Your data, handled the
way sunlight travels — transparently.

360watts is operated by Matterless Technologies (OPC) Private Limited ("360watts", "we", "us"), Coimbatore, Tamil Nadu, India. We provide solar installation, monitoring and after-sales service ("360Care"). We decide why and how your personal data is used, which makes us the data fiduciary under the Digital Personal Data Protection Act, 2023.

This policy covers our website (www.360watts.com), the customer portal, our mobile apps, the monitoring devices installed at your site, and our email and WhatsApp communications. Our systems run in India (AWS Mumbai). The section "Data Outside India" lists the few places where data can leave India.

• Account details. Name, email, phone number and site address, when you register, are added by our team, or request a quotation. Your password is stored only as a salted hash.
• Website enquiries. Name, phone, email, city or company and message, when you use the contact form. These are emailed to our team and are not saved in our database.
• Solar and device data. Energy generation, consumption, battery, grid and device-health readings from the inverter, meters and smart plugs at your site, plus the site location (coordinates) used for forecasts.
• Service records. Bookings, technician assignments, completion notes and the messages around 360Care visits.
• Billing configuration. Tariff and billing-period data used to calculate savings. We do not store card details.
• Assistant chats and voice. What you type to the in-app assistant, and short voice recordings if you use the microphone.
• Technical data. Sign-in and access logs (IP address, time, device type), app notification tokens, and device heartbeat records from our gateways.
• Communications. Emails and WhatsApp messages exchanged with our support and field teams.

We use your data only for these purposes:

We do not sell your personal data and do not use it for advertising. The basis for most of this is your consent when you register, plus our legal duties and the service you asked for. You can withdraw consent at any time (see Your Rights).

Inverters, meters, smart plugs and our IoT gateway report readings every few seconds to minutes. Some devices are read through the maker's cloud (Deye Cloud for inverters, Tuya for smart plugs), using the India-region service. The readings power your dashboard and alerts and, in aggregated and de-identified form, train our forecasting models. Device-level readings are not shared outside 360watts and the providers listed under Who We Share With.

The in-app assistant answers questions about your system. To do that, your message and the relevant site, device and alert data are sent to a language model on Amazon Bedrock in Mumbai. If you hold the microphone button, the recording is sent to Amazon Transcribe in Mumbai to turn it into text. Neither is sent outside India.

Assistant answers can be wrong: check anything important with our team before acting on it. We do not use the assistant to make decisions about you that have legal effect.

Only service providers that help us run 360watts receive your data, and only what they need:

• Amazon Web Services, Mumbai (India). Servers, database, backups, file storage, transactional email (SES), the assistant (Bedrock) and voice-to-text (Transcribe).
• Deye Cloud and Tuya. The makers' cloud services for inverter and smart-plug data. We use their India-region endpoints.
• Meta (WhatsApp Business Platform). Messages you have opted in to receive or exchange.
• Google Firebase Cloud Messaging. Push notifications in the mobile app (device token and notification text).
• Open-Meteo and Solcast. Weather and solar-forecast services. They receive your site coordinates only, never your name or contact details.

We do not share data with advertisers or data brokers. We disclose data if the law or a court requires it.

Our own systems, database and backups are in India. Data can leave India only through the third parties above that run their own services: Google Firebase (push notifications), Meta (WhatsApp), Open-Meteo and Solcast (site coordinates), and possibly Deye and Tuya, whose own processing locations we have asked them to confirm in writing. Where the law restricts a transfer of specific data, we will follow it.

We use only the cookies and browser storage needed to run the portal. We do not use advertising or analytics cookies or trackers on this website.

Messages you exchange with us on WhatsApp are processed by the WhatsApp Business Platform (Meta), under Meta's Business Data Processing Terms. We message you only where you have opted in, and you can opt out by telling us. One-time completion codes are stored hashed and are sent only to the customer who requested the service.

• Account and site data: while your account is active. After you ask us to delete it, within 30 days (see the deletion page).
• Raw device readings: about two weeks, then summarised into five-minute averages kept for 90 days. De-identified aggregates used for forecasting may be kept longer.
• Device heartbeat records: 30 days.
• Backups: up to 13 months, so deleted data can still sit in a backup until it expires.
• Access and security logs: at least one year.
• Service, billing and warranty records: up to 7 years where Indian accounting, tax or warranty law requires.
• Website enquiries: kept in our team mailbox for up to 12 months, then deleted.

Traffic is encrypted (HTTPS/TLS) and our systems and database run in AWS Mumbai. Passwords and verification codes are stored hashed. Staff access is limited by role. If a breach affects your personal data we will tell you and the Data Protection Board as the law requires. No system is perfectly secure, so use a strong password and tell us at once if you suspect misuse of your account.

You can, by emailing hello@360watts.com:

We reply within 30 days, and we may need to confirm your identity first. If you are not satisfied, write to our grievance contact below and we will respond within 30 days. You can then complain to the Data Protection Board of India.

Our services are for property owners and businesses. We do not knowingly collect data from anyone under 18. If you think a child has given us data, tell us and we will delete it.

We update this policy as our services and the law change. The effective date above shows the latest version, and for material changes we will also notify account holders by email or in the app.