DWEEN Alert — Privacy Policy

Last updated: 30 October 2026

DWEEN Alert is an alerting app for the staff of UAB Energy Advice and for authorised users at our client companies. It collects only what it needs to deliver work alerts to your phone and show your alert history. It shows no ads, runs no analytics and does not sell data.

Who we are

UAB Energy Advice, Žemaičių g. 31-233, Kaunas, Lithuania (company code 303038190, VAT code LT100009883411), is the data controller for the app (package com.dween.notificator) and the server behind it.

Privacy questions: [email protected], +370 635 16380.

Data we collect

Data	Where it comes from	Where it is kept
Account identifier (an opaque user ID), and your name, username and email address	Your DWEEN account on our single sign-on (SSO) server when you log in	User ID: our server. Name, username and email: on your device only, to show who is logged in
Login tokens	Issued by our SSO server at login	On your device only, in app-private storage
Push token (a Firebase Cloud Messaging registration token)	Generated on your device by Firebase	Our server, linked to your user ID
Device registration times and push delivery status	Our server, each time it registers your device or sends you an alert	Our server
Alerts sent to you: title, text, severity, time	The systems connected to DWEEN Alert that raise the alert	Our server, and a cached copy on your device
Read status of each alert	You, when you open it	Our server
Vacation setting (on or off, end date)	You, in Settings	Our server
Membership of alert groups	Your SSO account's group settings, managed by administrators	Our SSO server; our server looks it up when sending an alert

The app does not collect your location, contacts, photos, files, phone number or device identifiers beyond the push token.

How we use it

We use the data only to run the alerting service:

Log you in and confirm that you may use the app.
Work out who should get each alert, including members of alert groups.
Send a push message to your devices. It holds only the alert ID and severity. The app then fetches the alert text from our server over an encrypted connection.
Show your alert history and which alerts you have read.
Pause pushes while your vacation setting is on. Alerts still appear in your history.
Find devices that have stopped receiving alerts and stop sending to them.

Legal basis (GDPR): our legitimate interest, and that of the organisation you use the app for, in delivering operational alerts to the people who need them (Art. 6(1)(f)). Where you use the app under a contract with us, as our employee or under our service agreement with your organisation, the basis is also the performance of that contract (Art. 6(1)(b)). We do not use the data for profiling, marketing or automated decisions about you.

Who we share it with

Our single sign-on (Keycloak). Run by us. It handles your login and alert-group membership. We do not send it any data from the app beyond what logging in requires.
Google Firebase Cloud Messaging. Google LLC delivers push messages to your device. Google processes your push token and the push message itself (the alert ID and severity only, never the alert text). Firebase may also process a Firebase installation ID. See Firebase privacy and security. Google may process this data outside the EU under the EU Standard Contractual Clauses.

We do not sell your data or share it with anyone else, unless the law requires us to.

Storage, retention and security

On your device: login tokens and a cache of your alerts sit in app-private storage. Android backup is turned off for the app, so this data never goes to cloud backups. Logging out revokes your tokens at the SSO server and ends your browser login session. Uninstalling the app deletes everything it stored on the device.
On our server: the data is kept on servers we run in Kaunas, Lithuania. All traffic between the app and our servers is encrypted (HTTPS). Only the app's own login client can read user data through the API. Only authorised systems can send alerts.
Retention: alert history and device registrations are kept while your account is active.

Permissions and what the app does not do

Permission	Why
Internet	Log in, register for pushes, fetch alerts
Show notifications	Display alerts
Full-screen notifications	Show critical alerts over the lock screen
Do Not Disturb access	Let critical alerts sound while Do Not Disturb is on, if you allow it

The app has no advertising, analytics, crash-reporting or tracking SDKs. It does not track your location or activity, and it does not sell or share data for advertising.

Your rights

Under the GDPR you can ask us to:

give you a copy of your data
correct it
delete it
restrict how we use it
stop using it (you can object)
send it to you in a portable format

To use any of these rights, or to have your data deleted, email [email protected]. We reply within one month. You can also complain to the State Data Protection Inspectorate of Lithuania (vdai.lrv.lt).

Children

The app is only for our staff and authorised users at our client companies. It is not meant for children, and we do not knowingly collect children's data.

Changes to this policy

If this policy changes, we will publish the new version at this address and update the "Last updated" date above.