Privacy Policy

Last updated: August 16, 2026

This Privacy Policy explains how SustivioLabs ("we," "us," "our") collects, uses, stores, and protects information when you use our website and services (the "Service"). SustivioLabs is a B2B tool for solar installers and EPC companies in India to size systems, calculate financials, and generate customer-facing reports.

1. Information We Collect

When you create an account, we collect:

• Email address (required)
• Password — stored only as a one-way bcrypt hash; we never store or can retrieve your actual password
• Name, phone number, username (optional, editable in Settings)

When you use the platform as an admin, the following actions are permanently logged: granting/revoking admin access, deleting a shared resource — recording who did it, what they did, and when.

We also keep a simple count of PDF reports generated (technical vs. graphical), with the generating user's email attached only when they were logged in at the time.

2. Information We Do NOT Collect

We do not store the actual inputs of any solar calculation — PIN code, roof size, electricity bill, panel choice, and every other calculator field exist only in your browser for the duration of your session. Nothing about a specific quote is saved on our servers unless you download it as a PDF, and that PDF exists only on your own device.

We do not use advertising trackers, third-party analytics cookies, or sell any data to third parties.

3. How We Use Your Information

We use account information to authenticate you, operate your account, send transactional emails (password resets), and maintain the security/audit measures described below. We do not use your information for advertising or marketing without separate consent.

4. Cookies

We use exactly one cookie: a session cookie that keeps you signed in. It is marked httpOnly, meaning it cannot be read by any script running on the page — only by our server. It is not a tracking or advertising cookie, and no cookie data is shared with third parties.

5. Third-Party Service Providers

We share limited data with the following providers, solely to operate the Service:

• Resend — receives your email address and a one-time reset code, only when you request a password reset, to deliver that email.
• Neon — hosts our PostgreSQL database (all account data described in Section 1).
• Render — hosts the application itself.
• Open-Meteo — receives only geographic coordinates (not linked to your identity) to look up solar irradiance data for a calculation.

None of these providers are permitted to use your data for their own purposes.

6. Data Retention

Account data is retained until you delete your account. If you delete your account, your login credentials and profile are permanently removed. Report-download statistics are anonymized (the email is cleared) rather than deleted, so aggregate usage counts remain accurate. Admin audit-log entries that name you (as an actor or target of an admin action) are retained even after account deletion, since they are an accountability record of actions already taken, not ongoing personal data.

7. Your Rights

You can, at any time, from your Settings page:

• View and edit your profile
• Permanently delete your account and associated data (password re-entry required to confirm)

If you have a request we haven't built self-service tooling for, contact us using the details in Section 10.

8. Data Security

Passwords are hashed with bcrypt and never stored in readable form. Login sessions use signed, httpOnly cookies. All traffic is encrypted via HTTPS. Repeated or automated abuse is throttled by rate limiting. Every privileged administrative action is permanently logged.

9. Children's Privacy

The Service is a business tool intended for use by solar installation companies and their staff, not by children. We do not knowingly collect data from anyone under 18.

10. Changes to This Policy

We may update this policy as the Service evolves. Material changes will be reflected by an updated "Last updated" date on this page.