Elvy AB (company reg. no. 559435-0737) is the controller for the processing of your personal data and is responsible for ensuring it complies with applicable data protection law, in particular the EU General Data Protection Regulation (GDPR).

This policy applies when you visit our website, submit an expression of interest, or become a customer. If you have questions about how we process your data, you can reach us using the details below.

When you submit an expression of interest or sign up for a subscription, we collect the details you provide: name, address, email and phone number. We use them to prepare a proposal, contact you and deliver the service. The details are stored in our lead database with Google Cloud (Firestore, within the EU) and are then handled in our CRM (HubSpot). We also send a confirmation to your email address via our email provider (Resend).

To tailor your proposal, we retrieve information about your home, such as property type and address details, from external property and address sources based on the address you enter.

When you use the website we collect, with your consent, usage data via our analytics tool (PostHog) to understand how the site is used and improve it. This includes page views and events, recordings of how you navigate and interact with the site (session replays), and heatmaps of where visitors click and move. No such collection happens before you have given your consent. Data strictly necessary for the website to function is always processed.

If you consent to marketing, we also use advertising cookies via the Meta pixel (Facebook and Instagram), the Google tag (Google Ads) and the TikTok pixel and, when you submit an expression of interest, send a conversion event to Meta, Google and TikTok to measure and improve our advertising. Your email address is first converted into a pseudonymised code (hashing) so it cannot be read as plain text. No such collection or sharing happens before you have consented to marketing.

Contract: where processing is necessary for us to deliver a subscription you have signed up for, or to take steps prior to entering into an agreement.

Legitimate interest: to respond to your expression of interest, tailor your proposal and develop our services, following a balancing test against your privacy.

Consent: for analytics of website usage via cookies and for marketing (advertising cookies and conversion measurement via the Meta pixel, Google Ads and the TikTok pixel). You can withdraw your consent at any time, without affecting the lawfulness of the processing before the withdrawal.

Legal obligation: where we are required by law to retain certain data, for example accounting records.

We use necessary cookies for the website to function and, with your consent, our analytics tool PostHog, which uses cookies and similar technologies to collect page views, events, session replays and heatmaps. We activate no analytics before you have consented, and we respect browser signals for automatic opt-out (Global Privacy Control and Do Not Track).

With your consent to marketing, we use the Meta pixel (Facebook and Instagram), the Google tag (Google Ads) and the TikTok pixel to measure the results of our advertising and reach relevant audiences. The pixels record which pages you visit on our site and certain events, for example that you viewed a product page or opened the quote form. When you submit an expression of interest, we additionally send a conversion event to each of them: to Meta and TikTok server-to-server from our server, and to Google directly from your browser. In every case your email address is first pseudonymised by hashing. It never leaves the website in plain text. Marketing is off by default. No such cookie or sharing happens before you have actively consented.

You can change or withdraw your consent at any time via the “Cookie settings” link at the bottom of the page, which opens your cookie settings. There you can switch analytics and marketing on or off and save your choices.

We never sell your personal data. We share it only with providers that help us run the service, and then as data processors bound by agreements and our instructions.

This mainly concerns our platform provider that runs the website (Vercel), our cloud storage provider (Google Cloud, within the EU), our CRM (HubSpot), our email provider (Resend), which sends your confirmation, our analytics tool (PostHog), providers of property and address data and, if you have consented to marketing, the advertising platforms Meta (Facebook and Instagram), Google (Google Ads) and TikTok, to which we send a hashed (pseudonymised) email address to measure the results of our advertising. We may also disclose data where we are required to by law or by a decision of an authority.

If a recipient processes data outside the EU/EEA, we ensure the transfer is protected by appropriate safeguards, such as the European Commission's standard contractual clauses.

Your equipment is financed through an external financier (operational leasing), which is the controller for its own processing of your data. You can find our financier's privacy policy here.

Elvy uses an internal tool to manage our own Facebook and Instagram accounts: to read and reply to comments, hide inappropriate comments, and review how our advertising is performing. The tool is private and used only by an authorised member of Elvy's staff. It is not a public product, and we do not use the comments to profile you or to target ads at you.

When you comment on a post or an ad on Elvy's Facebook Page or Instagram account, the tool processes, for that comment: your public name or username, the user ID the platform has assigned you, the text of the comment, a link to the comment where available, and the time and which post or ad it belongs to. We also store any reply we send and a record of who sent it and when. We do not collect your email, phone number, address, payment details or any other profile data, only what you have written publicly and the name you display.

We use the data to reply to you and to hide or unhide an inappropriate comment (hiding is reversible and is not deletion). To draft a suggested reply and check it against our tone of voice, the text of the comment is sent to our AI provider (Anthropic). No reply is sent and no comment is hidden automatically: a person reads and clicks for every action.

We also read aggregate performance figures for pages and ads (such as impressions, clicks and cost) from Facebook, Instagram, Google Ads, TikTok and LinkedIn. These are aggregate statistics, not personal data about individuals.

The data is handled by providers that are data processors, bound by data processing agreements and our instructions: Meta (Facebook and Instagram, the source of the comments), our database provider (Supabase, with storage within the EU) where comments, drafts and records are stored, our application host (Vercel, which runs the tool within the EU), our AI provider (Anthropic) which drafts the suggested replies, and a service that schedules the ingestion (Inngest). Where a provider processes data outside the EU/EEA, we protect the transfer with appropriate safeguards, such as the European Commission's standard contractual clauses.

Only authorised members of Elvy's staff can access the data, via login with two-factor authentication, and the database is access-controlled. Every reply and hide is logged. We keep a comment, our reply and the related record for up to 24 months after the comment was posted or last acted on, and then erase them. If you delete your comment at the source or ask us to remove it, we do so sooner.

We process the comments on the basis of our legitimate interest in managing communications on our own channels, following a balancing test against your privacy. The rights described below apply to this data too: you can request a copy of your data or its erasure using the details under Contact. You can also delete your comment yourself directly on Facebook or Instagram, which removes it at the source.

We keep your data for as long as needed for the purpose it was collected for, and then erase or anonymise it. The retention periods we apply are set out below.

An expression of interest that does not lead to an agreement: the data is kept for up to 24 months after your last contact with us and then erased.

Customer data: processed during the term of the agreement and for up to 36 months afterwards, so we can handle warranties, claims and any disputes. Accounting records are kept for seven years under the Swedish Bookkeeping Act.

Analytics data: processed for as long as your consent applies, for at most 12 months. Session replays are kept for a shorter time, up to one month.

Consent records: kept so we can demonstrate that processing was on the correct basis, for up to 36 months after you change or withdraw your consent.

You have the right to know what data we process about you (a copy of your data) and to have inaccurate data corrected.

You have the right to request erasure, to object to or restrict certain processing, and to receive the data you have provided in a machine-readable format (data portability).

You have the right to withdraw consent you have given at any time, for example for analytics cookies.

To exercise a right, contact us using the details below. We will respond to your request as soon as we can, and no later than within one month.

If you have questions about this policy or want to exercise your rights, you can reach us at kundservice@elvyenergy.com.

If you believe we are processing your personal data incorrectly, you have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY), the supervisory authority for data protection in Sweden.

We may update this policy as our services or legal requirements change. For material changes we update the date above and, where necessary, ask for your consent again. This version applies from July 2026.