Privacy Policy

ChargeSlot is operated by Dawid Kostka. We are responsible for deciding how and why your personal data is processed when you use the ChargeSlot platform.

• Account & organisation data: name, work email address, organisation name, role information and billing contacts that you provide during registration or onboarding.
• Booking & usage data: charging reservations, station assignments, session timestamps, check-in/check-out information and related audit trails created while using the app.
• Support communication: the contents of support tickets, live chat conversations, feedback forms and any attachments you share with our team.
• Technical metadata: IP address, device and browser information, log files and diagnostic data collected automatically to maintain security and service reliability.

• Provide and maintain the service

  We use your account, booking and technical data to deliver core functionality, ensure fair charging slot allocation and give you access to organisation resources (Art. 6(1)(b) GDPR).

• Customer communication and support

  Your contact details and support history allow us to answer enquiries, send operational emails and manage onboarding (Art. 6(1)(b) and (f) GDPR).

• Product analytics (aggregated)

  We evaluate anonymised and aggregated usage insights to improve planning, detect bottlenecks and develop new features. Wherever possible we use aggregated data and legitimate interest balancing (Art. 6(1)(f) GDPR).

• Security, fraud prevention and compliance

  Technical logs help us secure accounts, investigate incidents, comply with legal obligations and enforce our terms (Art. 6(1)(c) and (f) GDPR).

We rely on carefully selected service providers that process data on our behalf under data processing agreements and Standard Contractual Clauses where required.

• Calendly LLC (USA)

  Used for demo scheduling. We transmit your name, email address and chosen appointment data so you can book a meeting slot. Calendly applies EU Standard Contractual Clauses for international transfers.

• Lettermint B.V. (Netherlands)

  Sends our transactional emails (e.g. verification, booking and onboarding emails). For this, Lettermint processes your email address, the message content and delivery data. Lettermint runs its infrastructure exclusively within the EU; processing is based on a data processing agreement.

• Umami web analytics (self-hosted, netcreators)

  To measure the reach of our website we use a self-hosted instance of the open-source software Umami at stats.netcreators.app. Umami sets no cookies, builds no personal user profiles and does not store IP addresses; it records aggregated data such as the page visited, referrer, browser, device type and country. The analytics script is delivered through Cloudflare's network. The legal basis is our legitimate interest in improving our service (Art. 6(1)(f) GDPR).

• Application hosting and infrastructure

  Our web application and databases run on EU-based cloud infrastructure. Providers only access data to deliver infrastructure services under contractual confidentiality obligations.

We only set technically necessary cookies, which require no consent (Section 25(2) no. 2 TDDDG):
• chargeslot-session – keeps the sign-in and form input together while the site is used; valid until the session ends.
• XSRF-TOKEN – protects forms against cross-site request forgery; same lifetime as the session.
• remember_web_… – only if "Remember me" is ticked when signing in; keeps the sign-in until sign-out.
Beyond that, the browser's local storage only holds display settings such as light or dark mode and a dismissed install hint. We set no tracking or advertising cookies.
For our own visitor statistics we derive a daily changing, irreversible identifier from the IP address and browser identification (a hash with a random daily key that is deleted after two days at the latest). Nothing is stored on the device for this, and visitors cannot be recognised across days. If someone arrives through a partner link (e.g. with ?ref=…), we keep the partner identifier only within the current session, so that a sign-up can be attributed to the partner. The legal basis is our legitimate interest in improving our service and in settling accounts with partners (Art. 6(1)(f) GDPR).

We retain personal data only for as long as necessary to fulfil the purposes described above. Account and booking records are stored for the duration of the customer relationship plus applicable statutory retention periods. Support conversations are deleted after 24 months unless we must keep them longer to resolve issues or meet legal requirements.

If data is transferred outside the European Economic Area, we rely on EU Standard Contractual Clauses or other safeguards recognised by the GDPR. We continuously monitor the compliance of our processors.

You have the following rights under the GDPR with respect to your personal data:

• Right of access to the personal data we hold about you (Art. 15 GDPR).
• Right to rectification of inaccurate or incomplete data (Art. 16 GDPR).
• Right to erasure (‘right to be forgotten’) in line with Art. 17 GDPR.
• Right to restriction of processing where the conditions of Art. 18 GDPR are met.
• Right to object to processing based on legitimate interests (Art. 21 GDPR).
• Right to data portability for information you provided to us (Art. 20 GDPR).
• Right to lodge a complaint with your competent supervisory authority (Art. 77 GDPR).

To exercise these rights, email us at dk@chargeslot.app

How to delete your account: Delete your account

Drivers can also use ChargeSlot as an app. It uses the same account and the same data as the web application, and the sections above apply accordingly. In addition, the following applies to the app:

• Permissions

  The app asks for only two permissions, and only when you use the feature that needs them: notifications and camera. You can revoke either at any time in your device settings; all other features keep working. The app does not access your location, contacts, microphone or photo library.

• Push notifications (Expo, Google Firebase Cloud Messaging, Apple)

  If you allow notifications, your device creates a push token. We store it with your account together with the platform, app version and a device name (device model plus a random identifier). To deliver a message – for example a reminder about your booking or a slot that has become free – we send the token and the message text (e.g. charger and time) to the push service Expo (650 Industries, Inc., USA). Expo forwards the message to Google's Firebase Cloud Messaging (Android) or the Apple Push Notification service (iOS). According to Expo, it does not store message content, and it relies on the EU-US Data Privacy Framework for transfers to the USA. We delete the token when you sign out of the app, delete your account or do not use the app for 180 days. You choose which notifications you receive under “More → Notifications” in the app. The legal basis is Art. 6(1)(b) GDPR.

• Camera and QR codes

  The camera is only active when you open it yourself: to read the QR code on a charger or to take a photo of a blocked bay. When you scan a QR code, no image is stored or transmitted; only the code that was read is sent to our server so you can join the organization or open the charger.

• Photos for “Report a blocked bay”

  We transmit the photo you take and your optional note to our server and show them to the people responsible in your organization. Because the photo may show someone else's vehicle and licence plate, we do not store it in a publicly accessible place, we remove all metadata when it is uploaded (e.g. GPS position, capture time, device identifiers), and we delete it 30 days after the report has been resolved. The report itself stays with the organization as a record, without the photo. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is getting blocked charging bays cleared.

• Data on your device

  Your sign-in token, your language choice and the device name are kept in the operating system's protected storage (Android Keystore or iOS Keychain) and are excluded from the device's automatic backup. So that the app can show the last known state without a connection, it caches chargers, bookings, the waitlist and notifications on the device. This cache is deleted when you sign out.

• No advertising, no tracking

  The app contains no advertising, does not read an advertising ID and uses no third-party analytics, tracking or crash-reporting services. We do not pass data from the app to third parties for their own purposes. Google and Apple collect their own data through their app stores and operating systems, for example about installs or crashes if you have allowed this on your device; their privacy policies apply to that.

• Account without an invitation

  If your employer does not use ChargeSlot yet, you can also create an account in the app without an invitation or QR code (name, email address, password). The same rules apply as for any other account. The legal basis is Art. 6(1)(b) GDPR.

• Starting a team

  If you start a team in the app, you create an organization on ChargeSlot and – exactly as with a sign-up on the web – receive the manager role: you manage the team, see its members and decide on join requests from colleagues, which we show you with their name and email address for that purpose. We store the team name, the location, the names of the chargers and your device's time zone. We save the domain of your email address (e.g. company.com, but never addresses of public providers such as gmail.com or gmx.de) as a trusted domain: anyone with an address at that domain can join your team without approval. You can change this on the web dashboard, where you can also hand the manager role over to someone else. The legal basis is Art. 6(1)(b) GDPR.

• Suggesting your employer

  You can suggest your company to us. We then store the company name, optionally the city and – only if you provide it – the name of a contact person, as well as whether you would like to be notified. We do not collect an email address or any other contact details of the contact person. Please only enter another person's name if you can assume they agree. ChargeSlot does not contact this person. The suggestion is sent by email to the ChargeSlot team (Dawid Kostka), who may use it to get in touch with the company. The app also gives you a prepared message with a personal link that you can share yourself. If the company signs up through this link or we match it ourselves, we notify you once if you asked us to. The legal basis is our legitimate interest in approaching companies whose employees would like to use ChargeSlot (Art. 6(1)(f) GDPR). We delete your suggestions together with your account. Suggestions through which the company has not signed up are also deleted 12 months after they were made.

• Information for named contact persons

  If someone named you as a contact person, we only received your name, together with the company name and city – not from you, but from a person at your company who would like to use ChargeSlot. We do not store your email address or any other contact details, and we do not write to you. We use your name only to address the right person if we get in touch with your company; if we do, we point you to this processing at that time. Without contact details we cannot inform you separately, so this policy is the information under Art. 14 GDPR (Art. 14(5)(b) GDPR). You can object at any time (Art. 21 GDPR) and ask us to delete your name; an email to dk@chargeslot.app is enough. At the latest, we delete your name together with the suggestion: when the person who named you deletes their account, or 12 months after the suggestion if your company has not signed up.

• Deleting your account in the app

  Under “More → Delete account” you can delete your account directly in the app. Among other things, this deletes your bookings, waitlist entries, notifications, employer suggestions and the sign-in and push tokens of your devices. The page “Delete account”, linked in the section “Your rights”, describes exactly what is deleted. Uninstalling the app does not delete your account.

We may update this privacy policy if our processing activities change or legal requirements evolve. We will post the new version on this page and indicate the revision date.