Privacy Policy

This Privacy Policy describes how the personal data of users of this platform is collected, used, stored and protected.

1. Data collected

When users sign up to the platform, we collect their email address and the password needed to give them access to the service. This data is made unreadable and anonymous through hashing and encryption techniques.

Users may also connect their vehicle to the platform. The data transmitted by the vehicle through the official Tesla Fleet API is collected and stored so that the user can view and use it. This data may include, for example: speed, battery status, location, etc.

Data collected through the Fleet API is processed solely to provide the platform's features and is not shared with unauthorised third parties.

Data is kept only for as long as strictly necessary for the purposes for which it was collected and in any case no longer than the deletion of the account by the user, except where required by law and except as provided in section 4.1 for certificates already issued.

2. Purposes of processing

The data collected is used solely for technical purposes, namely to allow access to the platform, manage the user account and display the data of the connected vehicle.

The data collected is processed on the following legal bases:

• Email and password: performance of the contract (Art. 6(1)(b) GDPR), necessary to provide the requested service.
• Vehicle data: performance of the contract (Art. 6(1)(b) GDPR), necessary for the platform's features.
• Pseudonymised VIN: the controller's legitimate interest (Art. 6(1)(f) GDPR) in preventing fraud.
• Usage Certificate: performance of the contract (Art. 6(1)(b) GDPR) for issuing the document and making it available for verification; the controller's legitimate interest (Art. 6(1)(f) GDPR) in the verifiability of documents already handed over, solely for keeping the register of codes.

3. Processing and storage methods

Personal data is processed lawfully, fairly and transparently, with appropriate technical and organisational measures to protect it from unauthorised access or accidental loss.

As far as possible, stored data is anonymised to ensure a higher level of privacy protection. However, we cannot guarantee the absolute security of data transmitted over the internet.

Users can always request the complete removal and the export of their data from the platform.

4. Data sharing

Personal data is not shared with third parties, except for the service providers listed in section 6 and for the Usage Certificate described in section 4.1, which the user chooses to have issued and to hand over to a recipient of their choice.

4.1. Usage Certificate

At the user's request, the platform issues the Usage Certificate, a document containing vehicle usage data intended to be handed over to a third party chosen by the user.

The document can only be viewed by someone who has both the code printed on the document and the vehicle's VIN. The VIN appears in full so that the recipient can check it against the vehicle; at the requester's choice, the document may include a representation of the areas driven and charged in, always in aggregated form and without precise positions. The number of access attempts is limited to prevent automated searches.

The data in the document is frozen at the time of issue and kept for the validity period (12 months), after which it is deleted and the document can no longer be viewed. The document code, the issue and expiry dates and an unreadable identifier of the vehicle are kept beyond that period and beyond account deletion, solely to allow whoever received the document to verify its authenticity.

The document is issued only at the request of the account holder, who is responsible for handing it over to third parties.

5. User rights

Users have the right to access their personal data and to request its rectification, erasure, extraction or restriction of processing. They may also object to the processing of their data or request its portability.

To exercise these rights, users can contact the data controller using the details provided below.

6. Use of third-party services

The platform uses external services to provide some features:

• OpenWeatherMap: to obtain weather information based on geographic coordinates (latitude and longitude).
• Radar.io: to convert addresses into geographic coordinates and vice versa (geocoding).
• PayPal: to manage payments and subscriptions through the website for users located in Italy.
• Paddle: to manage, as authorised reseller, payments and subscriptions through the website for users located in other countries.
• RevenueCat: to manage and verify in-app subscriptions on iOS and Android.
• Apple Inc. (App Store): to process iOS payments through in-app purchases.
• Google LLC (Google Play): to process Android payments through in-app purchases.
• Anthropic (Claude API): to provide natural language processing and smart assistance features.

The coordinates sent are not associated with identifiable personal data of users or vehicles. They are used solely to provide the features described above and are not shared with other parties.

Data provided to PayPal and Paddle, on the other hand, is handled according to their respective privacy policies and is necessary for processing payments. Paddle receives the account's email address and the chosen plan, which are needed to issue receipts and invoices and to apply taxes; Paddle also processes this data as an independent controller, in its capacity as reseller. The platform does not store sensitive payment information.

Data sent to the Claude API is anonymised and aggregated beforehand, so that no information sent can be traced back to a specific vehicle or user. The platform does not include direct or indirect identifiers (such as number plate, vehicle code, user ID or personal details) in the messages sent to Anthropic.

International data transfers: some of the services listed (Anthropic, PayPal, RevenueCat, Apple, Google) are based in the United States, and using them involves transferring personal data outside the European Economic Area (EEA). These transfers take place in compliance with the safeguards provided by the GDPR, in particular through Standard Contractual Clauses approved by the European Commission, or on the basis of an adequacy decision. Paddle is based in the United Kingdom, a country for which the European Commission has adopted an adequacy decision. For more information on the safeguards adopted by each provider, please refer to their respective privacy policies.

7. Prevention of promotion abuse

To prevent misuse of promotions or trial periods, we may keep the vehicle VIN provided by the user in pseudonymised form using cryptographic functions (HMAC). The legal basis for this processing is our legitimate interest in preventing fraud.

Pseudonymised values are kept until the end of the period needed to prevent the free trial from being repeated, and in any case no longer than 12 months after deletion.

8. Contact

For any question or request regarding privacy and the processing of personal data, you can contact the data controller at: [email protected].

Users also have the right to lodge a complaint with the competent supervisory authority. In Italy, the competent authority is the Garante per la protezione dei dati personali (www.garanteprivacy.it).

This service is provided by Daniel Greco, VAT No. IT04787120981 – Contact: [email protected].