Privacy Policy

What we collect

Nothing beyond what the purposes below require.

• Account: your email address, the language and theme you chose, and the country inferred from the preferences your browser declares.
• Identity provider identifier, if you sign in with Google or Tesla.
• Your grid: section names, bookmark titles and addresses.
• Paired vehicles: the name you give them and the date of last activity.
• Tesla account, if you link one: an encrypted access token and your account's region. iCar requests READ-ONLY scopes and cannot send any command to the vehicle.
• Trips, only if you turn recording on: precise timestamped positions and distances travelled.

What we do not collect

Weather and map tiles are requested directly by the vehicle's browser, without passing through us: we see nothing of them.

To announce points of interest along your route, and to work out which chargers you can still reach, the vehicle sends its position to our servers. It is used to answer the request and then forgotten: it is neither recorded nor retained.

Trip recording is the only feature that keeps positions, and it only starts with your agreement.

No position is ever written to our logs, under any circumstance.

Why, and on what basis

• Providing the service — your account, your grid, its sync to the vehicle: performance of our contract.
• Recording your trips: your consent, which you may withdraw at any time from your settings. Withdrawal stops recording without erasing the history already collected, which you can delete separately.
• Keeping the service secure and preventing abuse: our legitimate interest.

Who else has access

We sell no data and pass none on for advertising purposes.

• OVH (France) hosts the service and its backups.
• Brevo (France) sends sign-in emails.
• Google and Tesla, if you choose to sign in through them or to link your vehicle. These exchanges leave the European Union.

What the vehicle contacts directly

Some features are requested by the vehicle's own browser, without passing through our servers. Those services therefore see the vehicle's IP address and what it asks for. We receive nothing from these exchanges, but you should know they happen.

• Open-Meteo, for the weather where you are driving.
• France's IGN Géoplateforme and OpenStreetMap, for map tiles.
• Wikimedia, for photographs of the points of interest announced.

Who processes data on our behalf

These providers act on our instructions and for the purposes described here only.

• Stripe Payments Europe, Ltd., for subscriptions and billing. Your card details are entered on Stripe's pages: they never pass through our servers and we store none of them. All we know about your payment is its status and its renewal date.
• Brevo, for sending sign-in links.
• OVH SAS, which hosts the service in France.
• Google and Tesla, if you choose to sign in or link your vehicle through them.

For how long

• Account and grid: as long as the account exists.
• Recorded trips: ⟨retention to be confirmed, 12 months proposed⟩, then automatic erasure.
• Sign-in links and codes: one hour.
• Encrypted backups: thirty days, after which rotation destroys them.

Your rights

You may request access to your data, its correction, erasure or portability, object to a processing operation, or withdraw a consent. Write to contact@geticar.com.

You may also lodge a complaint with your national data protection authority.

Security

Traffic is served over HTTPS. Tokens granting access to third-party services are encrypted at rest and unreadable without a key held separately. Backups are encrypted before being written to disk.