Hyviva Privacy Policy

1. Who We Are

This Privacy Policy explains how Hyviva LLC and its affiliates, doing business as Hyviva (“Hyviva,” “we,” “us,” or “our”), collects, uses, discloses, and protects personal information.

This Privacy Policy applies when you:

• visit www.hyviva.com, cloud.hyviva.com, or another website that links to this Privacy Policy (collectively, the “Sites”);
• request information, an estimate, or a home energy assessment;
• reserve, purchase, install, or obtain support for a HyvivaGrid system;
• make a payment through our Sites;
• create or use a Hyviva account;
• use HyvivaGrid software, mobile applications, cloud-relay services, or connected-system features;
• communicate or otherwise interact with us.

Hyviva is the controller of the personal information described in this Privacy Policy unless we state otherwise.

Hyviva contact information

If you are located in the European Economic Area or United Kingdom, see Section 12 for additional information.

2. Personal Information We Collect

The personal information we collect depends on how you interact with us.

Information you provide

We may collect:

• Identity and contact information, such as your name, email address, telephone number, billing address, installation address, and preferred method of contact.
• Account information, such as your username, account identifier, password or authentication credentials, preferences, and account settings.
• Reservation and transaction information, such as the system or service requested, reservation amount, transaction date, purchase history, invoices, refunds, and payment status.
• Payment information. Payments are processed by Stripe, our payment processor. Hyviva generally receives transaction identifiers and payment status. Hyviva does not receive or store your payment information.
• Property and energy information, such as the property address, property type, ownership or authorization status, utility provider, energy usage, utility bills, electrical equipment, existing solar or storage equipment, photographs, plans, site measurements, installation constraints, and information needed to assess or design a system.
• Project and service information, such as site-assessment results, system configuration, permits, installation records, service history, warranties, and support requests.
• Communications, including emails, form submissions, telephone inquiries, survey responses, and other correspondence.
• Marketing preferences, such as whether you have chosen to receive product announcements or promotional communications.
• Other information you voluntarily provide.

Please do not provide sensitive personal information that we have not requested.

Information collected automatically

When you use our Sites or online services, we and our service providers may automatically collect:

• IP address;
• browser type and version;
• device type, operating system, and device identifiers;
• pages viewed, referring pages, links selected, and time spent on the Sites;
• approximate location derived from an IP address;
• session, authentication, diagnostic, and security information;
• cookie and similar-technology identifiers; and
• information concerning errors, performance, and attempted misuse.

HyvivaGrid system and cloud-relay information

Depending on the system configuration and services you enable, a HyvivaGrid system may generate operational information such as equipment status, energy production and consumption, system performance, fault conditions, configuration settings, and diagnostic information.

HyvivaGrid operational data is ordinarily stored on equipment located at the customer’s premises. When the cloud-relay feature is enabled, operational information may pass through Hyviva’s systems to facilitate communication between the local HyvivaGrid equipment and the customer’s authorized devices. Except for transient technical caching, ordinarily lasting less than three seconds, Hyviva does not persistently store the content of relayed operational data.

You may opt in to the Hyviva Fleet Manager. Only after you opt in will Hyviva store the data points mentioned above in a secure cloud service for analysis and debugging purposes.

Hyviva may nevertheless retain limited account, authentication, connection, security, error, and diagnostic records needed to operate, protect, troubleshoot, and support the service. These records may constitute personal information when they can be associated with an identifiable customer, device, or property.

We will update this Privacy Policy before materially expanding the categories of HyvivaGrid information we persistently collect or the purposes for which we use it.

Information received from other sources

We may receive personal information from:

• payment processors and financial institutions;
• dealers, installers, contractors, and service providers;
• utilities, permitting authorities, or grid operators when authorized;
• referral or commercial partners;
• fraud-prevention, identity-verification, and security providers;
• publicly available sources; and
• another person acting for a property owner, business, or household.

If you provide information about another person, you represent that you are authorized to provide it and, where required, have given that person appropriate notice.

3. How We Use Personal Information

We may use personal information to:

• operate, maintain, secure, and improve our Sites, products, and services;
• create and administer customer accounts;
• respond to inquiries and provide requested information;
• conduct home energy and site-feasibility assessments;
• develop estimates, proposals, designs, and system configurations;
• process reservations, payments, refunds, purchases, and invoices;
• fulfill orders and coordinate engineering, permitting, delivery, installation, commissioning, maintenance, and support;
• communicate about reservations, orders, appointments, installations, service events, safety notices, and product updates;
• authenticate users and authorized devices;
• provide cloud-relay and remote-access functionality;
• diagnose faults and provide technical support;
• maintain transaction, warranty, tax, accounting, and business records;
• prevent fraud, unauthorized access, security incidents, and other misuse;
• enforce our agreements and protect our rights, customers, personnel, and property;
• comply with legal, regulatory, safety, and reporting obligations;
• analyze and improve product performance and customer experience using aggregated or deidentified information where reasonably possible;
• send marketing communications where permitted by law and consistent with your preferences;
• establish, exercise, or defend legal claims; and
• complete a merger, financing, acquisition, reorganization, sale of assets, insolvency proceeding, or similar corporate transaction.

We will not use personal information for a materially different purpose without providing any additional notice or obtaining any consent required by law.

4. Legal Bases for Processing in the EEA, UK, and Switzerland

Where applicable law requires a legal basis, we process personal information on one or more of the following grounds:

Where we rely on consent, you may withdraw that consent at any time. Withdrawal does not affect processing already lawfully performed.

Where we rely on legitimate interests, you may request information about the balancing assessment relevant to your personal information.

5. How We Disclose Personal Information

We may disclose personal information to the following categories of recipients:

• Payment and transaction providers, including payment processors, banks, fraud-prevention providers, and accounting providers.
• Installation and project partners, including dealers, engineers, site assessors, installers, contractors, logistics providers, utilities, permitting authorities, inspectors, and maintenance providers, where necessary for the requested project.
• Technology providers, including website hosts, cloud-service providers, email providers, customer-relationship-management providers, account-authentication providers, analytics providers, security providers, and technical-support providers.
• Professional advisers, including attorneys, accountants, auditors, insurers, lenders, and consultants.
• Affiliates and corporate partners, where reasonably necessary to operate our business or fulfill your transaction.
• Governmental and regulatory authorities, courts, law enforcement, or other parties when we believe disclosure is legally required or reasonably necessary to protect legal rights, safety, or security.
• Parties to a corporate transaction, such as an actual or proposed purchaser, investor, lender, successor, insolvency administrator, or professional adviser involved in a financing, merger, acquisition, restructuring, insolvency, or sale of all or part of our business.
• Other parties at your direction or with your consent.

Service providers may use personal information only to provide services to Hyviva or as otherwise permitted by their agreements and applicable law.

Hyviva does not sell personal information for money. Hyviva does not share personal information for cross-context behavioral advertising or targeted advertising.

We do not disclose complete payment-card information because it is collected and processed directly by our payment provider.

6. Cookies and Similar Technologies

Our Sites may use cookies and similar technologies for the following purposes:

• Strictly necessary technologies, which support security, authentication, shopping-cart or checkout functions, payment processing, network management, and basic site operation.
• Preference technologies, which remember language, region, or other selections.
• Analytics technologies, which help us understand how visitors use the Sites and identify errors or performance issues.
• Advertising technologies, if used, which may measure campaigns or support personalized advertising.

Where required by law, we will obtain your consent before placing analytics, advertising, or other nonessential technologies on your device. You may change your choices through the controls in your browser.

Rejecting nonessential cookies will not prevent access to the basic features of the Sites. Disabling necessary cookies may affect checkout, authentication, or other functions.

7. Marketing Communications

We may send service-related communications necessary to administer an inquiry, reservation, purchase, installation, warranty, account, or safety matter. You generally cannot opt out of these communications while the relevant relationship continues.

We will send promotional email or electronic marketing only as permitted by applicable law. You may unsubscribe by selecting the unsubscribe link in a marketing email or contacting us at privacy@hyviva.com.

Unsubscribing from marketing does not stop transactional, product-safety, warranty, or service communications.

We do not use consent to receive marketing as a condition of purchasing a HyvivaGrid system unless the marketing is necessary to provide a service you specifically requested.

8. Retention

We retain personal information only for as long as reasonably necessary for the purposes described in this Privacy Policy, including to provide products and services, honor warranties, maintain safety and service records, comply with tax and accounting requirements, resolve disputes, prevent fraud, and enforce agreements.

Retention periods depend on the type of information and applicable legal requirements. Our general criteria include:

• Inquiry information: for example, two or more years after the last substantive contact;
• Unsuccessful reservation or assessment information: for example, three or more years after closure;
• Customer, transaction, installation, and warranty records: for the duration of the customer relationship and applicable warranty, plus the period required for tax, accounting, safety, and legal claims;
• Payment records: as required for financial, tax, fraud-prevention, and dispute-management purposes;
• Marketing records: until consent is withdrawn or the information is no longer needed, while retaining a limited suppression record to honor an opt-out;
• Website and security logs: ordinarily for up to one year, except for portions of logs containing information subject to incident review, and as required by law;
• Transient cloud-relay data: ordinarily less than three seconds, unless a longer period is necessary to address an error or security event; and
• Account information: while the account remains active and for a limited period afterward for security, support, and legal purposes.

We may retain aggregated or deidentified information that cannot reasonably be linked to an identifiable individual.

9. Data Security

We use reasonable administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, loss, misuse, alteration, or disclosure.

These measures may include encryption in transit, access controls, authentication protections, logging, vendor oversight, personnel restrictions, backups, security monitoring, and incident-response procedures, as appropriate to the nature of the information.

No method of transmission or storage is completely secure. We therefore cannot guarantee absolute security. You are responsible for protecting your account credentials and promptly notifying us of suspected unauthorized access.

If a breach affecting your personal information occurs, we will investigate and provide any notices required by applicable law.

10. International Data Transfers

Hyviva is based in the United States, and personal information may be processed in the United States or other countries where Hyviva, its affiliates, or its service providers operate. These countries may have data-protection laws different from those in your country.

Where required for transfers from the EEA, UK, or Switzerland, we use an approved transfer mechanism, such as:

• an adequacy decision;
• applicable standard contractual clauses;
• the UK International Data Transfer Agreement or UK Addendum;
• an applicable data-transfer framework; or
• another legally permitted safeguard or exception.

You may contact us for more information about the safeguards applicable to your personal information.

11. Your Privacy Rights

Depending on where you live and subject to applicable exceptions, you may have the right to:

• request confirmation that we process your personal information;
• access or obtain a copy of your personal information;
• correct inaccurate or incomplete information;
• request deletion of personal information;
• restrict or object to certain processing;
• withdraw consent;
• obtain certain information in a portable format;
• opt out of direct marketing;
• opt out of the sale, sharing, or use of personal information for targeted advertising, if applicable;
• appeal our refusal of a privacy request, where applicable; and
• lodge a complaint with a privacy or data-protection authority.

To exercise a privacy right, contact us at privacy@hyviva.com. Please describe your request and provide enough information for us to identify the applicable records.

We may take reasonable steps to verify your identity and authority before completing a request. An authorized agent may submit a request where permitted by law, but we may require evidence of the agent’s authority and verification of the individual’s identity.

We will not unlawfully discriminate against you for exercising a privacy right.

These rights are not absolute. We may retain or continue processing information where permitted or required by law, including to complete a transaction, provide a warranty, maintain product-safety records, detect fraud, comply with legal obligations, or establish or defend legal claims.

12. Additional Information for the EEA, UK, and Switzerland

If you are located in the EEA, UK, or Switzerland, Hyviva acts as the controller of the personal information covered by this Privacy Policy.

European and UK representatives

If Hyviva is required to appoint a representative in the European Economic Area, United Kingdom, or Switzerland, the representative’s identity and contact information will be stated in this section before Hyviva begins the processing that requires the appointment.

Privacy contact

Hyviva has not appointed a statutory Data Protection Officer because it has determined that its current processing activities do not require one. Privacy questions and requests may be directed to privacy@hyviva.com.

You may lodge a complaint with the data-protection authority where you live or work or where you believe a violation occurred. We encourage you to contact us first so that we can attempt to address your concern.

• European Economic Area authorities are listed at edpb.europa.eu.
• United Kingdom complaints may be submitted to the Information Commissioner’s Office.
• Swiss complaints may be directed to the Federal Data Protection and Information Commissioner.

13. U.S. State Privacy Disclosures

Residents of certain U.S. states may have additional privacy rights. The availability of those rights depends on the applicable law and whether Hyviva meets that law’s coverage thresholds.

During the preceding 12 months, we may have collected the categories of personal information described in Section 2 from the sources described there. We may have used and disclosed those categories for the business purposes described in Sections 3 and 5.

We do not knowingly sell personal information for money. We do not knowingly sell or share the personal information of anyone under 16 years of age.

If Hyviva begins selling personal information or sharing it for targeted or cross-context behavioral advertising, we will update this Privacy Policy and provide any legally required opt-out mechanism.

Where required by applicable state law, you may submit a request or appeal using the contact methods in Section 11.

14. Children’s Privacy

Our Sites, products, and services are intended for adults and are not directed to children under 16. We do not knowingly collect personal information directly from children under 16.

If you believe a child has provided personal information to us, contact us at privacy@hyviva.com so that we can investigate and, where appropriate, delete it.

15. Third-Party Sites and Services

Our Sites may contain links to third-party websites or services. Their privacy practices are governed by their own policies, not this Privacy Policy. We encourage you to review the applicable third party’s privacy disclosures before providing information.

Payment pages or embedded payment functions may be operated by Stripe, our payment processor, whose handling of payment information is also governed by its privacy policy.

16. Automated Decision-Making

Hyviva does not make decisions producing legal or similarly significant effects based solely on automated processing of personal information.

If this practice changes, we will provide the disclosures and choices required by applicable law.

17. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our practices, services, technologies, or legal obligations. The “Last updated” date identifies the latest revision.

If a change materially affects how we use personal information already collected, we will provide additional notice or obtain consent where required by law.

18. Contact Us

Questions, concerns, and privacy requests may be directed to: