Privacy Policy

Wattly Technologies S.L.
CIF: B26874222
C/ Mestre Joan Corrales, 107–109, 1ª Planta, 08950 Esplugues de Llobregat, Spain
Email: privacy@wattly.tech

2.1 Account data

• Email address and/or Apple ID identifier
• Username (optional, for community features)
• Profile picture (optional)
• Referral relationships (who referred you, who you referred) for the referral rewards program

2.2 Vehicle data

Provided by Tesla's official Fleet API:

• Vehicle status (battery level, charging state, climate)
• Vehicle location (with your consent)
• Charging history and sessions
• Trip / drive data and routes
• Odometer readings
• Firmware version

2.3 Technical data

• Anonymous crash reports to improve app stability
• Device type and iOS version (for compatibility)
• Anonymous app usage analytics (e.g. app opens, feature usage) to improve the experience and measure advertising effectiveness

We process your data based on:

• Contract performance (Art. 6(1)(b) GDPR): to provide the features you request, including necessary processing for authorized web and MCP connections, commands and, where available, routines.
• Consent (Art. 6.1.a GDPR): to send push notifications (revocable any time).
• Legitimate interests (Art. 6(1)(f) GDPR): to secure the service, prevent abuse and duplicate commands, and diagnose faults, subject to your rights and interests. You may object on grounds relating to your particular situation by contacting privacy@wattly.tech.

We use your data exclusively to:

• Display statistics and information about your vehicle in the app
• Provide requested features (charging analytics, trip tracking, vehicle commands)
• Send notifications about your vehicle status (if authorized)
• Improve app stability and performance
• Enable community and social features (leaderboards, competitions)

We use the following third-party services that may process data:

Your data is processed on servers located in the European Union. Some third-party services (Tesla, Mapbox, Sentry, Google Firebase) may process data in the United States under appropriate transfer mechanisms (Standard Contractual Clauses or adequacy decisions).

• Account data: until you request deletion or delete your account.
• Vehicle data: up to 2 years from collection, or until you delete your account.
• Trip history: retained for analytics; deleted upon account deletion.
• Credentials: Wattly account and vehicle credentials use protected device or server storage according to their purpose. Assistants receive only separate, scoped MCP tokens.

We store token hashes, permissions, selected vehicles, connection dates and preferences. Connection and command records, including duplicate-prevention records, and available plans, routines and execution history are retained without an automatic age-based purge until account deletion, to operate these features and preserve security, quota and execution records. Revocation or cancellation changes their status; it does not erase this history.

Expired authorization requests and codes, and token records whose refresh validity has expired, become eligible for periodic cleanup after a one-day margin. Temporary encrypted confirmation secrets are cleared on dispatch or by periodic and on-access cleanup when expired, no longer approved or linked to a revoked connection; revocation does not promise immediate physical erasure of those records.

MCP operational logs record the tool, duration, result category and internal connection identifiers, not tokens, coordinates or response contents. Logs rotate according to size limits; no fixed day-based retention period is promised here. Account deletion and its limited exceptions are described below.

Under the General Data Protection Regulation, you have the right to:

• Access: request a copy of your personal data.
• Rectification: correct inaccurate data.
• Erasure: delete your account and all data (“right to be forgotten”).
• Portability: receive your data in a structured, machine-readable format.
• Object: object to certain types of processing.
• Restriction: restrict processing under certain circumstances.

You can exercise these rights from the app's “Settings” section or by contacting us at privacy@wattly.tech.

You can request deletion of your account and associated data in the app’s “Settings” or by emailing privacy@wattly.tech.

A minimal deletion audit, including a protected hash of the email address, is retained for 365 days for security and then purged. Limited technical coordination records may remain after an interrupted operation. Backup copies are removed through scheduled rotation, with daily backups retained for up to 90 days. Deleting your Wattly account does not delete copies already held by an assistant provider; contact that provider to manage them.

With your permission, we use Google Analytics and Meta and X pixels to measure visits and advertising conversions. You can decline or change your choice at any time.

Google Firebase Analytics (iOS). We use analytics to improve Wattly and measure our campaigns.

Wattly is not intended for use by children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us immediately.

We protect your data through:

We may update this Privacy Policy and will notify you of significant changes through the app or by email. The updated date identifies the current version. Where processing requires consent, we will request it separately; continuing to use Wattly does not replace that consent. You can withdraw optional consent using the relevant controls.

Wattly does not collect, process or use any sensitive personal information as defined by data-protection law, including:

• Health or medical conditions
• Political affiliations or beliefs
• Race or ethnic origin
• Religious or philosophical beliefs
• Sex or sexual orientation
• Trade-union membership
• Genetic or biometric data

We do not use vehicle data to infer or derive any such sensitive information about you or anyone else.

If you believe we have violated your rights, you can file a complaint with the Spanish Data Protection Agency (AEPD): www.aepd.es.