself. If you do, it is fetched from YouTube (Google), which then receives your IP address and information about your device, and may store data on your device. That happens under Google’s own responsibility as a controller, not as a processor acting for us. If you would rather avoid it, simply leave the film alone: the same questions are answered in text on the page.

When you use the website we collect, with your consent, usage data via our analytics tool (PostHog) to understand how the site is used and improve it. This includes page views and events, recordings of how you navigate and interact with the site (session replays), and heatmaps of where visitors click and move. No such collection happens before you have given your consent. Data strictly necessary for the website to function is always processed.

If you close the quote form without sending it, after getting some way in, we may ask why. We ask only once, and only if you have consented to analytics. If you answer, the answer is stored in PostHog with the other analytics data. Email addresses and phone numbers are removed from the text before it is sent, but it is best not to write anything else that identifies you.

If you have consented to analytics and arrive from an ad, PostHog stores the ad's click ID (for example from Meta, Google or TikTok). If you have consented to marketing as well, PostHog also stores the ID the Meta pixel sets for your browser. That lets us see which ads lead to an expression of interest. If you withdraw your consent to marketing, we stop storing the pixel's ID and remove Meta's cookies on our site, but what has already been stored stays in PostHog.

If you consent to marketing, we also use advertising cookies via the Meta pixel (Facebook and Instagram), the Google tag (Google Ads) and the TikTok pixel and, when you submit an expression of interest or an installer application, send a conversion event to Meta, Google and TikTok to measure and improve our advertising. Your email address, phone number and name are first converted into pseudonymised codes (hashing) so they cannot be read as plain text. The Meta pixel and the TikTok pixel also read the contact details typed into the forms on the website themselves, even before a form is sent, and turn them into hashed codes in the browser before passing them on (automatic matching). Exactly what each platform receives is set out under “Cookies, analytics and marketing” below. No such collection or sharing happens before you have consented to marketing.

Anyone can download the Elvy app. You log in with your phone number and a code we send by text, so we process your phone number and details about your device to let you in and keep you signed in. If you are a customer, the app shows your subscription. If you are not, the referral part is what you get.

For customers, the app shows the details we already hold: name, address, contact details, what you pay, how long you have been a customer, and your personal identity number, which we show partly masked. The identity number identifies you against your subscription and nothing else. We collect no identity number from you if you are not a customer.

The app also shows your energy allowance, meaning the electricity included in your subscription, and how much of it you have used. The figures come from the equipment we run in your home, such as the heat pump and the solar panels. We receive measurement and operating data from the equipment continuously and can adjust it remotely, because that is how the subscription works. Data like that says something about when someone is home, so we use it only to deliver and run the subscription.

If you want to refer someone, you pick contacts from your phone book. Only the phone numbers of the contacts you tick leave the phone. The names stay on your phone. The numbers are stored with us, so we know which referral is yours and can pay the right person. If you do not share your whole phone book with us (see below), the rest is never sent to us. You send the text message yourself, from your own phone, in its ordinary messaging app. We send no messages in your name.

You can let us sort the list for you. The app then shows a screen of its own, right before the phone's usual prompt, and asks whether you want to share your whole phone book with us. Say yes and we get the phone numbers, without names. We compare them with referrals other users have already sent. If someone in your phone book has referred someone else in your phone book, that second person moves up your list. Highest of all goes to anyone an Elvy customer has referred. The idea is that they say yes more often, and the bonus only comes when someone does. It is optional. You can share your whole phone book or only the contacts you choose, and you change that under Settings → Elvy → Contacts. We never show others who you know, and we never show who already has Elvy either. Say no and the rest of the referral part works exactly as before. If you change your mind, withdraw your consent with a button in the app, by turning off the app's access to your contacts, or by emailing kundservice@elvyenergy.com. We then delete the numbers you shared.

This also applies to you if you are in someone else's phone book. If that person has shared it with us, we have your number, and you did not know. We use it only to sort that person's list, and we keep it for up to 12 months. If you want us to delete the number, telling us is enough.

If you refer someone, that can move them up the list of other people who have you both in their phone book. If you are a customer, it counts for more. Neither you nor the person you referred is told when that happens.

If someone refers you in the app, we receive your phone number from them, nothing more. We do not receive your name. The person referring you confirms they asked you first. When we get in touch we say who we are, that the details came from a named friend, and where to find this policy. If you would rather not be contacted, or want us to delete the details, telling us is enough.

The app has a leaderboard showing how much different users have referred. It shows a nickname and an amount, not your name, so you can compare yourself with others without others seeing who you are.

To pay out a referral bonus we need your name, address and bank details, which you fill in under your profile. We use them for the payment and for our accounts. We pay out the full amount with nothing deducted, and you declare it yourself to the Swedish Tax Agency.

The app can send push notifications about your subscription and your referrals. If you would rather not have them, you turn them off in your phone settings. You also reach customer service by phone and email from the app, and that contact is handled as ordinary customer contact.

The first time you open the app, we ask whether you want to help us improve it. You choose Godkänn (Accept) or Neka (Decline). If you choose Neka, the app sends no data to our analytics tool (PostHog). If you choose Godkänn, the app sends usage events, such as which screens you open and which buttons you tap, masked screen recordings, crash reports and your approximate location. In the screen recordings, text and personal data on the screen are hidden, so we cannot see them. The crash reports show what went wrong when the app crashed. We work out the location from your IP address, and it only shows roughly where you are, such as which city.

The data is linked to your username. PostHog stores it in the EU. We do this to find faults and make the app easier to use.

You decide. You can turn the analytics off at any time: go to Profil (Profile) and turn off Analys (Analytics). The app then stops sending data straight away. If you delete your account, we also delete your data at PostHog.

You can delete your account in the app. We then remove the account and the data belonging to it, apart from what we are required by law to keep, such as the record of a payment we have already made. How to delete your account, even if you have already uninstalled the app.

Contract: where processing is necessary for us to deliver a subscription you have signed up for, which includes running the equipment in your home and showing your details in the app, or to take steps prior to entering into an agreement.

Steps before a contract: when you apply for a job with us, we process your details to assess your application and contact you.

Legitimate interest: to respond to your expression of interest, tailor your proposal, sort expressions of interest and develop our services, following a balancing test against your privacy.

Consent: for analytics of website usage via cookies, for analytics in the app and for marketing (advertising cookies and conversion measurement via the Meta pixel, Google Ads and the TikTok pixel). You can withdraw your consent at any time, without affecting the lawfulness of the processing before the withdrawal.

Legal obligation: where we are required by law to retain certain data, for example accounting records.

We use necessary cookies for the website to function and, with your consent, our analytics tool PostHog, which uses cookies and similar technologies to collect page views, events, session replays and heatmaps. We activate no analytics before you have consented, and we respect browser signals for automatic opt-out (Global Privacy Control and Do Not Track).

With your consent to marketing, we use the Meta pixel (Facebook and Instagram), the Google tag (Google Ads) and the TikTok pixel to measure the results of our advertising and reach relevant audiences. The pixels record which pages you visit on our site and certain events, for example that you viewed a product page or opened the quote form. The Meta pixel and the TikTok pixel also use automatic matching: they read the contact details typed into the forms on the website, even before a form is sent, turn them into hashed codes directly in your browser and send the codes along with the events. At Meta the setting covers email address, phone number, name, town, region, postcode, country, gender, date of birth and ID number, and at TikTok email address, phone number and address. Our forms do not ask for gender or date of birth, and the only ID number they ask for is the company registration number in the installer application. When you submit an expression of interest or an installer application, we additionally send a conversion event to each of them: to Meta and TikTok server-to-server from our server, and to Google directly from your browser. All three receive your email address and phone number, pseudonymised by hashing. Meta also receives your name in hashed form. For an expression of interest, Meta also receives your town, postcode and country in hashed form, and Google receives your name in hashed form and your town, postcode and country in plain text. Meta and TikTok also receive your IP address, details about your browser and their own IDs for your browser and for the ad you clicked, so they can connect the event to the right ad. Your email address, phone number and name never reach the ad platforms in plain text. Marketing is off by default. No such cookie or sharing happens before you have actively consented.

You can change or withdraw your consent at any time via the “Cookie settings” link at the bottom of the page, which opens your cookie settings. There you can switch analytics and marketing on or off and save your choices.

We never sell your personal data. We share it only with providers that help us run the service, and then as data processors bound by agreements and our instructions.

This mainly concerns our platform provider that runs the website (Vercel), our cloud storage provider (Google Cloud, within the EU), our CRM (HubSpot), our email provider (Resend), which sends your confirmation, our recruitment system (Teamtailor) for job applications, our analytics tool (PostHog), our work chat (Slack), where we are notified internally about new enquiries and applications, the map service in the installer application (Google Maps), providers of property and address data, a tool that sorts expressions of interest (TypeSafe, USA) and, if you have consented to marketing, the advertising platforms Meta (Facebook and Instagram), Google (Google Ads) and TikTok, to which we send contact details (email, phone and name hashed, that is, pseudonymised) and technical details of your visit to measure the results of our advertising. We may also disclose data where we are required to by law or by a decision of an authority.

The app is downloaded from the Apple and Google app stores, and push notifications go through their notification services, which gives them details about your device. What you see in the app is held in our cloud storage at Google Cloud (Firestore, within the EU), and a referral bonus is paid out through our bank. If you accept analytics in the app, it goes to our analytics tool (PostHog), which stores it in the EU.

If a recipient processes data outside the EU/EEA, we ensure the transfer is protected by appropriate safeguards, such as the European Commission's standard contractual clauses.

Your equipment is financed through an external financier (operational leasing), which is the controller for its own processing of your data. You can read our financier's privacy policy.

Elvy uses an internal tool to manage our own Facebook and Instagram accounts: to read and reply to comments, hide inappropriate comments, and review how our advertising is performing. The tool is private and used only by an authorised member of Elvy's staff. It is not a public product, and we do not use the comments to profile you or to target ads at you.

When you comment on a post or an ad on Elvy's Facebook Page or Instagram account, the tool processes, for that comment: your public name or username, the user ID the platform has assigned you, the text of the comment, a link to the comment where available, and the time and which post or ad it belongs to. We also store any reply we send and a record of who sent it and when. We do not collect your email, phone number, address, payment details or any other profile data, only what you have written publicly and the name you display.

We use the data to reply to you and to hide or unhide an inappropriate comment (hiding is reversible and is not deletion). To draft a suggested reply and check it against our tone of voice, the text of the comment is sent to our AI provider (Anthropic), or to Google (Gemini) when Anthropic does not respond. We also sort the comments. An AI tool reads the text of each comment and labels it by topic and tone, for example a question, praise or a complaint. It also labels whether the comment is something for customer service, whether the writer already seems to be a customer, and how interested the person seems in our services. This is done by TypeSafe (USA), and by Anthropic when TypeSafe does not give a confident answer. They receive only the text of the comment, never your name or user ID. The labels set the order in which we read, whether a complaint goes straight to customer service, and what our suggested reply covers. They also help us see how the mood around Elvy changes over time. The labels apply to each comment on its own, not to you as a person. You can object to this by contacting us. No reply is sent and no comment is hidden automatically: a person reads and clicks for every action.

We also read aggregate performance figures for pages and ads (such as impressions, clicks and cost) from Facebook, Instagram, Google Ads, TikTok and LinkedIn. These are aggregate statistics, not personal data about individuals.

The data is handled by providers that are data processors, bound by data processing agreements and our instructions: Meta (Facebook and Instagram, the source of the comments), our database provider (Supabase, with storage within the EU) where comments, drafts and records are stored, our application host (Vercel, which runs the tool within the EU), our AI provider (Anthropic) which drafts the suggested replies, Google (Gemini), which does so when Anthropic does not respond, TypeSafe (USA), which sorts the comments, with Anthropic as the fallback, and a service that schedules the ingestion (Inngest). Where a provider processes data outside the EU/EEA, we protect the transfer with appropriate safeguards, such as the European Commission's standard contractual clauses.

Only authorised members of Elvy's staff can access the data, via login with two-factor authentication, and the database is access-controlled. Every reply and hide is logged. We keep a comment, our reply and the related record for up to 24 months after the comment was posted or last acted on, and then erase them. If you delete your comment at the source or ask us to remove it, we do so sooner.

We process the comments on the basis of our legitimate interest in managing communications on our own channels, following a balancing test against your privacy. The rights described below apply to this data too: you can request a copy of your data or its erasure using the details under Contact. You can also delete your comment yourself directly on Facebook or Instagram, which removes it at the source.

We keep your data for as long as needed for the purpose it was collected for, and then erase or anonymise it. The retention periods we apply are set out below.

An expression of interest that does not lead to an agreement: the data is kept for up to 24 months after your last contact with us and then erased.

A tip from one of our sales partners: the data is kept for as long as an expression of interest above. The photo of the grid bill is kept for a shorter time, up to 90 days, and is then erased automatically.

An application to become an installation partner: the data is kept for up to 24 months after your last contact with us and then erased. The same applies to a started application that is never submitted.

A job application: the CV file on our platform is deleted automatically after 30 days. The application in the recruitment system is kept for up to 24 months after the role is filled or you withdraw, and then deleted. You can ask us to delete it sooner at any time.

Customer data: processed during the term of the agreement and for up to 36 months afterwards, so we can handle warranties, claims and any disputes. Accounting records are kept for seven years under the Swedish Bookkeeping Act.

An app account: the data is processed for as long as you keep the account. If you delete the account we remove it, apart from what we must keep by law.

A referral made in the app: the details of the person you referred are kept for up to 12 months after the referral and are then erased. A shorter period than an expression of interest, because the person you referred did not contact us themselves. If they get in touch with us during that time, the expression-of-interest period applies instead.

A phone book you have shared with us: the phone numbers are kept for up to 12 months after you shared them. If you withdraw your consent, or delete the account, we delete them.

Energy and operating data from your home: processed during the term of the agreement and for up to 36 months afterwards, like other customer data.

Payment details: kept for seven years, because a payment is an accounting record under the Swedish Accounting Act.

Analytics data: processed for as long as your consent applies, for at most 12 months. Session replays are kept for a shorter time, up to one month.

Consent records: kept so we can demonstrate that processing was on the correct basis, for up to 36 months after you change or withdraw your consent.

You have the right to know what data we process about you (a copy of your data) and to have inaccurate data corrected.

You have the right to request erasure, to object to or restrict certain processing, and to receive the data you have provided in a machine-readable format (data portability).

You have the right to withdraw consent you have given at any time, for example for analytics cookies or for analytics in the app.

To exercise a right, contact us using the details below. We will respond to your request as soon as we can, and no later than within one month.

If you have questions about this policy or want to exercise your rights, you can reach us at kundservice@elvyenergy.com.

If you believe we are processing your personal data incorrectly, you have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY), the supervisory authority for data protection in Sweden.

We may update this policy as our services or legal requirements change. For material changes we update the date above and, where necessary, ask for your consent again. This version applies from October 2026.