1. Who is responsible for this information?
The marketing footer currently displays “BijleeAI by GridMind” and “TilkRaj Enterprise.” Those display names do not establish which legal person or entity operates the website or app, or acts as the data controller.
Owner confirmation required: Identify the legal operator and controller, applicable address and jurisdiction, and the approved contact for privacy questions and requests. The site footer currently displays tilkeshpurohit@bijleeai.com; confirm whether that address is an appropriate privacy contact before relying on it for that purpose.
2. Information submitted through the website
The current public request and contact endpoints accept different combinations of information, including:
- Contact details such as name, company, email, and phone, plus inquiry messages.
- Solar and project details such as plant or site name, location, plant count, capacity, current monitoring setup, interest area, or referral source.
- Partner referral details such as partner name or code, partner type, service geography, portfolio size, capabilities, and referral context.
- Campaign fields such as UTM source, medium, and campaign. The free-pilot audit form can also accept a CSV file.
Demo, pilot, service inquiry, partner referral, and audit request routes are implemented in the app. Some request flows save details in the app; some register a requester’s name and email with the Polsia email contacts endpoint or send request details through the Polsia email proxy. The audit CSV route attempts to send an uploaded file through the Polsia R2 upload proxy.
Owner confirmation required: Confirm the complete set of website forms and fields, actual purposes for each field, and whether any additional information is collected outside these observed request flows.
3. Information used in the solar monitoring app
The app supports client and administrator accounts, client records, and solar asset performance workflows. Depending on account use and data supplied, the app’s records can include:
- Plant profiles and site details, including capacity, location coordinates, commissioning and maintenance details, and solar equipment specifications.
- Equipment records such as equipment type, make, model, rating, quantity, installation date, and serial numbers.
- Generation and other readings, including grid import or export and bill-related values where supplied.
- Monthly readings, cleaning, repair or replacement history, alerts, anomaly results, and reports.
- Uploaded plant, equipment, reading, event-history, report, or audit files supported by the app.
These are plant, equipment, and operational data categories. Their contents may relate to a person or business in a particular context; the application schema alone does not determine whether each record is personal information.
Owner confirmation required: Confirm which data clients are asked to upload, whether files may contain identifiable people’s information, and which additional account or support records are used in practice.
4. How the app uses information
In the current implementation, submitted request details are used in demo or pilot request flows, including request storage and configured notifications. Account and solar records are used by the app to associate clients with their assets and to display performance information, readings, reports, alerts, and anomaly results.
The website’s landing-page code also uses campaign values in form submissions and sends page-view information to the app’s tracking endpoint, as described below.
Owner confirmation required: Confirm the full set of business purposes, including whether and how information is used for marketing, product improvement, support, analytics, or other purposes.
5. Website analytics and browser storage
The landing page currently stores campaign parameters in browser local storage under bijlee_utm for use in request forms. It also creates and stores a visitor identifier under polsia_vid for the analytics beacon described below.
The Express app is configured to use a session cookie named bijleeai.sid. The server configuration sets it as HttpOnly, SameSite=Lax, Secure in production, and with a seven-day maximum age.
Owner confirmation required: Confirm the complete cookie and browser-storage inventory across the site and app, the actual behavior on all pages and devices, and whether consent or preference controls are used.
6. Page-view tracking
The landing page sends its path, browser referrer, and available UTM campaign values to the app’s /api/track endpoint. The endpoint records the page, referrer, UTM values, request IP address, and user-agent in the page-view table; known bot user agents are filtered by the current database code.
The landing page also requests a Polsia analytics pixel with the app’s configured slug and the locally stored polsia_vid value.
Owner confirmation required: Confirm the analytics purpose, the provider’s data handling and role, any retention or opt-out behavior, and whether other pages or services perform additional tracking.
7. Service providers and information sharing
Current code shows external connections that include the Polsia email and contacts endpoints in request flows, the Polsia R2 upload proxy for free-pilot audit CSVs, the Polsia analytics pixel on the landing page, and Open-Meteo weather endpoints that receive plant coordinates and date ranges for solar-relevant weather data.
Payment routes call a configured Polsia payment endpoint. AI-assisted chat and report code uses the OpenAI SDK with a configured API endpoint; chat requests can include a user’s question and selected client and plant context, such as asset identifiers, performance figures, or maintenance information.
This list describes observed integrations only. It is not a complete provider list and does not establish any provider’s legal role, hosting location, or data-handling terms.
Owner confirmation required: Confirm which integrations are active in production, all providers and other recipients, what information each receives, their roles, applicable contracts, and whether information is accessed or transferred across borders.
8. Data retention and deletion
The app stores request records, page views, account and solar records, and session records in its database-backed features. This draft does not specify how long any category is kept or when it is removed.
Owner confirmation required: Set and describe retention periods or criteria for each data category, including uploaded files, analytics, account records, backups, and deletion requests.
9. Security
Owner confirmation required: Confirm which security measures can be accurately described, how account and uploaded information is protected, and what process applies if a security incident occurs. This draft makes no security guarantee.
10. Privacy choices and requests
Owner confirmation required: Confirm which privacy rights and choices apply to visitors and users, how requests are submitted and verified, the response process, and the correct privacy contact. No particular legal right or request outcome is stated here.
11. Marketing, children, and location of processing
Owner confirmation required: Confirm whether contact information is used for marketing and what preferences are available; whether the service is directed to or knowingly used by children; and where information is stored, processed, or transferred.
12. Applicable law and updates
Owner confirmation required: Confirm the legal basis or bases for relevant processing, the applicable jurisdiction and legal requirements, and how policy changes will be announced and dated. Update the “Last updated” date above only after owner review.