Effective Date: 30 August 2026

1. Introduction

At Tempurium ("we," "us," or "our"), we are committed to protecting the privacy of our users and customers. This Privacy Policy explains what information we collect, how we use it, and the choices available to our users regarding our use of their information when they use our website, mobile application, and related services (collectively, the "Service").

2. Information Collection

We collect information from our users in various ways, including when they create an account, use the Service, or participate in promotions or surveys. This information may include:

  • Account Information: Your username, email address, and display name. We do not collect your postal address or phone number.
  • Payment Information: None. The Service is free of charge, and we do not ask for, collect, or store payment card, bank account, or billing details, and no payment processor is involved in your use of the Service.
  • Technical Information: This may include your IP address, browser type, device information (e.g., operating system, model), and usage data related to your interaction with our Service (e.g., pages visited, features used).
  • Location Information: With your consent, we may collect precise location data (e.g., GPS) or infer your general location (e.g., from your IP address or city provided during registration) to provide location-based services, such as weather data for your solar panel system.
  • Solar System Information: To provide accurate solar forecasts, you may provide us with details about your solar panel system, such as its size (kWp), orientation, tilt, and any known shading.
  • AI Feature Content: If you use AI-assisted features (such as the daily briefing, recommendations, or the AI chat assistant), the content you submit — together with relevant account and solar-system context needed to generate a useful response — is sent to our AI provider, Anthropic, PBC, to produce that response. See "AI-Assisted Features" below.

What our mobile app does not collect. The Tempurium mobile application does not collect advertising identifiers or device identifiers, does not include any third-party analytics, advertising, or crash-reporting software, and does not send push notifications, so no push token is collected. The app requests access to your device location only if you choose to use automatic location detection, and you can revoke that permission at any time in your device's settings. If we add any of these in future, we will update this policy and the store data-safety disclosures before doing so.

3. Information Use

The information we collect is used to provide, maintain, and improve our Service, and to communicate with our users. This may include:

  • Providing customer support and resolving disputes.
  • Sending updates, service announcements, promotions, and other communications (you can opt-out of marketing communications).
  • Personalizing your experience with the Service.
  • Improving the quality, design, and functionality of our Service.
  • Conducting data analysis, testing, research, and monitoring usage trends.
  • Protecting against and preventing fraud, unauthorized transactions, claims, and other liabilities.
  • Complying with applicable legal requirements and industry standards.

4. AI-Assisted Features

Certain features of the Service (including the daily briefing, personalized recommendations, and — for Pro subscribers — the AI chat assistant) are powered by a third-party large language model provided by Anthropic, PBC ("Anthropic"). To generate these features, we send Anthropic the relevant inputs needed to produce a useful response — for example, your chat messages, your solar system configuration, and recent weather/production data associated with your account. Where a feature includes live web search (Pro chat), your query terms may also be used to retrieve information from the public web via Anthropic's search tool.

Under our commercial agreement with Anthropic, data submitted through the API is not used to train Anthropic's models. Anthropic may retain API inputs/outputs for a limited period for abuse monitoring and legal-compliance purposes, consistent with Anthropic's own privacy policy, available at anthropic.com/legal/privacy. Do not submit sensitive personal information (e.g., financial account numbers, government IDs, health information) in chat messages, as it is unnecessary for the Service to function.

5. Cookies and Analytics

Essential cookies. We use cookies that are necessary for the Service to function — for example, to keep you signed in and to protect forms against cross-site request forgery. The Service cannot work properly without these.

No third-party advertising or tracking cookies. We do not use Google Analytics or any other third-party analytics, advertising, or tracking service on our website. We also self-host our fonts and JavaScript libraries rather than loading them from external content delivery networks, so simply visiting our site does not disclose your IP address to third parties.

First-party usage analytics. We record basic in-product activity on our own servers — such as sign-ins and which pages of the dashboard are viewed, together with your account and subscription tier — to understand feature usage and diagnose problems. This information stays on our own infrastructure and is never shared with advertisers. Our analytics records themselves do not contain your IP address or geographic location. Separately from analytics, our hosting provider's web servers write standard request logs that do include the IP address your request came from; those logs are described in Sections 6 and 7.

Managing cookies. Most browsers let you refuse or delete cookies through their settings. Because we only use strictly necessary cookies, we do not display a cookie consent banner; blocking these cookies will prevent you from signing in and using the Service.

Do Not Track and Global Privacy Control. Some browsers send a "Do Not Track" (DNT) signal, and some send a Global Privacy Control (GPC) signal. We do not track you across third-party websites or over time for advertising, and we do not sell or share your personal information, so there is nothing for these signals to switch off — we therefore do not respond differently to a DNT or GPC signal. If we ever begin activity that these signals apply to, we will honour GPC as a valid opt-out request and update this policy first.

6. Information Sharing

We do not sell your personal information. We may share information with third parties in the following limited circumstances:

  • Service Providers (sub-processors): We share information with the third-party vendors listed below, each of which is authorized to use it only as necessary to provide their service to us:
    • Anthropic, PBC — AI-assisted features, as described in Section 4 (United States).
    • Visual Crossing Corporation — historical and forecast weather data. We send the name of your city, not your precise coordinates.
    • Open-Meteo — solar irradiance data for the interactive Solar Lab map. When you select a point on the map, that point's latitude and longitude are sent through our servers; your IP address is not disclosed to Open-Meteo.
    • OpenStreetMap Foundation (Nominatim) — converts a map point into a place name in the public Solar Lab. This request is made directly by your browser, so your IP address and the selected coordinates are visible to the OpenStreetMap Foundation.
    • Salesforce, Inc. (Heroku) — application hosting and database storage (United States). Heroku's web servers write standard request logs that include the requesting IP address, the URL requested, and a timestamp.
    • Functional Software, Inc. (Sentry) — error and performance monitoring. When something goes wrong on our servers, a diagnostic report is sent to Sentry. These reports can include the URL involved, technical details of the error, and the identifier of the signed-in account, so that we can reproduce and fix the fault.
    • Twilio Inc. (SendGrid) — delivers account emails such as address confirmation, password reset, and the weekly digest (United States). Your email address and the content of those messages are processed by SendGrid on our behalf.
    We will update this list when our sub-processors change.
  • Legal Obligations: We may disclose your information if required to do so by law or in the good faith belief that such action is necessary to comply with a legal obligation (e.g., responding to a subpoena or court order), protect and defend our rights or property, prevent or investigate possible wrongdoing in connection with the Service, or protect the personal safety of users of the Service or the public.
  • Business Transfers: In the event of a sale, merger, reorganization, dissolution, or similar event involving Tempurium, your information may be part of the transferred assets. We will notify you via email and/or a prominent notice on our Service of any change in ownership or uses of your personal information, as well as any choices you may have regarding your personal information.
  • With Your Consent: We may share your information with third parties when we have your explicit consent to do so.

7. Data Retention

We keep personal information only for as long as we need it to provide the Service, and then delete it or reduce it to a form that no longer identifies you.

  • Account and solar system information — kept for as long as your account is open. This includes your username, email, city, and your saved system configuration.
  • Inverter production readings and modelled-output records — kept for as long as your account is open, because the calibration feature compares readings over time. Deleted immediately and permanently when you delete your account.
  • Account deletion — when you delete your account, your account record and the solar data linked to it are removed from our live database straight away. Copies may persist in routine encrypted backups until those backups age out, ordinarily within 30 days.
  • Product usage records (sign-ins and which dashboard pages were viewed) — retained for analysis, but the link to your account is severed when your account is deleted, leaving records that no longer identify you.
  • AI conversations — chat messages are not stored on our servers as a conversation history; each request sends the conversation from your device. Our AI provider may retain inputs and outputs briefly for abuse monitoring, as described in Section 4.
  • Server logs and technical data — our hosting provider's request logs, which include IP addresses, device and browser details, and requested URLs, are retained on a short rolling basis for security, abuse prevention, and debugging, ordinarily no more than 30 days, after which they are overwritten. Error reports sent to our monitoring provider are retained under that provider's default schedule, ordinarily up to 90 days.
  • Inactive accounts — we do not currently delete accounts for inactivity. If we introduce such a policy, we will give you notice by email before any deletion occurs.

Exceptions to deletion. When you ask us to delete your information, we may keep specific items where the law allows or requires it: records needed to comply with a legal obligation, information subject to a legal hold or needed to establish, exercise, or defend a legal claim, security and abuse-prevention logs for their normal retention period, and backups until they expire. We will not use retained information for any other purpose.

Aggregated and de-identified information. We may create aggregated or de-identified information from your data — for example the average performance of systems in a region — and retain and use it indefinitely to operate and improve the Service. Where we hold information in de-identified form, we maintain it as de-identified, do not attempt to re-identify it (except to test that de-identification works), and require the same of any recipient. De-identified information is not personal information.

We may retain information for longer where we are required to do so by law, or where it is necessary to resolve a dispute or enforce our agreements.

8. Data Security

We take the security of our users' information very seriously and implement appropriate administrative, technical, and physical security measures designed to protect against unauthorized access, disclosure, alteration, or destruction of the information we collect and store. However, no method of transmission over the Internet or method of electronic storage is 100% secure. Therefore, while we strive to use commercially acceptable means to protect your personal information, we cannot guarantee its absolute security.

If a breach occurs. If we become aware of a security breach that has compromised your personal information, we will notify you by email at the address associated with your account, and will notify regulators, without undue delay and within the time limits required by applicable law. Our notice will describe, as far as we are able at the time, what happened, what information was involved, what we are doing about it, and what you can do to protect yourself. Please keep your email address current so we can reach you.

9. User Control and Access (Your Rights)

You have certain rights regarding your personal information. Subject to applicable law, these may include the right to:

  • Access, review, and update your personal information by logging into your account settings.
  • Request correction of your personal information if it is inaccurate or incomplete.
  • Request deletion of your personal information, subject to certain exceptions.
  • Opt out of the weekly solar digest at any time, either by using the unsubscribe link in the footer of any digest email or by turning it off from your dashboard. Opting out does not affect account emails such as address confirmation and password resets, which are necessary to operate your account.
  • Object to or restrict the processing of your personal information under certain circumstances.
  • Request the transfer of your personal information to another party in a machine-readable format (data portability), where technically feasible.

To exercise these rights, please contact us at support@tempurium.com.

10. Your California Privacy Rights (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act, as amended by the CPRA, gives you additional rights. This section describes them and the disclosures California law requires.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising, as those terms are defined under the CCPA. We have not done so in the preceding 12 months. We also do not knowingly sell or share the personal information of consumers under 16.

Categories collected in the preceding 12 months.

  • Identifiers — username, email address, display name, IP address. Collected from you and automatically. Disclosed for a business purpose to our hosting and payment providers.
  • Geolocation data — your chosen city, and precise coordinates where you grant permission or select a point on the map. Disclosed to our weather and mapping providers as described in Section 6.
  • Internet or network activity — pages viewed within the Service and sign-in events. Collected automatically; kept on our own infrastructure.
  • Other information you provide — your solar system configuration, appliance selections, inverter readings, and the content of AI chat messages. Disclosed to our AI provider as described in Section 4.

We collect these for the business purposes described in Section 3, and retain them as described in Section 7. We do not collect "sensitive personal information" for the purpose of inferring characteristics.

Your rights. Subject to verification, you may request to know the categories and specific pieces of personal information we hold about you; to delete it; to correct inaccurate information; and to obtain it in a portable format. You have the right not to receive discriminatory treatment for exercising these rights — we will not deny you the Service, charge you a different price, or give you a lower quality of service.

How to exercise them. Email support@tempurium.com, or use the account settings page, which lets you view, correct, and delete your information directly. We will verify your request using the email address associated with your account. You may use an authorised agent; we may ask them for proof of authorisation. We will respond within the period required by the CCPA, and may extend that period where the CCPA permits.

11. Other U.S. State Privacy Rights

If you are a resident of Virginia, Colorado, Connecticut, Texas, Oregon, Montana, or another state with a comprehensive consumer privacy law, you have rights similar to those in Section 10: to confirm whether we process your personal data and to access it, to correct inaccuracies, to delete it, to obtain a portable copy, and to opt out of targeted advertising, the sale of personal data, and profiling that produces legal or similarly significant effects.

We do not sell personal data, do not use it for targeted advertising, and do not carry out profiling of that kind, so there is nothing for those opt-outs to apply to. We do not process sensitive personal data for these purposes; where a law requires consent before processing sensitive data such as precise geolocation, we ask for it — in the app, through your device's location permission.

How to exercise your rights. Email support@tempurium.com, or use the account settings page. We will verify your request against the email address on your account and respond within the period required by the applicable law of your state, which we may extend where that law permits.

Right to appeal. If we decline your request, you may appeal that decision by replying to our response or emailing support@tempurium.com with the subject line "Privacy Appeal". We will review the appeal and inform you in writing of our decision, and the reasons for it, within the period required by the applicable law of your state. If we deny your appeal, we will also give you a way to contact your state Attorney General to submit a complaint.

12. Users in the European Economic Area and the United Kingdom

Tempurium is a United States company, the Service is directed at users in the United States, and our pricing, content, and weather data are US-oriented. We do not offer the Service to, or monitor the behaviour of, individuals in the EEA or the UK, and we do not consider ourselves established there. The following is offered voluntarily, as a matter of good practice, for anyone who nonetheless uses the Service from those regions; it is not an acknowledgement that the GDPR or UK GDPR applies to us.

Data controller. Tempurium LLC, 301 S Heatherwilde Blvd #953, Pflugerville, Texas 78691, United States, is the controller of your personal data. Contact: support@tempurium.com.

Lawful bases. We rely on: performance of a contract to create and operate your account and deliver forecasts; legitimate interests to secure the Service, prevent fraud, and understand feature usage through our own first-party analytics; consent where you grant access to your device's precise location, which you may withdraw at any time in your device settings; and legal obligation where the law requires us to retain particular records.

Your rights. You may request access, rectification, erasure, restriction of processing, and portability, and you may object to processing based on legitimate interests. Where processing is based on consent, withdrawing it does not affect processing carried out beforehand. You may lodge a complaint with your local supervisory authority.

International transfers. Your data is stored and processed in the United States by us and by the providers listed in Section 6. Where we transfer personal data out of the EEA or the UK, we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum) as incorporated into our agreements with those providers.

13. Children's Privacy

Our Service is not directed to individuals under the age of 13 (or a higher age threshold as required by applicable law). We do not knowingly collect personal information from children. If we become aware that a child has provided us with personal information, we will take steps to delete such information.

14. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for other operational, legal, or regulatory reasons. If we make material changes, we will notify you by posting the updated policy on our Service and updating the "Effective Date" at the top of this policy. We encourage you to review this Privacy Policy periodically for any changes.

15. Contact Us

If you have any questions or concerns about this Privacy Policy or our data collection and use practices, please contact us at: support@tempurium.com.