Privacy Policy

Who we are

Bywatts (bywatts.pro) is operated by Sunhub. For the purposes of the EU and UK General Data Protection Regulation, Sunhub is the data controller for personal data processed through this site. You can reach our privacy contact at privacy@sunhub.com.

What we collect

We deliberately collect as little as possible. In normal use of the site we process:

• Your IP address and basic request metadata (the page requested, timestamp, browser user-agent). This is inherent to how any website is served and is handled by our hosting provider to deliver and secure the site.
• An aggregate visit count. To avoid double-counting the same visitor, our counter briefly records a one-way (irreversible) hash of your IP address for up to five minutes, then discards it. We never store your raw IP for this purpose and never link it to your identity.
• Your cookie-consent choice, if you set one, stored in a first-party record on your own device so we can honor it. See the Cookie Policy.

When you browse without signing in, we do not collect names, emails, payment details, or location beyond what an IP address inherently implies. We use one cookieless, privacy-preserving analytics tool (Cloudflare Web Analytics) for aggregate traffic and page-performance metrics; beyond that we run no advertising, fingerprinting, or cross-site tracking.

Quote requests. If you use the quote form we collect your name, email, optional phone number, state, zip code, and the project details you enter. We record the moment you gave consent. We share these details with up to 3 verified installers covering your state; only installers on our Featured plan receive your phone number. If no verified installer covers your area we share your details with nobody and tell you so.

Support messages. If you message us we keep your name, email, and message so we can reply.

Accounts. If you sign in, we keep your email address, the listings you have claimed, and a record of your sign-in session. A cookie keeps you signed in for up to 30 days (see the Cookie Policy).

Bywatts Exhibit. If your company uses Bywatts Exhibit, we keep what it enters in its Exhibit Passport: brand colors and fonts, a tagline, logo files and product photos, product lines, and its team. For each team member we keep the email address the invitation was sent to, and the name and job title the member or the company enters. Uploaded files are private and are served by the app only to the people on the company's team at that moment. Every live team member sees the other active members' names, job titles and roles; only the owner sees other members' email addresses and public settings.

What appears on a company's public page. A company's public Bywatts page shows its product lines (name, category and description; photos stay private) once the owner or an editor saves them: there is no separate publish step. It also shows badges Bywatts has awarded and trade shows whose attendance Bywatts has verified. A team member's name and job title appear there only if that member turns this on themselves, and then only the name and job title they see and can edit when they do; the app lets no one else turn it on. Each opt-in and opt-out is recorded (the Passport, the member and account ids, whether they opted in or out, the time and the wording version they were shown), and we keep the text of every wording version, so we can always tell which wording they agreed to. They can turn it off at any time. Installer listings do not show Exhibit details on their public pages yet.

When a change shows. Turning a team member's public setting off takes effect straight away in Exhibit. The public company page is cached for up to an hour, so a change reaches it within an hour. Search engines and web archives may keep an older copy for longer, and we cannot make them delete it.

If a listing changes owner. A Passport belongs to its listing. If a different account becomes the verified owner, it takes over the Passport and its files, and the previous holder loses access. The previous holder's team is paused: they have no access and are not shown publicly until the new owner chooses to keep each of them, and invitations the previous holder sent stop working. The new owner can see the email address, name, job title and public setting of each paused member and each pending invitee from the previous holder, and can keep or remove the paused members and remove the pending invitees. Product lines the previous holder saved stay hidden from the public page until the new owner, or an editor on the new owner's team, saves the Passport. Badges and verified trade shows stay on the public page through a transfer. A kept member's public setting stays as they left it, and a paused member can still turn it off, or leave the team.

Brand import. To suggest a company's brand colors, fonts and logo, Bywatts reads pages from the company's own website, the one on its verified listing, and requests only addresses on that website's own domain. It reads that site's home page, stylesheets and logo images, and sends no cookies or personal data with its requests. It stores what it finds in the company's Passport: the colors, the fonts, up to two logo images as files, and the addresses of the logo images it found on the page (some of which can point to other sites; Bywatts does not request those). The company can change the colors, fonts and logos before it confirms its brand.

Abuse limits. To stop abuse, Bywatts Exhibit counts a signed-in user's invitations, acceptances, uploads and brand imports. The counters are stored under salted one-way hashes (of the account, the IP address or, for invitations, the invited email address), never the raw values.

Why we process it (legal bases)

Under GDPR Article 6 we rely on:

• Legitimate interests (Art. 6(1)(f)): serving and securing the site, preventing abuse, counting visits in aggregate, and running cookieless, privacy-preserving analytics (Cloudflare Web Analytics) to understand aggregate traffic and page performance. These interests are balanced against your rights; the processing is minimal, sets no cookies or client-side identifiers, and is not used to profile you.
• Consent (Art. 6(1)(a)): required only if we ever introduce optional cookies or cookie-based analytics, which would be off by default and gated behind the consent banner. None are active today. Our current analytics (Cloudflare Web Analytics) is cookieless, runs under legitimate interest rather than consent, and - because Cloudflare injects it at the network edge and it stores nothing on your device - is not gated by the consent banner.

Bywatts Exhibit. We process a company's Exhibit Passport, and the details of the team members it invites, to provide the service the company signed up for (Art. 6(1)(b) for the account holder; legitimate interests, Art. 6(1)(f), for the team members the company invites). Showing a team member on the company's public page relies on that member's own consent (Art. 6(1)(a)), which they can withdraw at any time from their Exhibit settings.

Quote requests: consent. We share your details with installers only because you explicitly ticked the consent box, and we record when you did. You can withdraw consent at any time by contacting us, though installers already contacted will already hold your details.

Third parties who receive data

Loading any web page reveals your IP address to whoever serves its content. We keep this list short and name every one:

None of these are advertising networks, and we do not share data with them for marketing. We do not sell personal information to anyone. Our fonts are served first-party from our own domain, so no font provider receives your IP address. If you subscribe to a paid plan, your payment details (card number, billing address) are entered directly on Stripe's checkout and processed by Stripe; we never receive or store your card details ourselves.

Retention

• The visit-count IP hash is deleted automatically within five minutes.
• Server and security logs are retained by our host for a short period under their standard policy and then rotated out.
• Your cookie-consent choice persists on your device until it expires (about six months) or you clear it.
• Bywatts Exhibit's abuse-limit counters expire an hour after they were last updated (a day for the counter that limits invitations to one address).
• A team invitation link works once and expires after 7 days. We store only a hash of its secret in our database, not the secret itself.

Quote requests and support messages are kept for 24 months so we can handle follow-up questions and disputes, then deleted.

A company's Exhibit Passport stays with its listing until the company asks us to delete it; meanwhile the company can change or remove its product lines, remove team members, and delete a file once no brand logo or product line uses it. When a team member leaves or is removed, their email address, name and job title are deleted from the team at once and their open invitation links stop working. We keep a record of their public opt-in choices as proof of what they agreed to (the Passport, the member and account ids, whether they opted in or out, the time and the wording version); the account id still identifies the account holder, whose email address we keep with the account. An invitation that is never accepted stops working after 7 days, but the invited address, and any name and job title the company entered for it, stay on the company's team list until the company removes them. A file the company deletes is removed from storage straight away; a stored file that is no longer used (for example after an interrupted upload) is unreachable and is cleaned up periodically.

Your rights (GDPR / UK GDPR)

If you are in the EU, EEA, or UK, you have the right to access, rectify, erase, restrict, or object to processing of your personal data, the right to data portability, and the right to withdraw consent at any time. If you have only browsed the site, we hold no data that identifies you (only a transient IP hash), so we may be unable to locate data tied to you, but we will help where we can. To exercise a right, email privacy@sunhub.com. You also have the right to lodge a complaint with your local data protection supervisory authority.

Your rights (California, CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act (as amended by the CPRA) gives you the right to know what personal information we collect, to delete it, to correct it, and to opt out of its sale or sharing. For visitors who only browse, the only category of personal information we collect is identifiers (IP address), used solely to serve and secure the site and count visits. For account holders and Bywatts Exhibit team members we also collect contact and professional information (email address, name and job title), used only to provide and secure the service.

We do not sell or share your personal information, and we do not use it for cross-context behavioral advertising. Because we do not sell or share, there is nothing to opt out of, but we still honor the Global Privacy Control (GPC) browser signal as an opt-out of any future sharing. We will not discriminate against you for exercising any privacy right. To make a request, email privacy@sunhub.com.

International transfers

The site is hosted in the United States, and the providers above may process data in the US and other countries. Where required, those providers rely on Standard Contractual Clauses or equivalent safeguards for transfers out of the EU/EEA and UK.

Children

Bywatts is a business-and-infrastructure reference tool intended for a general professional audience. It is not directed at children, and we do not knowingly collect personal data from anyone under 16.

Changes

If our data practices change (for example, if we add optional cookie-based analytics or a new processor), we will update this page and the “last updated” date above, and where the change is material we will surface it through the consent banner.

Contact

Questions about this policy or your data: privacy@sunhub.com. See also our Cookie Policy and Terms of Service.