Privacy Policy

1. Controller

CastValue.ai is operated by FlexUp GmbH, Riedener Weg 34A, 82319 Starnberg, Germany. For any privacy question or request, contact us at hello@flexup.solar.

2. Account and service data

When you create an account we store your email address and, if provided, your name. Forecast providers who upload data via our API have that forecast data, and any API keys they generate, stored to provide the benchmarking service. This data is hosted by Supabase in Frankfurt, Germany (EU). We process this data to provide the service you signed up for (Art. 6(1)(b) GDPR — performance of a contract).

3. Billing

Paid subscriptions are processed by Stripe. We do not store your card details — Stripe handles payment data directly under its own privacy policy. We retain the billing status and amount associated with your account to manage your subscription.

4. Cookies and analytics

We use a small number of strictly necessary cookies (for example, to keep you logged in) that don't require consent. We also use the following analytics tools, which only run after you accept them via the cookie banner shown on your first visit:

• Google Analytics (Google Ireland Limited) — usage statistics, such as which pages are visited.
• Hotjar (Hotjar Ltd., Malta) — session recordings and heatmaps, to understand how the product is used.

These tools may transfer data outside the EU/EEA; both providers offer Standard Contractual Clauses as a transfer safeguard. You can withdraw your consent at any time by clearing your browser's site data for castvalue.ai, which will show the cookie banner again on your next visit. The legal basis for analytics cookies is your consent (Art. 6(1)(a) GDPR, §25 TTDSG).

5. Other service providers

We use Resend to send account, billing, and notification emails, and Vercel to host the web application. Each acts as a data processor under a data processing agreement and only processes data on our instructions.

6. Data retention

Account and forecast data is retained for as long as your account is active. If you'd like your account and associated data deleted, contact us at the address above.

7. Your rights

Under the GDPR, you have the right to access, correct, delete, restrict, or port your personal data, and to object to its processing. You can withdraw consent to analytics cookies at any time (see Section 4). You also have the right to lodge a complaint with a data protection supervisory authority — in Germany, the authority responsible for Bavaria is the Bayerisches Landesamt für Datenschutzaufsicht.

8. Changes to this policy

We may update this policy as the service evolves. Material changes will be reflected by updating the date at the top of this page.