Privacy policy

Data controller

Tarra AB, reg. no. 556819-9953, Berghamnsvägen 56A, SE-165 71 Hässelby, Sweden. E-mail: info@qtrl.me, phone: +46 10 550 00 82.

Data we process

• Account: name, e-mail address, language and subscription. Your password is only stored as a cryptographic hash.
• Sign-in with Google or Facebook: we receive your e-mail address and name from the account you sign in with (in the app via a Google ID token). Your Google or Facebook password never reaches us.
• Hubs and devices: the hub's id (MAC address), name, firmware version, IP address and connection status, data from sensors and devices (for example temperature, humidity and on/off state) and the commands you send.
• What you create: automations, dashboards, virtual devices and connections to other services (for example Shelly).
• Places: name, coordinates and time zone of places you add yourself. They are used to compute clock times, sunrise and electricity prices in your automations.
• The mobile app: a push token from Google Firebase Cloud Messaging and the phone's model, platform and app version, so we can send the notifications you have chosen.
• Payments: handled by Stripe. We store Stripe's customer id and which subscription you have. Card details never reach us.
• Technical logs: IP address, time and events, for operations, troubleshooting and security.

Mobile app permissions

• Camera: only to scan the QR code on the hub. The image is processed on the phone and is never sent anywhere.
• Location: Android requires the location permission to scan for Wi-Fi networks when you set up a hub. The app only uses it for that. Your location is neither stored nor sent to us.
• Bluetooth: only to configure a nearby hub, directly between the phone and the hub.
• Notifications: only if you allow them. You can turn them off in the app or in the phone's settings.

Why we process the data

• To provide the service you have chosen: show and control your devices, run automations and send notifications (contract).
• For payments and accounting (legal obligation).
• For security, troubleshooting and to prevent abuse (legitimate interest).
• For e-mail about your account, for example confirmations, receipts and important changes to the service.

Providers that process data for us

We only share data with providers needed to run the service. They may only use the data on our behalf.

• Microsoft Azure: hosting of the web service and the database.
• Google Firebase: push notifications to the app and checking that requests come from the genuine app.
• Google: sign-in with Google (if you choose it) and reCAPTCHA against spam in forms.
• Meta: sign-in with Facebook (if you choose it).
• Stripe: payments and invoices.
• Shelly: only if you connect your Shelly account to qtrl.me.

Security

Traffic between the app or browser and qtrl.me is encrypted (HTTPS). Hubs with newer firmware connect encrypted; older firmware connects unencrypted until the hub is updated. Passwords are only stored as hashes, and the app accesses your account with tokens you can revoke.

How long we keep the data

• Account and content: as long as you have the account. When you delete the account the data is removed immediately.
• Technical logs: deleted automatically after 90 days.
• Invoices and payments: seven years, as required by Swedish accounting law.
• Database backups: overwritten automatically after a limited time.

Delete your account

You can delete your account at any time. How to do it and what gets deleted: Delete account.

Your rights

You have the right to know what data we hold about you, to have it corrected or deleted, to object to the processing and to receive your data. You can download it yourself under Account → Personal data. You can also complain to the Swedish Authority for Privacy Protection (imy.se).

Contact

Questions about privacy or your data: info@qtrl.me.