Privacy Policy

Version 1.2.0 · Effective 8 October 2026 · Governing law: Malta · EU GDPR (Regulation (EU) 2016/679)

1. Who is the controller?

The Wagoi mobile application and related services (the “Service”) are operated by Wagoi Ltd., a company to be incorporated under the laws of Malta, acting as the data controller for your personal data. Contact: privacy@wagoi.eu.

If you live in the European Union or the United Kingdom, you can contact our EU representative at the same address pending designation.

2. What data we collect

Account data

Email address, display name, profile photo (optional), preferred language, country.
Authentication identifiers from Sign in with Apple or Google Sign-In if you use those providers.
Magic-link tokens and sign-in codes (short-lived, used only to authenticate your sign-in).
Acceptance of our Terms and this Privacy Policy (version + timestamp).

Vehicle data

Identifiers and descriptive attributes: Vehicle Identification Number (VIN) for cars, frame number for e-bikes, and make / model / year / body type / fuel type / country.
Manufacturer or platform tokens (encrypted at rest, used only to query your vehicle on your behalf).
Telemetry such as odometer, battery state, location, charging events, ride or trip data — only for vehicles you have explicitly connected.
For e-bikes connected through platforms like Bosch eBike Systems, this may also include rider-specific signals (cadence, rider power, assist mode) and ride history. GPS location is only collected when your hardware supports it and you have authorised it.
The Wagoi app does not read your phone’s GPS. Locations come from your vehicle’s manufacturer or platform.

App-usage data

Product analytics (PostHog) — only if you switch it on — tied to a Wagoi-generated user id, not your email.
Crash and error reports (Sentry): technical details of the error and the app state around it.
Push notification tokens (Firebase Cloud Messaging).
Map tiles: to draw a trip map, the app requests map images for the area shown. The map provider sees your IP address and that area.

Payment data

Subscriptions are bought through the Apple App Store or Google Play. Apple or Google handles the payment; we never receive your card details. We receive the subscription status, the product, the store and transaction identifiers, through RevenueCat.

Website (wagoi.eu)

Visit statistics: we count page views with PostHog (EU-hosted) in cookieless mode. Nothing is stored on your device and no profile is built. Basis: our legitimate interest in knowing how the site is used (Art. 6(1)(f)).
Waiting list: if you join the waiting list, we keep your email address to send you launch news (consent, Art. 6(1)(a)); you can unsubscribe at any time. The form is protected against spam by Google reCAPTCHA, which processes your IP address and browser data and may set cookies (Google LLC, US — SCCs).
Hosting: the website runs on Webflow (Webflow, Inc., US — SCCs) behind Cloudflare, which sets a technical cookie to protect the site against abuse.

3. Why we use your data — legal bases

Purpose	Categories of data	Legal basis (GDPR Art. 6)
Provide and operate the Service (account, vehicle connection, trips, maps, air quality, rewards, subscriptions)	Account, vehicle, app-usage, payment	Performance of contract — Art. 6(1)(b)
Crash and error reporting, security, anti-abuse and account-integrity checks (signup throttling, VIN re-use detection)	Account, vehicle, device signals, crash reports	Legitimate interests — Art. 6(1)(f)
Product analytics	App-usage	Consent — Art. 6(1)(a), off until you switch it on
Marketing emails and in-app promos	Account, app-usage	Consent — Art. 6(1)(a)
Emergency-responder VIN lookup (§4b)	Vehicle, last-known location	Consent — Art. 6(1)(a)
Comply with legal obligations	Any of the above	Legal obligation — Art. 6(1)(c)

We share personal data only with vetted processors who act on our instructions and under written data processing agreements. Categories:

Cloud hosting: OVH Cloud (France, Gravelines / Strasbourg — EU only).
Vehicle telematics providers — depending on which vehicle or e-bike you connect, this can include: vehicle manufacturers operating their own telematics endpoint (e.g. Tesla Fleet API), with whom Wagoi maintains direct OAuth integration agreements; telematics aggregators that unify data across many manufacturers; eBike platforms acting as data holders under the EU Data Act. The manufacturer or platform for each vehicle you connect is shown in the app at the moment of connection. The current list of all providers we use, with each provider’s role, jurisdiction, transfer safeguards and the categories of data shared, is published at wagoi.eu/providers.
Vehicle identity lookup: EU-based vehicle-data providers selected per country of registration to decode a VIN into descriptive attributes.
Maps: MapTiler AG (Switzerland — EU adequacy decision) serves the map tiles for trip maps.
Air quality: public air-quality services receive a location coordinate (never your identity or vehicle) and return air-quality levels for that spot.
Analytics & crash: PostHog (EU-hosted, only with your consent), Sentry (EU-hosted).
Email: Brevo (France, EU).
Push: Firebase Cloud Messaging (Google LLC, US — SCCs).
Subscriptions: Apple and Google process the payment as independent controllers under their own privacy policies. RevenueCat, Inc. (US — SCCs) keeps the subscription state for us; it receives your Wagoi user id and the store’s purchase records, never card details.

Vehicle imagery shown in the app may be generated using third-party AI models. When this is done, Wagoi sends only non-personal descriptive vehicle attributes (such as brand, model, model year, and colour); no Vehicle Identification Number, frame number, account information, or telemetry is shared with those AI models.

We do not sell your personal data and we do not share it with advertising networks.

4a. EU Data Act recipient role

Where the EU Data Act (Regulation (EU) 2023/2854, in force since 12 September 2025) applies to your vehicle, e-bike or other connected product, Wagoi acts as a registered data recipient of the manufacturer or platform that holds the product data. The manufacturer remains the source of the data; Wagoi receives it on your behalf under your explicit consent given to that manufacturer.

You can revoke that consent at any time, either through Wagoi’s settings or directly with the manufacturer or platform. Withdrawal takes effect immediately for future data flows; data already received is handled in accordance with §6 (Retention) below.

Wagoi’s obligations as a data recipient under the Data Act include honouring the purpose-limitation of the access (we will not use the data for purposes you did not authorise), not on-sharing the data with competitors of the data holder, and implementing the same security measures as for any other personal data we process.

4b. Emergency responders (opt-in)

You can allow verified emergency responders (fire and rescue services) to look up your vehicle by its VIN. This is off unless you switch it on, and you can switch it off at any time.

When it is on and a verified responder organisation looks up your VIN, it sees the vehicle’s emergency fiche: the official rescue sheet for the model, safety-critical attributes (for example a high-voltage battery), the last-known location and recent trip context. Only organisations we have verified as emergency services get access. Every lookup is logged (who, when, which VIN) so misuse can be detected; the log is kept for 12 months.

5. International transfers

We keep data in the EU wherever we can. Where personal data is transferred outside the European Economic Area (Firebase Cloud Messaging and RevenueCat in the US), we rely on the European Commission’s Standard Contractual Clauses (SCCs) and, where required, supplementary technical measures (encryption in transit and at rest, pseudonymisation of identifiers sent to non-EU processors). MapTiler (Switzerland) is covered by an EU adequacy decision.

6. Retention

Account data: kept while your account is active and for up to 12 months after deletion (legal-obligation and dispute-handling window). On request we may delete sooner, subject to legal exceptions.
Trips and charging sessions: kept as long as the vehicle is connected, but their precise GPS points and routes are erased after 90 days. Distance, duration, energy and the address text stay, so your history keeps working.
Detailed vehicle signal history: 90 days. Vehicle alerts: 12 months.
Crash reports: 90 days.
Product analytics: individual events for up to 13 months, aggregated statistics afterwards.
Emergency-responder lookup log: 12 months.
Magic-link tokens and sign-in codes: 15 minutes from issuance.
Subscription records: as long as required by tax and accounting law.

7. Your rights

Under the GDPR you have the right to:

Access the personal data we hold about you.
Have inaccurate data corrected.
Have your data deleted (right to be forgotten) — use wagoi.eu/delete-account.
Restrict or object to certain processing.
Receive your data in a portable, machine-readable format.
Withdraw consent at any time (for consent-based processing such as analytics or marketing) without affecting the lawfulness of prior processing.
Lodge a complaint with your local data-protection authority. In Malta this is the Office of the Information and Data Protection Commissioner (IDPC).

To exercise any of these rights, email privacy@wagoi.eu. We respond within 30 days.

The Privacy settings in the Wagoi app let you switch your consents on and off: product analytics, marketing, charging-report emails and the emergency-responder lookup. Changes take effect immediately and apply going forward. We do not use pre-ticked boxes, and we do not bundle marketing consent with accepting our Terms (in line with EU Court of Justice case C-673/17 “Planet49”).

9. Security

We protect your data with industry-standard measures:

HTTPS with certificate pinning in the mobile app.
Authentication tokens stored in platform-secure storage (iOS Keychain / Android Keystore).
Encryption-at-rest for sensitive credentials, with versioned key rotation.
Audit logs of administrative access to user data.
Daily encrypted backups to OVH Object Storage in the EU.

No system is perfectly secure. If you believe your account has been compromised, contact security@wagoi.eu immediately.

10. Children

The Service is not directed at children under 16 (or the higher minimum age of digital consent in your country). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact privacy@wagoi.eu and we will delete it.

11. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. Material changes (major-version bumps) are communicated in-app and require renewed acceptance before continued use. Minor clarifications, editorial fixes, and additions to our public providers list (minor or patch versions) do not require re-acceptance. Previous versions remain accessible at /privacypolicy-vX-Y-Z.

12. Contact

For questions about this Privacy Policy or to exercise your rights, contact privacy@wagoi.eu. For security disclosures, contact security@wagoi.eu.