This Privacy Policy explains how Levellume (operated by Lars Huyghe, Belgium) collects, uses, and protects your personal data when you visit levellume.com, place an order with us, or use a Levellume device (the P1 dongle and light fixture) and the Levellume app at app.levellume.com. We are committed to safeguarding your privacy in accordance with the General Data Protection Regulation (GDPR) and applicable Belgian data protection law.
1. What data we collect
We collect the following personal data:
- Order information — your name, email address, shipping address, and phone number, collected through our Stripe-powered checkout.
- Payment data — processed entirely by Stripe. We do not store your credit card number or payment details on our servers.
- Referral cookies — if you arrive via a referral link, we store a referral code in a cookie to attribute your visit to the referring person.
- Analytics data — anonymised usage data collected through Google Analytics, including pages visited, session duration, device type, and approximate geographic location.
- Account data — if you create an account, your email address and authentication credentials are managed through Firebase Authentication.
- Home energy data — when you connect a Levellume device to your account, the dongle reads your smart meter (electricity consumption and production, gas, and water where a water sensor is fitted) and sends readings, daily totals and the levels derived from them to our cloud, typically once a minute. The fixture's built-in sensors add indoor temperature and humidity. This data is tied to your home and account, so it is personal data.
- Device and settings data — the device identifier, its network name and Wi-Fi signal, firmware version, diagnostics and crash reports, and the settings you choose (the name you give your home, daily budgets, tariffs, capacity limit, display configuration).
- Assistant questions — if you use the assistant in the app, the questions you type. Your recent readings are included as context only after you switch that on in the app.
2. Why we collect it
We use your personal data for the following purposes:
- Order fulfilment — to process, ship, and deliver your order, and to communicate about order status.
- Referral tracking — to credit referrals and manage our referral programme.
- Website analytics — to understand how visitors use our website so we can improve the experience.
- Customer support — to respond to your questions or requests.
- Showing you your home — to display live and past energy, gas and water use on your fixture and in the app, at home and away, and to let the people you share your home with see the same. This is the service you bought; the legal basis is the contract with you.
- Running your device — to apply your settings, deliver firmware updates, keep the device and the fixture paired, and diagnose faults.
- The assistant — to answer the questions you ask it about your usage.
- Legal obligations — to comply with tax, accounting, and other legal requirements under Belgian and EU law.
3. Third parties
We share your data only with trusted third-party services that are necessary to operate our business:
- Stripe — payment processing. Stripe acts as an independent data controller for payment data. See Stripe's Privacy Policy.
- Google Analytics — website analytics. Data is anonymised and processed in accordance with Google's Privacy Policy.
- Firebase (Google Cloud) — website and app hosting, authentication, and the databases and cloud functions that store and process your home energy data, device data and settings. Google acts as our processor under the Google Cloud Data Processing Addendum.
- OpenAI — generates the assistant's answers. When you ask the assistant a question we send OpenAI your question and, only if you have switched it on, a summary of your recent readings. OpenAI processes this as our processor through its API and does not use it to train its models. See OpenAI's Privacy Policy.
Where your data is stored. Your home energy data, device data and account data are stored in Google Cloud data centres in the United States (Firebase Realtime Database and Firestore, US regions); the assistant's requests are processed by OpenAI in the United States. These transfers outside the EU rely on the EU-US Data Privacy Framework where the provider is certified under it, and otherwise on the European Commission's Standard Contractual Clauses that are part of each provider's data processing terms. We will state it here if this changes.
We do not sell, rent, or trade your personal data to any third party for marketing purposes.
4. Cookies
We use a limited number of cookies:
- Referral cookie — stores the referral code from a referral link. Expires after 30 days.
- Google Analytics cookies — used to distinguish users and track sessions. See Google's cookie policy for details.
- Firebase authentication cookies — used to maintain your login session if you create an account.
We do not use advertising or tracking cookies beyond what is described above. The Levellume app itself sets no cookies and runs no analytics; it keeps your sign-in and your preferences in your browser's own storage on your device.
5. Data retention
We retain your personal data only for as long as necessary to fulfil the purposes described in this policy:
- Order data — retained for 7 years to comply with Belgian tax and accounting requirements.
- Analytics data — retained for 14 months (Google Analytics default).
- Referral cookies — expire after 30 days.
- Account data — retained until you delete your account.
- Home energy, device and settings data — retained for as long as your account exists, so that your history and comparisons keep working, and deleted with your account.
- Assistant questions — kept with your account for the assistant's context; deleted with your account.
Deleting your account. In the app, open Settings and choose "delete account & all data". This removes your account, every device linked to it and all of its cloud data including readings, and your sign-in. It is immediate and cannot be undone. You can also ask us by email.
6. Your rights under GDPR
As a data subject under the GDPR, you have the following rights:
- Right of access — you can request a copy of the personal data we hold about you.
- Right to rectification — you can ask us to correct inaccurate or incomplete data.
- Right to erasure — you can request that we delete your personal data, subject to legal retention obligations.
- Right to data portability — you can request your data in a structured, machine-readable format.
- Right to restrict processing — you can ask us to limit how we use your data in certain circumstances.
- Right to object — you can object to processing based on legitimate interests.
- Right to lodge a complaint — you have the right to file a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit).
7. Data security
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. All data transmitted through our website, the app and the device is encrypted using TLS/SSL. Each device authenticates to our cloud with its own credential, and a home's data can only be read by the account that set the device up and the people that account shares it with. Payment processing is handled entirely by Stripe, a PCI DSS Level 1 certified provider.
8. Contact
For any questions about this Privacy Policy or to exercise your data rights, please contact us:
Last updated: 10 September 2026 — added the Levellume device and app: home energy data, the assistant (OpenAI), where data is stored, and in-app account deletion.