Privacy Policy
In force from 28 September 2026 for accounts created from that date, and from 28 October 2026 for existing accounts
1. Who we are
Shelly Fleet Manager and Shelly Business Manager are provided by Shelly Europe Ltd., UIC 202320104, 103 Cherni Vrah Blvd., 1407 Sofia, Bulgaria ("Shelly", "we"). Data Protection Officer: dpo@shelly.com. General contact: fleet_manager@shelly.com.
2. Two roles
- We are the controller for: your account as the customer's contact, subscriptions and billing, support, our website (forms, call bookings, AI Advisor, traffic statistics) and marketing. This policy describes that processing.
- We are a processor for everything our business customers put into their fleets: their users, devices, sites, energy and sensor data, alerts and logs. The customer (your employer or the company that runs the building) is the controller and decides how that data is used. That processing is governed by our Data Processing Agreement. Questions about it should go to that company first; we will pass on requests we receive.
3. What we process as controller
| Purpose | Data | Legal basis | Kept for |
|---|---|---|---|
| Creating and running your account | Name, e-mail, password (hashed), organisation, language and time zone, login and security events | Contract (Art. 6(1)(b)) | While the account exists |
| Subscriptions, invoices and payments (Fleet Manager is paid by bank transfer; Business Manager is free for now) | Company name, VAT number, billing contact, plan, invoices, payer bank details shown on the transfer | Contract; legal obligation – accounting law (Art. 6(1)(c)) | 10 years (Bulgarian Accountancy Act) |
| Support | Your messages, support history, technical information you share | Contract; legitimate interest in helping customers | 3 years after the ticket is closed |
| Trial, reseller and contact forms on the website | Name, e-mail, company, website, country, use case, fleet size, how you heard of us, IP address, time | Pre-contract steps at your request; legitimate interest in answering business enquiries and stopping spam | 24 months if no contract follows |
| Booking a call | Name, e-mail, company, chosen time, what you want to discuss | Pre-contract steps at your request | 24 months |
| AI Advisor chat on the website | What you type in the chat; your IP address for a daily message limit (kept in memory only) | Legitimate interest in helping visitors choose the right Shelly product | Chat text is not stored by us |
| Website traffic statistics | Page, referrer, campaign tag, and a daily pseudonymous code made from IP address and browser – no cookies | Legitimate interest in knowing which channels bring visitors | 13 months |
| Contacting you to understand your problems and improve our services | Name and the e-mail you registered with; your answers and feedback | Legitimate interest in improving the Service for business customers (Art. 6(1)(f)) – you can say no at any time | While the account exists; feedback notes 3 years |
| Business Manager portal account | Name, e-mail, company, projects, what you ask the AI template editor, images you upload | Contract (Art. 6(1)(b)) | While the account exists; deleted 30 days after it is closed |
| Push notifications and marketing e-mails | Push token; e-mail address | Consent (Art. 6(1)(a)) – withdraw at any time in the app or via the link in each e-mail | Until you withdraw |
| Security, fraud prevention and legal claims | Logs of logins and actions, IP addresses | Legitimate interest in protecting the Service | Per retention schedule (90 days – 2 years) |
How we contact you
Shelly may contact everyone who has an account in the Service – Fleet Manager customers and their users, Business Manager portal users (installers), and the users installers create for their own clients – at the e-mail address used for registration, to understand how they use the Service, ask about problems they face, invite them to short feedback calls or surveys, and improve Shelly's services. These messages are not advertising, and every message includes an easy way to say no to further contact. Saying no does not affect the account; essential service messages (security, billing, changes to the terms) are still sent.
4. The Fleet Manager Assistant (FMA) app
The FMA app connects Shelly devices to a Fleet Manager account. It sends your login and, if you allow notifications, a push token to Fleet Manager. Wi-Fi passwords you enter are sent to the device over Bluetooth only – never to our servers. Push notifications are delivered through Google Firebase Cloud Messaging and, on iPhones, Apple Push Notification service.
5. Who receives data
We use these service providers. They act on our instructions under data processing agreements:
| Sub-processor | What for | Personal data | Location | Safeguard |
|---|---|---|---|---|
| Google Cloud (Google Cloud EMEA Ltd. / Google LLC) | Hosting: virtual machines, disks and networking for all Fleet Manager stacks (application, databases, identity service) | All personal data in the Service | EU – Belgium (europe-west1) | Google Cloud DPA; SCCs + EU-US Data Privacy Framework for any access from outside the EU |
| Google Firebase Cloud Messaging (Google LLC) | Push notifications to the Fleet Manager Assistant (FMA) app; iOS delivery is passed on to Apple Push Notification service | Push token, device platform, notification title/text (may include device and location names) | USA / global | Google DPA; EU-US Data Privacy Framework; SCCs |
| Anthropic PBC | Business Manager AI template editor: turns the installer's chat requests into portal design and template changes | Chat messages, uploaded images and logos, template settings; any names the user types into the chat | USA | Anthropic commercial terms and DPA with SCCs; API data not used for model training |
| Apple Inc. (Apple Push Notification service, via FCM) | Delivering push notifications to iPhones | Push token, notification text | USA | Apple terms; EU-US Data Privacy Framework |
| OpenStreetMap Foundation (Nominatim) | Turning site addresses into map coordinates and back (geocoding) | Location addresses and coordinates entered for sites (not linked to a person by the Service) | United Kingdom | UK adequacy decision |
| CARTO / OpenFreeMap (map tiles) | Map background shown in the web app; loaded directly by the user's browser | User's IP address and requested map area | EU (CARTO: Spain); OpenFreeMap as fallback | Provider terms; only IP address and requested map area |
E-mail: All e-mails from Fleet Manager and Business Manager (account verification, password reset, one-time codes, Business Manager feedback) are sent through Shelly's own mail server (mail.shelly.cloud), which Shelly runs on Google Cloud in Belgium. No separate e-mail provider is used. Alert e-mails go out through the SMTP server or Gmail / Microsoft 365 account that the Customer configures.
Call bookings on our scheduling page are handled by a self-hosted Cal.com; its confirmation e-mails are currently sent through Brevo (France).
Alexa: a Shelly Fleet Manager Skill for Alexa Smart Properties exists but is not available yet. If it is launched and a customer enables it, the device names and states requested by voice will be exchanged with Amazon under the customer's own Amazon agreement. We will update this policy before launch.
For the website we also use Groq, Inc. (USA) to answer AI Advisor chats, with the safeguards described in section 6. Map tiles on the website and in the app are loaded from CARTO/OpenFreeMap, which see your IP address.
We do not sell personal data. We share data with authorities only when the law requires it.
6. Transfers outside the EU
Our servers are in the EU (Google Cloud, Belgium). Where a provider processes data outside the EEA (for example push notification services and the AI Advisor provider in the USA), we rely on the EU-US Data Privacy Framework or the EU Standard Contractual Clauses.
7. Your rights
You can ask for access, correction, deletion, restriction, a copy in a machine-readable format (portability), and object to processing based on legitimate interest or to direct marketing. You can withdraw consent at any time. Send your request to dpo@shelly.com; we answer within one month. You can change some data yourself in your account settings; to delete your account or get a copy of your data, e-mail dpo@shelly.com.
You can complain to the Bulgarian Commission for Personal Data Protection (www.cpdp.bg), to the authority in your EU country, or – in the UK – to the Information Commissioner's Office (ico.org.uk).
8. Security
We use encryption in transit, encrypted storage of device and integration credentials, separated customer environments, role-based access, rate limiting and audit logging. Details are in Annex II of our Data Processing Agreement.
9. Changes
We update this policy when the Service changes. We tell account holders about important changes by e-mail or in the platform before they take effect.