Privacy and cookies

Who processes the data

Service operator: the owner of the svitlo-lux.com.ua website; full details are provided on request at support@solars.com.ua. Requests concerning personal data: support@solars.com.ua.

What data we store

Account data: email, display name, secure password hash, privacy and notification settings and, optionally, a phone number and a private address in the profile.

Technical session data: a shortened browser string (up to 200 characters) and an irreversible keyed hash of the IP address; the IP addresses themselves are not stored in the sessions table.

Organization data: legal name, EDRPOU code, registered address, registration and authority documents, and the organization's bank details. Documents are kept in restricted storage, and access to them is logged.

Transfer declaration data: amount, date, masked reference text and, optionally, a receipt. The payer's full name from statements is not stored: only a mask is kept in the log.

Enquiries and complaints: the text you enter in the form, the selected reason and, for complaints without an account, an irreversible keyed hash of client attributes needed for rate limiting.

What is never published

We do not publish apartment addresses, names, contact details, receipts or bank documents. The public page shows only totals and anonymous light dots.

Linking a contribution to a window on the facade is possible only with your separate consent. Consent can be withdrawn at any time: the link disappears immediately, while the confirmed amount does not change.

Cookies and counters

The site sets one technically necessary session cookie (named sl_sid, and __Host-sl_sid on a secure connection). It appears only after sign-in, registration or password recovery, is marked HttpOnly and SameSite=Lax, and lasts no longer than the session.

The maximum session duration is 14 days. The site does not set cookies for advertising, profiling or third-party analytics, no third-party analytics scripts are connected. The browser's localStorage holds only the colour theme choice (key svitlolux-theme with the value light or dark); it contains no personal data, is not sent to the server, and is not written at all in the system theme mode. The site does not use sessionStorage.

To understand which pages are useful, the site keeps aggregated counters without cookies, without visitor identifiers and without IP addresses: event types, page group and referral source group are counted separately. Requests with DNT and GPC signals, and bots, are not included in the counters.

If cookies requiring consent are added in the future, this section will be updated before they are enabled.

Calculator submissions

The calculators work without registration and without saving the numbers you enter. If you leave a contact in a form, we store it together with a consent record (version and text hash) and irreversible hashes of the contact and the IP address for abuse protection.

Submissions are deleted automatically after 180 days. Immediately after submitting, you receive a one-time withdrawal code: with it the record is deleted at once. The contact is not passed to equipment suppliers, including SunEco, automatically.

Retention periods

Organization documents are kept for 1825 days and receipts for 730 days, counted from upload; calculator submissions for 180 days; aggregated counters for 400 days; technical server logs for 30 days. After the period ends, the files are deleted, and the fact of deletion remains in the log.

These periods are set by the platform settings as of the date of this draft and are provisional pending a lawyer's opinion. The retention period for enquiries and complaints has not yet been defined in the settings: this is an open question for the operator.

Who receives the data

The platform does not sell data and does not pass contacts to equipment suppliers automatically. Third-party providers (hosting and an email service) are used to run the site and send emails; the operator will list them once they are chosen. Data may be provided to state authorities only in the cases and in the manner provided by law.

Your rights

In your account you can download your data in a machine-readable format, correct your profile, change your privacy and notification settings, and submit a request to delete your account.

Deletion is carried out after a grace period (14 days) by anonymization; the procedure is described on the page "Data export and deletion". For requests made outside the account: support@solars.com.ua.

Security

Bank details are encrypted, critical operations require the password to be confirmed again (valid for 10 minutes), access to documents is issued through short-lived links (300 seconds), and the action log is protected by a checksum chain that is verified periodically.

Quick applications, the jar and the Telegram chat

For a quick application we store the title, city, a note about the building, the purpose, the desired amount, the description, the jar link, the organiser’s marks of received amounts (amount, date, an optional short note that is not published) and moderation records. The public page shows the title, city, purpose, amounts, totals and dates of receipts. Contact details in the text of an application are rejected or hidden.

The jar link is stored as text. The platform does not open it automatically; a moderator reviews it by hand.

If the Telegram chat check is enabled, the bot stores only the chat identifier, its type, the number of members and the time of the check. Message texts, names and member identifiers are not stored; the bot reacts only to the command that confirms the code.

The retention period for quick applications and moderation records is not yet defined: this is an open question for the operator and a lawyer.