Since July 2026 my house has a solar plant, with a Sigenergy inverter and two Sigenergy batteries. Sigenergy is headquartered in Shanghai. To see my own plant’s data, I have to use their app, mySigen, and their cloud. The terms for that app hold this gem:
“If your device has not been used for a long time (for example, the device is offline or not connecting to the Sigen Clould for many days), […] the device will shut down automatically for safety reasons.”
Yes, “Clould”. That device stands in my house, and I paid for it in full.
So on 3 September 2026 I sent Sigenergy a request under the GDPR, the EU’s General Data Protection Regulation: 30 numbered points. I asked for a copy of all my data, the names of everyone who gets it, and the legal safeguard for every transfer out of the EU. I withdrew every consent and asked for erasure. And I asked six plain questions about the shutdown: does the inverter switch off without internet, after how many days, and how do I switch it back on?
On 24 September they took the two extra months the GDPR allows, “due to the complexity and scope of your request”. Their answer arrived in late October. By my count, 2 of my 30 points got a full answer, 10 a partial one, and 18 got nothing, or a polite paragraph.
China
Their answer on where my data goes, word for word:
“EU data is stored within the EU territory; only for business necessary scenarios (such as equipment maintenance, etc.), Chinese R&D personnel may conduct remote access through encrypted and compliant measures, follow the minimisation principle, and adopt corresponding contractual measures, technical measures and organisational management measures.”
Which company employs these people? Where do they sit? What can they see? Can they send commands to my inverter? The sentence does not say. Under Article 15(2) GDPR I had asked for the legal safeguard behind every transfer of my data out of the EU. The answer names none. Yet their own privacy policy for the mySigen app, dated 15 June 2026, promises exactly that safeguard: “executing EU Standard Contractual Clauses with the applicable recipients”. The privacy policy that Apple’s App Store links for the same app is a different, older text that does not mention China at all.
Six questions, one link
Their whole answer to my six shutdown questions was a link to their FAQ, entry “Can I operate the system offline?”. That entry says:
“Yes, you can operate the system offline. […] If the disconnection persists beyond 90 consecutive days, the system will automatically engage in Safe Operation Mode for safety.”
What does “Safe Operation Mode” do? The FAQ does not say. Sigenergy’s factory warranty for inverters in Europe, which lists my model, says more:
“To activate and maintain SIGENERGY’s 10-year limited warranty, your device must remain connected to the Internet for essential firmware updates. […] If disconnected Internet for over one year cumulatively, the warranty coverage will adjust to 5 years from the original activation date. SIGENERGY reserves the right to modify technical specifications and operating parameters in Safe Operation Mode without prior notice.”
None of this was in the answer to my six questions. The German version of the same warranty, dated 11 June 2026, has my favourite line: after one year offline, the warranty “verlängert sich” – is extended – to 5 years. From 10.
“All” my data
The copy of all my data came as two small files: my account, and the master data of my plant. Not one measurement. Not one log. Yet their own answer says they collect “energy production and consumption data”, and error and operation logs “With your consent”. I withdrew every consent. Their list of what they will erase: “marketing email delivery records, click records and historical AI dispatch schedules”. The logs are not on it.
The export also places my plant in Dresden. My plant is not in Dresden. The export noticed this by itself: “This discrepancy has not been manually verified.”
Names, please
The only recipient they name is AWS, Amazon’s cloud. Everyone else is “installers, customer support companies, and other business partners”. The Court of Justice of the European Union ruled in case C-154/21 (12 January 2023) that the controller owes “the actual identity of those recipients”, unless they cannot be identified or the request is manifestly unfounded or excessive.
The cloud is optional – for the installer
The inverter speaks Modbus TCP, an industrial protocol, so it can be read on my own network with no cloud at all. A Home Assistant user explains the catch: “Modbus/TCP needs to be enabled by your installer. It’s not a setting which can be enabled by the user.”
What happens next
On 28 October I sent a follow-up: 43 numbered questions, each to be answered under the question, yes or no where the question asks for it. Deadline: 4 November 2026. After that, I file a complaint with the data protection authority of my German state. The GDPR itself gives Sigenergy until about 3 December 2026.
To be continued.