Skip to content
hello@sentinelapp.solar
Sign in Apply for access
Legal

Privacy policy

Last updated 25 October 2026. We've tried to write this in plain English. If anything's unclear, email hello@sentinelapp.solar and we'll fix it.

Who we are

Sentinel is operated by RVTC LTD, a UK private limited company registered in England and Wales. Our registered contact for data-protection enquiries is hello@sentinelapp.solar.

What data we collect

From a paired inverter

When an approved installer pairs to a customer's GivEnergy system, the local Sentinel agent reads telemetry over the Modbus interface and forwards a summary to our cloud service (see “Where it’s stored”). This includes:

  • Power values (solar, battery, grid, load) and state of charge
  • Battery voltage, current, temperature and energy counters, and the status and warning flags the battery reports
  • Inverter temperature, run state, firmware version, fault and error codes
  • Charge / discharge schedule and mode settings
  • On a site with a GivEnergy energy management unit (EMS), the unit’s own figures for the whole site and, when the engineer reads them, its settings

We do not read or transmit the customer's home WiFi password, or anything held on other devices on the network. To find the inverter, the Sentinel app tries the port GivEnergy inverters use at each address on the home network, and asks any address that answers whether it is a GivEnergy inverter. What it sends us about the network is limited to two things. First, the network address of each inverter it connects to, which is passed to the engineer for the session. Second, if an engineer asks the app to search the network again, the network addresses of other devices that answered on that port without proving to be a GivEnergy inverter, each with a short reason such as “timed out” or “answered, but not as a GivEnergy device”. That search result goes to the engineer’s screen through our relay; we do not store it. Nothing else about other devices on the network is sent.

From approved installers

  • Account details — name, email address and installer credentials when you apply for and hold a Sentinel access account.
  • Access activity — the pairing sessions, register reads and customer-approved access windows carried out under your account, for audit and safety.
  • Support enquiries — anything you send us by email, contact form, WhatsApp or phone.

From the customers whose systems are accessed

  • Site and system identity — the inverter serial, site reference and any contact detail needed to run a support session an installer is carrying out with the customer's agreement.
  • 48-hour access authorisations — if you give your installer 48-hour access from the Sentinel app on a Mac or Windows PC, we record the name you type to authorise it, the engineer it was granted to, and when it starts and ends. From version 1.2.0 of the Sentinel app, the screen where you give it also says “RVTC’s administrator can also connect during these 48 hours, to help your engineer.” Access you give on that screen lets RVTC’s administrator connect as well, and we record that it does. Access given from an earlier version is your engineer’s alone. Your engineer sees your name while the access lasts, so it is clear who allowed it, and in their list of past systems for as long as we keep it. See below for how long that is.
  • What the app keeps on your own device — the Sentinel app keeps a few small files in its own data folder on your phone or computer (on Windows, a Sentinel folder under your AppData): the install id our server gave it, and the network address of the inverter it last connected to, so it can find it again quickly. From version 1.2.0 it also keeps, for each inverter, the addresses at which its battery packs answered (battery_packs.json), so it can find them again quickly too; it holds no readings. On a Mac or Windows PC it also keeps what 48-hour access needs: a second install id with the token the app uses to reconnect, the 48-hour authorisations you have given (including the name you typed, the engineer’s name and the system’s label), and, for an authorisation you stop early, its reference number until the time it would have ended. An authorisation is removed from that list when you stop it, and one that has run out is removed the next time the app starts.
  • Write records — when an approved installer makes a change, we record the change itself (register, value, the engineer who made it, the system, and the time) in our audit log. A change made by RVTC’s administrator is recorded against the administrator in the same way. The permission is given on the customer’s own device — a change window only they can open, or 48-hour access only they can grant — and is enforced there: the inverter is never the server’s to command. Alongside each change we also record whether that permission was confirmed by the device or could not be verified, so the log is honest about which of the two it was.

How we use it

  • To run the remote-support and monitoring sessions approved installers use Sentinel for.
  • To detect faults on a paired system and surface them to the engineer.
  • To administer installer access accounts and enforce the eligibility policy.
  • To respond when you contact us.
  • To improve Sentinel — aggregated, anonymised fault patterns help us catch more issues faster across the fleet.

We do not sell your data. We do not share it with marketers. We do not show third-party ads on Sentinel.

Who we share it with

  • Solar Tech Support (sister brand, same legal entity) — fault alerts and engineer-access sessions carried out through Sentinel.
  • Cloudflare — hosts the Sentinel cloud infrastructure and relays the pairing connection (see “Where it’s stored” for where).
  • Formspree — receives what you type into the forms on our homepage and on the About, How it works, Apply for access, Why Sentinel exists and Contact pages, and passes it on to Sentinel’s inbox.
  • HMRC / regulators — when legally required.

Where it's stored

Sentinel runs on Cloudflare. The write-once audit archive is held in Cloudflare’s EU jurisdiction, which is a contractual data-location boundary. Our main database is configured with a Western-Europe location hint: in practice it is served from Western Europe, but Cloudflare treats a location hint as a performance setting rather than a guaranteed jurisdiction boundary, so we do not claim your data is technically prevented from leaving the UK / EU. If you contact us from outside the UK / EU, email replies may route through your local server.

Formspree, Inc. (a US company) processes what you type into these forms in the United States and other countries where it operates. The entries stay in our Formspree account until we delete them.

How long we keep it

  • Readings from your system — removed from our live database after 48 hours, automatically. Live figures pass through the relay to your installer’s screen while your read window is open, and a summary is also written to our database so that an engineer given 48-hour access can see what happened while they were away rather than only from the moment they connect. That summary includes your solar, battery, grid and home power figures; your inverter’s temperature; your battery’s state of charge, temperatures, voltage and current, and the per-cell voltages and status and warning flags it reports; and your battery’s own details: its serial number, firmware version, charge-cycle count and the capacity figures it reports. It also holds the inverter’s own readings of its battery’s voltage and current, and the inverter’s run state (for example, waiting or running normally). On a site with a GivEnergy energy management unit, it also holds the unit’s own figures for the whole site: grid, battery and home power, and the average state of charge. An automatic job deletes anything older than 48 hours. Our database provider also keeps restore points of the database, so that it can be recovered after a failure; those expire within 30 days, so a reading can be held in them for up to 30 days after it was removed.

    Who can see that summary: an engineer you have given 48-hour access to, while it lasts; any engineer who has worked on your system before, for as long as their own Sentinel account is active, even after their access has ended; and RVTC’s administrator, who runs Sentinel.

    This changed on 10 September 2026, and we should have said so at the time. Until then nothing was stored, and an earlier version of this page said we would update it before switching storage on. We enabled it first and updated this page afterwards, which was the wrong way round. On 12 October 2026 we added your battery’s own details (serial number, firmware, cycle count and capacity) to the summary, and updated this page before that change was switched on. Nothing else about what we kept, or for how long, changed then.
  • 48-hour access authorisations, including the name you typed to authorise one — kept for up to 90 days after the access period ends, then deleted automatically. For access you end early, the 90 days run from the time it would have ended. We keep it so that, if we need to assess your system in future, we can see who allowed access to it and when; that is our legitimate interest in keeping it. The audit log records that the access happened and which engineer used it; it does not keep your name.
  • Backups — once a day we copy our main database (installer accounts, the audit log and the 48-hour access authorisations, including the names typed to authorise them, but not your readings) so that we can recover it after a failure. Each copy is kept for 90 days, then deleted automatically. Something deleted from the live database can stay in those copies until they expire, and in the database’s own restore points for up to 30 days.
  • Audit log (every engineer action and every write on a system, tied to the engineer who made it) — kept indefinitely, for safety and legal reasons. It is an append-only record: entries are never edited or deleted, and a correction is added as a new entry rather than changing an old one. A copy is mirrored to a write-once archive that cannot be altered or removed for at least six years.
  • Installer account records — kept while your access account is active, then deleted on the same schedule as our other business records.
  • Support correspondence — 2 years, then deleted.

Your rights under UK GDPR

You can ask us to: see what we hold on you; correct anything wrong; delete your account; have a copy of what we hold (your account record, the audit entries for your system, any 48-hour access authorisations that carry your name, and any readings from the last 48 hours that have not yet been deleted); restrict processing; or object to a particular use. Email hello@sentinelapp.solar and we'll respond within 30 days. If you're not happy with our response you can complain to the ICO.

Cookies

The Sentinel website uses a minimal set of strictly-necessary cookies only (session auth, CSRF). We set no analytics, tracking, advertising, or cross-site cookies.

Security

The Sentinel agent connects to our cloud over an outbound, encrypted connection only. Nothing listens for incoming connections, so nothing has to be opened on your router. Sentinel is read-only by default. Any change to a customer's inverter needs the customer's permission, given on their own device: a change window they open themselves, which closes on its own, or 48-hour access they grant and can cancel at any time. No engineer, and no part of our system, can give that permission. Every change is recorded to a permanent, tamper-evident log before it is sent to the inverter — the entries are hash-chained, so a later edit or deletion is detectable, and no engineer can alter or remove one. Only the account owner can erase an entire system's record (for example to clear a test), and every erasure is itself permanently logged.

Changes to this policy

If anything material changes in future, we'll email approved installers, and ask them to tell the customers whose systems they look after. Minor wording tweaks are tracked in the date at the top.

What changed on 25 October 2026:

  • The name you type to give 48-hour access is now kept for up to 90 days after the access ends, rather than deleted when it ends, and we say why.
  • From version 1.2.0 of the Sentinel app, 48-hour access can also let RVTC’s administrator connect, and the app says so before you agree.
  • We now say that readings are removed from our live database after 48 hours and can stay in its restore points for up to 30 days, how long our backups are kept, and who can see the stored readings.
  • We now say what the Sentinel app sends us about your home network when it looks for your inverter, and list the battery-pack file the 1.2.0 app keeps on your device.
  • We now list everything the stored summary of readings holds, including your inverter’s temperature and run state, your battery’s voltage, current and warning flags, and the inverter’s own readings of its battery.
  • Where this page describes your permission for a change to your inverter, it now names both ways of giving it: a change window during a call, or 48-hour access.
  • We now name Formspree, which receives what you type into the forms on this website, and say where it processes what you type and for how long.