Privacy Policy

Version 1.0.0 · Effective 26 May 2026 · Governing law: Malta · EU GDPR (Regulation (EU) 2016/679)

1. Who is the controller?

The Wagoi mobile application and related services (the “Service”) are operated by Wagoi Ltd., a company to be incorporated under the laws of Malta, acting as the data controller for your personal data. Contact: privacy@wagoi.eu.

If you live in the European Union or the United Kingdom, you can contact our EU representative at the same address pending designation.

2. What data we collect

Account data

Email address, display name, profile photo (optional), preferred language, country.
Authentication identifiers from Apple Sign In or Google Sign In if you use those providers.
Magic-link tokens (short-lived, used only to authenticate your sign-in).
Acceptance of these Terms (version + timestamp).

Vehicle data

Vehicle Identification Number (VIN), make, model, year, body type, fuel type, country.
Manufacturer/provider tokens (encrypted at rest, used only to query your vehicle on your behalf).
Telemetry such as odometer, battery state, location, charging events and trip data — only for vehicles you have explicitly connected, and only via the APIs you have authorised (e.g. Tesla Fleet API, Smartcar).

App-usage data

Anonymous product analytics (PostHog) tied to a Wagoi-generated user id, not your email.
Crash and error reports (Sentry).
Push notification tokens (Firebase Cloud Messaging).

Payment data

Subscription and one-off purchase records are handled by Apple App Store, Google Play, or Mollie. Wagoi receives transaction confirmations and subscription state but does not store your full payment card details.

3. Why we use your data — legal bases

Purpose	Categories of data	Legal basis (GDPR Art. 6)
Provide and operate the Service (account, vehicle connection, trips, rewards)	Account, vehicle, app-usage	Performance of contract — Art. 6(1)(b)
Anti-abuse, fraud and account-integrity checks (signup throttling, VIN re-use detection)	Account, vehicle, device signals	Legitimate interests — Art. 6(1)(f)
Product analytics and crash reporting	App-usage	Consent — Art. 6(1)(a), managed in the Consent Center
Marketing emails and in-app promos	Account, app-usage	Consent — Art. 6(1)(a)
Comply with legal obligations	Any of the above	Legal obligation — Art. 6(1)(c)

We share personal data only with vetted processors who act on our instructions and under written data processing agreements. Categories include:

Cloud hosting: OVH Cloud (France, Gravelines / Strasbourg — EU only).
Vehicle APIs: Tesla, Smartcar (US-based, GDPR-compliant under Standard Contractual Clauses).
Identity / VIN lookup: inMotiv (Belgium), Vincario (Czech Republic).
Analytics & crash: PostHog (EU-hosted), Sentry (EU-hosted).
Email: Brevo (France, EU).
Push: Firebase Cloud Messaging (Google LLC, US — SCCs).
Payments: Apple, Google, Mollie.
Generative imagery: fal.ai (US — only non-personal vehicle attributes are sent).

We do not sell your personal data and we do not share it with advertising networks.

5. International transfers

Where personal data is transferred outside the European Economic Area, we rely on the European Commission’s Standard Contractual Clauses (SCCs) and, where required, supplementary technical measures (encryption in transit and at rest, pseudonymisation of identifiers sent to non-EU processors).

6. Retention

Account data: kept while your account is active and for up to 12 months after deletion (legal-obligation and dispute-handling window). On request we may delete sooner, subject to legal exceptions.
Vehicle telemetry and trips: retained as long as the vehicle is connected. Free-tier users see only the most recent trips; full history is available via Wagoi Plus.
Crash reports: 90 days.
Anonymous product analytics: aggregated indefinitely, individual events for up to 13 months.
Magic-link tokens: 15 minutes from issuance.

7. Your rights

Under the GDPR you have the right to:

Access the personal data we hold about you.
Have inaccurate data corrected.
Have your data deleted (right to be forgotten) — use wagoi.eu/delete-account.
Restrict or object to certain processing.
Receive your data in a portable, machine-readable format.
Withdraw consent at any time (for consent-based processing such as analytics or marketing) without affecting the lawfulness of prior processing.
Lodge a complaint with your local data-protection authority. In Malta this is the Office of the Information and Data Protection Commissioner (IDPC).

To exercise any of these rights, email privacy@wagoi.eu. We respond within 30 days.

The Wagoi app contains an in-app Consent Center where you can toggle granular processing consents (analytics, marketing, telemetry, recommendations). Changes take effect immediately and apply going forward. We do not use pre-ticked boxes, and we do not bundle marketing consent with terms acceptance (in line with EU Court of Justice case C-673/17 “Planet49”).

9. Security

We protect your data with industry-standard measures:

HTTPS with certificate pinning in the mobile app.
Authentication tokens stored in platform-secure storage (iOS Keychain / Android Keystore).
Encryption-at-rest for sensitive credentials, with versioned key rotation.
Audit logs of administrative access to user data.
Daily encrypted backups to OVH Object Storage in the EU.

No system is perfectly secure. If you believe your account has been compromised, contact security@wagoi.eu immediately.

10. Children

The Service is not directed at children under 16 (or the higher minimum age of digital consent in your country). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact privacy@wagoi.eu and we will delete it.

11. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. Material changes (major-version bumps) are communicated in-app and require renewed acceptance before continued use. Minor clarifications and editorial fixes (minor or patch versions) do not require re-acceptance. Previous versions remain accessible at /privacypolicy-vX-Y-Z.

12. Contact

For questions about this Privacy Policy or to exercise your rights, contact privacy@wagoi.eu. For security disclosures, contact security@wagoi.eu.

This is an archived version, kept for reference. The current version is at /privacypolicy.