Privacy Policy
Last updated: September 2026
1. Information We Collect
Account Information
When an organisation administrator account is created, we collect: organisation name, organisation ID, administrator name, user ID, email address, phone number and a securely hashed password. Passwords are never stored in plain text.
Organisation Information
We collect organisation name, organisation type, location and operational status to configure and scope the platform correctly.
Facility Information
We store building, floor and zone information used to organise sensor data and generate reports.
Sensor and IoT Data
We collect sensor readings including energy consumption, water flow, waste metrics, temperature, humidity, CO₂ levels and other configured environmental metrics. Each reading is tagged with its source (IoT or Synthetic), device ID, organisation ID and timestamp. We do not collect personally identifiable information through sensors.
2. How We Use Your Data
- To authenticate and authorise platform access
- To display facility metrics on the dashboard
- To run AI/ML analysis, anomaly detection and forecasting
- To generate sustainability reports
- To send alerts and notifications to authorised administrators
- To maintain audit logs for security and compliance
- To improve platform performance and reliability
3. Data Storage
All data is stored in a PostgreSQL database. Sensor readings, user accounts, organisation data and AI results are stored with organisation-level separation. No administrator can access data belonging to another organisation.
4. Security
- Passwords are hashed using a strong algorithm (Argon2id). Plaintext passwords are never stored.
- All API communication uses HTTPS.
- IoT devices use device-specific credentials — not administrator passwords.
- Role-Based Access Control (RBAC) is enforced at the backend for every request.
- Organisation-level data isolation is enforced server-side.
- OTPs for password reset are time-limited, single-use and rate-limited.
We only claim the security features that are actually implemented in the platform.
5. Access Control
GreenNexa uses three roles: Super Admin, Admin and Operations User. Super Admins manage the platform. Admins manage their assigned organisation only. Operations Users have restricted, permission-based access. Every data request is validated server-side against the requesting user's role and organisation.
6. Data Retention
Sensor data and operational records are retained for the duration of your active subscription. Historical sensor data is preserved even if individual sensors are deactivated — only explicit deletion requests remove data.
7. Deletion
Administrators may request deletion of their organisation's data by contacting GreenNexa. Super Admins can deactivate organisations through the platform. Data deletion is irreversible.
8. Third-Party Services
GreenNexa may integrate with WhatsApp (for message-box pre-fill notifications only — no automatic sending), SMS providers (for OTP verification) and mapping services. No sensor data or personally identifiable information is shared with third parties for advertising purposes.
9. Synthetic Data
If your organisation uses Synthetic Data mode, the data is generated by GreenNexa's simulator for demonstration purposes. It is clearly labelled as synthetic and does not represent real facility conditions.
10. Contact
For privacy-related questions, data requests or deletion requests, please contact GreenNexa through the Contact page. Contact details are configured by the project owner.