Privacy Notice

Who is responsible

Elektron Energy (“Elektron”, “we”, “us”) operates this website and is the controller of the personal data described in this notice. For any question or request about your data, write to legal@elektron-energy.com.

This notice covers this website and its APIs. It does not cover other websites we link to, which have their own policies.

What we collect and why

The public site has no visitor accounts, sign-up, newsletter, contact form or comment box, so we do not ask for your name, email address or any other contact details. The personal data we handle is limited to what follows.

Server access logs

Each time your browser asks this site for a page or for data, our server records:

• your IP address;
• the date and time;
• the page or data address requested, without the part after “?”, and the request method;
• the response status and how long the response took;
• your browser’s user-agent string, which describes your browser, its version and your operating system;
• the referring page, meaning the full address of the page you came from, if your browser sends it;
• for IPv4 addresses, an approximate location and network looked up from the address: country, region, city, approximate coordinates of that city, and the name of your internet service provider.

Requests for images, scripts and stylesheets are not logged, nor are health checks or requests from browsers that identify themselves as bots, crawlers or monitoring services.

Why

To keep the site secure (spotting and stopping abuse, attacks and excessive scraping), to keep it running and fix faults, and to understand in aggregate which pages are used.

Legal basis

Our legitimate interests in securing and operating the site (Article 6(1)(f) GDPR).

Kept for

90 days, then deleted automatically.

Seen by

Only our site administrator.

We do not try to identify individual visitors from these records, and we do not combine them with other information about you.

Location lookup

To find the approximate location and internet provider for an IPv4 address, our server sends that address, and nothing else, to ip-api.com, an IP-geolocation service. IPv6 and private addresses are not sent. The answer is stored with the access-log entry and held in server memory until the server process restarts.

Protection against abuse

To stop any one address from overloading the site, our servers count recent requests from each IP address and temporarily refuse further requests from addresses that send too many. These counters are kept in server memory only and are lost when the server process restarts. When a request is refused this way, the access log marks it, and the application’s technical log records the IP address and page.

Administrator sign-in

The site has a single administrator account. When anyone tries to sign in, we record the username entered, the IP address, the time and whether the attempt succeeded. We also keep a security log of sign-ins, sign-outs, blocked attempts and password changes, with the IP address. This only concerns people who use the sign-in page.

Why

To block password-guessing attacks and keep a record of access to the administration area.

Legal basis

Our legitimate interests in protecting the site (Article 6(1)(f) GDPR).

Kept for

90 days, then deleted automatically.

Technical log files

Our web server and application also write technical log files, used only for troubleshooting and security. Entries can include IP addresses, the full requested address (including the part after “?”), the referring page and the browser user-agent. They are accessible only to our administrator and are not used for analytics. The files that record IP addresses are rotated automatically, so older entries are deleted over time.

Visit statistics

We count visits with a self-hosted installation of Plausible Analytics, loaded from analytics.nxtmining.com. Plausible sets no cookies, stores nothing in your browser, does not follow you across other websites, and does not store your IP address. It produces aggregate statistics only: pages viewed, referring websites, browser, operating system, device type, and country or region.

Legal basis

Our legitimate interests in knowing which pages are useful (Article 6(1)(f) GDPR).

Calculator and simulation inputs

Values you enter in calculators and simulations are sent to our server to compute the result. We do not store them against you, and they are not part of the access logs. Some pages put their settings in the page address so you can share a link; those settings travel with the link, and appear in technical log files as part of the address.

Cookies and browser storage

We use no advertising, analytics or tracking cookies. The only items this site stores in your browser are:

• session: a cookie set on your first visit. It holds a random security token that protects the site against cross-site request forgery. It expires when you close your browser. For the administrator, it also keeps the signed-in session for up to 24 hours.
• remember_token: a cookie set only for the administrator, and only if “remember me” is ticked at sign-in. It keeps the administrator signed in for up to 365 days.
• elk-beta-notice-dismissed-at: an entry in your browser’s local storage, written only if you close the beta notice. It records when you closed it, so the notice stays hidden for 30 days. It never leaves your browser.
• elk-publication-mode: an entry in your browser’s local storage, written only if you turn on Publication mode. It remembers that you chose the white look, and is removed when you turn it off. It never leaves your browser.

These are strictly necessary for the site to work securely or to remember a choice you made, which is why we do not ask for cookie consent. You can delete them at any time in your browser settings.

Content loaded from other providers

Your browser loads some code, icons, fonts and chart libraries directly from other providers. When it does, those providers receive your IP address and browser details, as with any web request, and handle them under their own privacy policies:

• jsDelivr (cdn.jsdelivr.net): page and chart libraries, on every page;
• cdnjs, run by Cloudflare (cdnjs.cloudflare.com): icons, on every page;
• Google Fonts (fonts.googleapis.com and fonts.gstatic.com): typefaces, on every page;
• Plotly (cdn.plot.ly): charts on the Buy vs Mine and Fleet Simulator pages.

Links to other websites, such as data sources, take you to sites this notice does not cover.

Who receives your data

• Our hosting provider, Amazon Web Services, which runs our servers and database on our behalf under its data processing terms.
• ip-api.com, which receives IPv4 addresses for the location lookup described above.
• The providers listed in section 4, which your browser contacts directly.
• Authorities, if we are legally required to disclose information, or to protect the site and its users against fraud or attack.

We do not sell or rent personal data, we do not share it for advertising, and we do not use it for profiling or for automated decisions that affect you.

Where your data is stored

The site is hosted on Amazon Web Services, and our database, which holds the access logs and sign-in records, is located in the United States. If you visit from the European Economic Area, the United Kingdom or Switzerland, your data is therefore transferred to the United States. AWS’s data processing terms, which apply to these transfers, include the European Commission’s Standard Contractual Clauses. ip-api.com and the providers listed in section 4 may also process data outside your country.

How long we keep it

• Access logs and sign-in records: 90 days, then deleted by a daily automatic job.
• Location lookups and abuse-protection counters held in server memory: until the server process restarts.
• Technical log files that record IP addresses: rotated automatically; older entries are deleted as new ones are written.
• The session cookie: until you close your browser, or 24 hours for a signed-in administrator. remember_token: up to 365 days. The beta-notice entry: until you clear your browser storage.

Your rights

Under data protection laws such as the EU and UK General Data Protection Regulation, you have the right to:

• ask for a copy of the personal data we hold about you;
• ask us to correct it, or to delete it;
• ask us to restrict how we use it;
• object to our use of it based on our legitimate interests;
• complain to the data protection authority where you live or work, or where you believe a problem arose.

To make a request, write to legal@elektron-energy.com. We do not know who our visitors are, so please tell us the IP address or addresses you used and roughly when you visited; without that we cannot find your records. We may ask for reasonable information to confirm that the records relate to you. We will reply within one month, free of charge.

If you live elsewhere, for example in California, you may have similar rights under local law, and you can use them in the same way. We do not sell or share personal information for cross-context behavioural advertising.

Children

The site is not directed at children under 16, and we do not knowingly collect personal data from them.

Security

The site is served over HTTPS. Access to logs and sign-in records is limited to the single administrator account, which is protected by a hashed password and by automatic lockout after repeated failed attempts. No system is completely secure, but we work to protect the data we hold.

Changes to this notice

We will update this notice when what we collect or how we use it changes, and change the date at the top of the page. The version in force when you use the site applies.