Security
Pre-contractual information under the EU Data Act EU Data Act Information
Last update 14.02.2026
The EU Data Act (Regulation (EU) 2023/2854) applies to certain hardware products and associated services controlling those products, defined in the EU Data Act as “connected products” and “related services”. This document provides information relevant to Cury’s connected products and related services.
The Cury device (“the Device”) is a smart device branded „Cury” in all models and modifications from any of the production series offered through the website www.smartcury.com and the Cury app/Shelly Smart Control (collectively referred to as “the Service”) – a mobile and web1 applications working with Cury devices available for downloading free of charge for Android, iOS and HUAWEI AppGallery2. The Cury device remains fully functional even without the use of any related service. The use of the the Cury app/Shelly Smart Control is optional. Cloud storage occurs only if the user chooses to activate the Service and link the device to an account.
Identity of the Data Holder
Trading name: Shelly Europe Ltd.
Establishment: Sofia, Bulgaria
Geographical address: 51 Cherni Vrah, office building 3, floor 2 and 3
Shelly Europe Ltd. acts as the data holder within the meaning of Article 2(13) of Regulation (EU) 2023/2854 and is responsible for providing access to readily available data generated by the use of Cury connected products and related services. Readily available data means data that is accessible to Shelly Europe Ltd. without disproportionate effort, including logs available via device interfaces or cloud service systems.
Data Sharing with Third Parties – User Control
Request procedure:
Users can initiate sharing through the Service
Withdrawal procedure: Sharing can be ended by disabling integrations within the Service, revoking API tokens, or by submitting a request to Shelly's support team.
Legal framework: All sharing and withdrawal requests are handled in compliance with GDPR and the EU Data Act, ensuring users retain full control over their data.
What types of data are generated during the use of your Cury connected product?
(1) Cury’s connected products continuously generate data while in use to provide certain functionalities. This includes when you interact with your Device directly (e.g. by pressing the buttons on the device) or through an app that controls how certain sensors of the device behave (e.g., using an app to change the led light color of the device).
(2) The types and volume of data generated during the use of Cury’s connected products can vary, depending on the software version, the functionalities of the device, your configurations and settings, and how you use them. Examples of product data generated by Cury devices include:
-
switching events;
-
device status information (connectivity);
-
firmware update status;
-
error logs.
Product data is generated in structured, machine-readable formats (e.g., JSON via local interface/API, and CSV exports where applicable).
(3) The raw sensor data your device generates during your interaction with your device is usually deleted immediately after being generated. Only data that is readily available to the data holder and generated by the use of the connected product or related service falls within the scope of Article 3 EU Data Act. The device subsequently uses inferred or highly processed data for ongoing functions, which are not subject to the EU Data Act. In addition, your device may collect analytics data, which can include certain technical details concerning the performance or your usage of your device (e.g. crash logs or performance metrics). Data may be generated in real time (e.g., switching events) or at regular intervals (e.g., periodic sensor measurements every few seconds or minutes). The volume of data generated is generally low per device (typically a few kilobytes per event or measurement), but may increase depending on usage frequency and enabled features.
Where and for how long is the data stored and for which purposes is it used?
(4) Device-generated data is used primarily to enable the device’s functionalities, ensure security, provide troubleshooting, and improve product performance. Cury typically does not collect and retain on its servers raw sensor data that your device generates during your use of the device. Instead, a lot of processing happens on the device, where the relevant data is used to power certain features or functionalities. Most of the data concerning the use of a Cury connected product is either deleted immediately after being generated, or within a short time frame, depending on device configuration, firmware version and enabled features. Some limited data may be retained on your device for a few days, until it is overwritten by newer data.
When connected with the related Service (Cury app / Shelly Smart Control) may generate and process additional data, such as:
-
user account identifiers and authentication data;
-
remote access logs and command history;
-
device configuration settings stored in the cloud;
-
automation rules, schedules, and user preferences;
-
aggregated usage statistics for service optimization.
Detailed device history logs are typically retained for up to 6-24 months, unless the user deletes them earlier. Aggregated statistics may be retained longer in anonymized form.
How can you access your data?
(5) Very limited data concerning your use of an Cury device is shared with us in a way that would allow us to personally identify you. This data is retained on our servers only for so long as necessary to provide the services or functionalities you chose to use.
(6) Data is directly accessible via the related Service and devices local Web UI. Users can access certain data directly through the device’s local Web UI or local network interfaces without using the cloud-based Service. Data export in CSV format is available where applicable via the same UI, or via APIs. Users can access real-time data and insights through, Application Programming Interfaces (APIs) . You may also contact our customer support on the email below to request assistance in accessing or exporting data.
In some cases, partners can be granted read-only or administrator access to device data within the platform, with control over these permissions via integrations. The Device user is the only one to decide with whom and what data can be shared.
For using the Cury Device via a third-party integrated service, data might be processed and stored by the relevant service provider in compliance with their terms of use and privacy policy. By sharing your Cury Device to third party service you are sharing your data. Make sure to read the third party’s terms of service and any referent data information before connecting your Cury Device thereto.
Data storage arrangements:
Data is stored in secure cloud servers located in the EU/EEA.
Retention period:
Historically transferred device-generated data is typically retained for as long as the account is active, with possible limits (e.g., 6-24 months of detailed logs, and different retention and aggregated strategies for different types of statistics).
(7) Where data concerning your use of Cury connected product is generated and retained on the device, e.g., your device analytics data, Cury provides options that allow you to access and download your data. The data is accessible by way of structured files.
How can third parties authorized by you request access to your data?
(8) Where you authorize a third party to access your data, access may be provided via secure API mechanisms. Where access is provided, data will be made available in a structured, commonly used and machine-readable format. Third parties may only access data after your explicit consent. You may revoke access at any time through the Service settings or by disabling integrations.
How can you enforce your rights?
(9) If you have questions, you can contact us:
Trading name: Shelly Europe Ltd.
Establishment: Sofia, Bulgaria
Geographical address: 51 Cherni Vrah, office building 3, floor 2 and 3
Dedicated support portal: https://support.shelly.cloud/en/support/home
Email: cury.support@smartcury.com
You also have the right to lodge a complaint with the relevant competent authority designated under Article 37 of the EU Data Act, in the Member State of your habitual residence, place of work or establishment.
With whom does Cury share your data?
(10) Cury may engage third parties to act as our service providers and perform certain tasks on our behalf, such as processing or storing data, including personal data generated and collected by Cury in connection with your use of Cury connected product. You can learn more by visiting our Privacy Policy. Cury does not transfer related service data outside the EU/EEA unless appropriate safeguards under GDPR are in place. If users enable optional third-party integrations (e.g., voice assistants or smart home platforms), certain data may be shared with those providers under the user’s instruction.
How can you terminate your use of the services?
(11) You may use Cury's services for as long as you wish, unless you or Cury terminate the service. You can stop using the Cury’s services at any time. To learn how to delete your Cury Account, please visit Privacy Policy. If you delete your Cury Account, you will not have access to other Cury or third party products and services that you set up with that Cury Account. This action is non-reversible. Before deleting an account, users may request or export available cloud-stored data where technically feasible.
Important! The Cury app and Shelly Smart Control operate through a single unified Shelly Platform Account within the shared Shelly Cloud Service. Consequently, deletion of an account initiated via the Cury App or Shelly Smart Control will apply to the Shelly Platform Account as a whole and will remove access to Shelly Smart Control and Cury App, any linked devices, and all related features and functionalities.