Privacy

Privacy notice — BESS Connector by Barrel

Version 1.1 · effective 1 October 2026 · The Italian text prevails in case of discrepancy.

1. Controller

Barrel S.r.l., Galleria delle Porte Contarine 4, 35137 Padova, Italy, VAT IT12616620964. For any privacy request: bess@barrel.center

This notice covers the website mcp.barrel.center, the customer area, the "New offer" form and the connector mcp.barrel.center/mcp.

For personal data of the user's customers contained in projects and documents, Barrel is not the controller but a processor on the user's behalf. This relationship is governed by Annex A to the terms of use.

2. What data we process, why, and for how long

Data	Purpose	Legal basis	Retention
Account: email, password (stored hashed, never in clear), company, country	Create and manage the account, give access to the Service	Contract (Art. 6.1.b GDPR)	Until account closure; then deletion within 30 days
Brand in the profile: logo, company name, address, VAT, name, role, email and phone of the contact person, preferences	Brand the user's documents	Contract	Until the user edits or deletes it, or until account closure
Billing data: company, VAT, address, packs purchased, payments	Invoicing, tax and accounting obligations	Legal obligation (Art. 6.1.c)	10 years, as required by Italian law (Art. 2220 Civil Code)
Documents produced (PDF) and their versions	Make documents and revisions available to the user	Contract	Until the user deletes them, or until account closure
"New offer" form data (project data, load curve, notes)	Produce the requested document	Contract	Only in memory while processing (a few minutes): not stored. The resulting PDF remains
Bills uploaded in the form (PDF or photo)	Read consumption, power and prices to fill in the form	Contract	Only in memory while being read (a few seconds): the file is stored neither on disk nor in the database. Only energy data return to the page; names, addresses, tax codes and POD are not extracted
Address of the plant site	Suggest the address, derive coordinates, solar yield and market zone	Contract	Not stored: it remains in the produced document
Usage data: document type, pages, product, country, credits charged, processing cost	Charging credits, support, cost control	Contract and legitimate interest (Art. 6.1.f)	Until account closure; afterwards only in aggregated, anonymous form
Technical logs: IP address, date and time, page requested	Security, abuse prevention, troubleshooting	Legitimate interest	At most 30 days

We do not process special categories of data (Art. 9 GDPR). Please do not enter them in the forms.

3. Artificial intelligence

To produce documents, the Service sends the form data to Anthropic (Claude model) through its API. The logo and the measured load curve are not sent: our server adds them. Uploaded bills are sent to Anthropic only to be read: we take the company name, supply address, consumption, power and prices to fill in the form, never tax codes, VAT numbers, meter or contract codes, bank or contact details. The file is not kept. The same applies to the grid connection offer (STMG) uploaded for utility projects: we take requester, site, connection data, costs and deadlines, without practice codes, people's names or contacts.

Anthropic processes these data as a provider on our behalf. Under its commercial API terms, it does not use them to train its models and retains them only for the period those terms allow.

The documents do not produce automated decisions with legal effects on individuals (Art. 22 GDPR).

4. Who we share data with

Data are processed by authorised Barrel staff and by the following providers, appointed as processors:

Hostinger (Hostinger International Ltd.): servers of the Service and email. The Service's servers are located in the United Kingdom, a country covered by an adequacy decision of the European Commission.
Anthropic (Anthropic PBC, United States): AI processing of documents. Transfers to the United States rely on the European Commission's standard contractual clauses or other safeguards under Arts. 45–46 GDPR.
Komoot (Photon service, OpenStreetMap data, Germany) and the European Commission — JRC (PVGIS service): they receive from our server only the typed address text or the coordinates, for suggestions and solar yield; no user data.
OpenStreetMap Foundation (United Kingdom): provides the map images of the form, loaded directly by the browser, which therefore receives the user's IP address.
Stripe (Stripe Payments Europe Ltd.), when paying by card or SEPA. Card data are collected directly by Stripe and never pass through Barrel.

We may also share data:

with our accountant, for tax compliance;
with authorities, when required by law.

We do not sell data and do not use them for advertising.

5. Cookies

The website mcp.barrel.center uses technical cookies only:

the session cookie, which keeps you logged in;
the cookie for the chosen language.

It uses no profiling cookies and no third-party analytics, so no consent is requested.

Stripe's payment page has its own notice.

6. Security

Encrypted connections (HTTPS).
A database not reachable from the internet.
Passwords stored only in hashed form.
Documents visible and downloadable only by the account holder.
Form data not stored after processing.

7. Your rights

You may at any time ask to:

access your data;
rectify them;
erase them;
restrict their processing;
object to processing based on legitimate interest;
receive them in a structured format (portability).

Write to bess@barrel.center.

You can also delete the brand and documents yourself from your profile.

If you believe the processing is not lawful, you may lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali (garanteprivacy.it), or with the authority of your country.

8. Changes

We may update this notice. The version in force is always at mcp.barrel.center/privacy, with its update date.