Privacy Policy

Version 1.3.0 · Effective 2 November 2026 · Governing law: Belgium · EU GDPR (Regulation (EU) 2016/679)

1. Who is the controller?

The Wagoi mobile application, the website wagoi.eu and related services (the “Service”) are operated by Mario Schraepen GCV, Trompetterstraat 6, 3530 Houthalen-Helchteren, Belgium, company number (KBO) and VAT BE 0845.537.122, acting as the data controller for your personal data. Contact: privacy@wagoi.eu.

We plan to transfer the Service to a new company, Wagoi Ltd., to be incorporated in Malta. That company does not exist yet. Before the transfer takes place, we will publish an updated Privacy Policy and tell you in the app.

2. What data we collect

Account data

Email address, display name, profile photo (optional), preferred language, country.
Authentication identifiers from Sign in with Apple or Google Sign-In if you use those providers.
Magic-link tokens and sign-in codes (short-lived, used only to authenticate your sign-in).
Acceptance of our Terms and this Privacy Policy (version + timestamp).

Vehicle data

Identifiers and descriptive attributes: Vehicle Identification Number (VIN) for cars, frame number for e-bikes, and make / model / year / body type / fuel type / country.
Manufacturer or platform tokens (encrypted at rest, used only to query your vehicle on your behalf).
Telemetry such as odometer, battery state, location, charging events, ride or trip data — only for vehicles you have explicitly connected.
For e-bikes connected through platforms like Bosch eBike Systems, this may also include rider-specific signals (cadence, rider power, assist mode) and ride history. GPS location is only collected when your hardware supports it and you have authorised it.
The Wagoi app does not read your phone’s GPS. Locations come from your vehicle’s manufacturer or platform.

Safety alert data (only if you set it up)

The emergency contacts you add: their name, phone number and, optionally, email address, and whether they confirmed.
Safety checks: when your connected vehicle reports a possible incident (for example automatic emergency braking), the time, whether you answered “I’m OK”, and which contacts we texted.
Your vehicle’s last-known location at that moment, which goes into the text message to your contacts (see §4d).

App-usage data

Product analytics (PostHog) — only if you switch it on — tied to a Wagoi-generated user id, not your email.
Crash and error reports (Sentry): technical details of the error and the app state around it.
Push notification tokens (Firebase Cloud Messaging).
Map tiles: to draw a trip map, the app requests map images for the area shown. The map provider sees your IP address and that area.

Payment data

Subscriptions are bought through the Apple App Store or Google Play. Apple or Google handles the payment; we never receive your card details. We receive the subscription status, the product, the store and transaction identifiers, through RevenueCat.

Website (wagoi.eu)

Visit statistics: we count page views with PostHog (EU-hosted) in cookieless mode. Nothing is stored on your device and no profile is built. Basis: our legitimate interest in knowing how the site is used (Art. 6(1)(f)).
Waiting list: if you join the waiting list, we keep your email address to send you launch news (consent, Art. 6(1)(a)). You confirm your sign-up through a link in an email (double opt-in), and you can unsubscribe at any time. The list is kept in Brevo. If you signed up on our previous website, your email address and sign-up date were moved to Brevo when we switched websites. The form is protected against spam by a hidden field, without third-party tools.
Hosting: the website runs on our own server at IONOS SE in Germany (EU). The website sets no cookies.

3. Why we use your data — legal bases

Purpose	Categories of data	Legal basis (GDPR Art. 6)
Provide and operate the Service (account, vehicle connection, trips, maps, air quality, rewards, subscriptions, vehicle value reports)	Account, vehicle, app-usage, payment	Performance of contract — Art. 6(1)(b)
Crash and error reporting, security, anti-abuse and account-integrity checks (signup throttling, VIN re-use detection)	Account, vehicle, device signals, crash reports	Legitimate interests — Art. 6(1)(f)
Product analytics	App-usage	Consent — Art. 6(1)(a), off until you switch it on
Marketing emails and in-app promos	Account, app-usage	Consent — Art. 6(1)(a)
Personalised in-app messages about your own activity (§4)	Account (first name), vehicle, activity insights	Legitimate interests — Art. 6(1)(f)
Sharing vehicle data with a business whose offer you accept (§4c)	Vehicle	Consent — Art. 6(1)(a), per offer
Safety alert: texting your emergency contacts after an unanswered safety check (§4d)	Account (first name), vehicle (type, last-known location), safety alert data	Performance of contract — Art. 6(1)(b), for the feature you set up
Your emergency contacts’ details	Name, phone number, optional email	Legitimate interests — Art. 6(1)(f), for the one confirmation text; then the contact’s consent — Art. 6(1)(a)
Emergency-responder VIN lookup (§4b)	Vehicle, last-known location	Consent — Art. 6(1)(a)
Comply with legal obligations	Any of the above	Legal obligation — Art. 6(1)(c)

We share personal data only with vetted processors who act on our instructions and under written data processing agreements. Categories:

Cloud hosting and backups: IONOS SE (Germany — EU) runs the app’s servers and the website, and stores our daily encrypted backups.
Vehicle telematics providers — depending on which vehicle or e-bike you connect, this can include: vehicle manufacturers operating their own telematics endpoint (e.g. Tesla Fleet API), with whom Wagoi maintains direct OAuth integration agreements; telematics aggregators that unify data across many manufacturers; eBike platforms acting as data holders under the EU Data Act. The manufacturer or platform for each vehicle you connect is shown in the app at the moment of connection. The current list of all providers we use, with each provider’s role, jurisdiction, transfer safeguards and the categories of data shared, is published at wagoi.eu/providers.
Vehicle identity lookup: EU-based vehicle-data providers selected per country of registration to decode a VIN into descriptive attributes.
Maps: MapTiler AG (Switzerland — EU adequacy decision) serves the map tiles for trip maps.
Air quality: public air-quality services receive a location coordinate (never your identity or vehicle) and return air-quality levels for that spot.
Analytics & crash: PostHog (EU-hosted, only with your consent), Sentry (EU-hosted).
Email: Brevo (France, EU).
Text messages (SMS): Spryng (Spryng B.V., the Netherlands — EU) sends the confirmation and safety-alert texts to your emergency contacts.
AI: Anthropic PBC (US — SCCs) provides the AI model behind two features. (1) It writes the wording of some in-app messages about your own activity; for that it receives your first name, your vehicle’s name and the activity insights the message is about. (2) For a vehicle value report it searches public listings; for that it receives the vehicle’s VIN, make, model, year and mileage, never your name or account details. Anthropic does not use this data to train its models.
Push: Firebase Cloud Messaging (Google LLC, US — SCCs).
Subscriptions: Apple and Google process the payment as independent controllers under their own privacy policies. RevenueCat, Inc. (US — SCCs) keeps the subscription state for us; it receives your Wagoi user id and the store’s purchase records, never card details.

Vehicle imagery shown in the app may be generated using third-party AI models. When this is done, Wagoi sends only non-personal descriptive vehicle attributes (such as brand, model, model year, and colour); no Vehicle Identification Number, frame number, account information, or telemetry is shared with those AI models.

We do not sell your personal data and we do not share it with advertising networks.

4a. EU Data Act recipient role

Where the EU Data Act (Regulation (EU) 2023/2854, in force since 12 September 2025) applies to your vehicle, e-bike or other connected product, Wagoi acts as a registered data recipient of the manufacturer or platform that holds the product data. The manufacturer remains the source of the data; Wagoi receives it on your behalf under your explicit consent given to that manufacturer.

You can revoke that consent at any time, either through Wagoi’s settings or directly with the manufacturer or platform. Withdrawal takes effect immediately for future data flows; data already received is handled in accordance with §6 (Retention) below.

Wagoi’s obligations as a data recipient under the Data Act include honouring the purpose-limitation of the access (we will not use the data for purposes you did not authorise), not on-sharing the data with competitors of the data holder, and implementing the same security measures as for any other personal data we process.

4b. Emergency responders (opt-in)

You can allow verified emergency responders (fire and rescue services) to look up your vehicle by its VIN. This is off unless you switch it on, and you can switch it off at any time.

When it is on and a verified responder organisation looks up your VIN, it sees the vehicle’s emergency fiche: the official rescue sheet for the model, safety-critical attributes (for example a high-voltage battery), the last-known location and recent trip context. Only organisations we have verified as emergency services get access. Every lookup is logged (who, when, which VIN) so misuse can be detected; the log is kept for 12 months.

Businesses can offer rewards in the Wagoi marketplace in exchange for specific vehicle data. Nothing is shared unless you accept an offer. When you do:

The business receives only the vehicle data listed in that offer (for example the odometer reading or battery health), for the period and at the frequency shown in the offer.
Your vehicle is identified by its VIN. We never pass on your name, email address or phone number.
The business receives the data as an independent controller and may use it only for the purpose stated in the offer, under its own privacy policy.
You can stop the agreement at any time in the app. From then on, no more data goes to the business; data it already received stays with it under its own privacy policy.

4d. Safety alert (opt-in)

You can add emergency contacts in the app. Each contact first receives one text message asking them to confirm; only contacts who confirm are ever texted again. You can remove a contact at any time, and a contact can ask us to remove them via privacy@wagoi.eu.

When your connected vehicle reports a possible incident, the app asks whether you are OK. If you do not answer in time, we text your confirmed contacts: your first name, the type of vehicle, the time, and a link to your vehicle’s last-known location on Google Maps. If you answer “I’m OK” later, the contacts we texted receive an all-clear text. Wagoi never calls the emergency services itself; the text asks your contacts to check on you or to call 112.

When a contact opens the location link, Google receives that request under its own privacy policy.

5. International transfers

We keep data in the EU wherever we can. Where personal data is transferred outside the European Economic Area (Firebase Cloud Messaging, RevenueCat and Anthropic in the US), we rely on the European Commission’s Standard Contractual Clauses (SCCs) and, where required, supplementary technical measures (encryption in transit and at rest, pseudonymisation of identifiers sent to non-EU processors). MapTiler (Switzerland) is covered by an EU adequacy decision.

6. Retention

Account data: kept while your account is active and for up to 12 months after deletion (legal-obligation and dispute-handling window). On request we may delete sooner, subject to legal exceptions.
Trips and charging sessions: kept as long as the vehicle is connected, but their precise GPS points and routes are erased after 90 days. Distance, duration, energy and the address text stay, so your history keeps working.
Detailed vehicle signal history: 90 days. Vehicle alerts: 12 months.
Emergency contacts and safety checks: until you remove a contact or delete your account.
Crash reports: 90 days.
Product analytics: individual events for up to 13 months, aggregated statistics afterwards.
Emergency-responder lookup log: 12 months.
Magic-link tokens and sign-in codes: 15 minutes from issuance.
Subscription records: as long as required by tax and accounting law.

7. Your rights

Under the GDPR you have the right to:

Access the personal data we hold about you.
Have inaccurate data corrected.
Have your data deleted (right to be forgotten) — use wagoi.eu/delete-account.
Restrict or object to certain processing.
Receive your data in a portable, machine-readable format.
Withdraw consent at any time (for consent-based processing such as analytics or marketing) without affecting the lawfulness of prior processing.
Lodge a complaint with a data-protection authority. Our lead authority is the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données, dataprotectionauthority.be). You can also contact the authority in the EU country where you live.

To exercise any of these rights, email privacy@wagoi.eu. We respond within 30 days.

The Privacy settings in the Wagoi app let you switch your consents on and off: product analytics, marketing, charging-report emails and the emergency-responder lookup. Changes take effect immediately and apply going forward. We do not use pre-ticked boxes, and we do not bundle marketing consent with accepting our Terms (in line with EU Court of Justice case C-673/17 “Planet49”).

9. Security

We protect your data with industry-standard measures:

HTTPS with certificate pinning in the mobile app.
Authentication tokens stored in platform-secure storage (iOS Keychain / Android Keystore).
Encryption-at-rest for sensitive credentials, with versioned key rotation.
Audit logs of administrative access to user data.
Daily encrypted backups to IONOS Object Storage in the EU.

No system is perfectly secure. If you believe your account has been compromised, contact security@wagoi.eu immediately.

10. Children

The Service is not directed at children under 16 (or the higher minimum age of digital consent in your country). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact privacy@wagoi.eu and we will delete it.

11. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. Material changes (major-version bumps) are communicated in-app and require renewed acceptance before continued use. Minor clarifications, editorial fixes, and additions to our public providers list (minor or patch versions) do not require re-acceptance. Previous versions remain accessible at /privacypolicy-vX-Y-Z.

12. Contact

For questions about this Privacy Policy or to exercise your rights, contact privacy@wagoi.eu. For security disclosures, contact security@wagoi.eu.