This is a courtesy translation: the Italian version is the only authoritative one and prevails in the event of any discrepancy.
Privacy Policy
Last updated: 28 September 2026
This privacy notice is provided under Articles 13 and 14 of Regulation (EU) 2016/679 ("GDPR") to users ("User", "you") of the EVmetry service (the "Application" or the "Service"), available at https://evmetry.com and through the iPhone and Android apps. Section 14 contains the additional information for Users resident in the United States.
EVmetry lets you create an EVmetry account and connect an official Tesla account through Tesla OAuth. The Service reads your Tesla vehicle's telemetry through the official Tesla Fleet API and shows information such as trips, charging sessions, battery status, estimated costs and maps.
The Service's automatic polling is read-only and does not wake the vehicle (no automatic wake-up). Wake-ups and remote commands are sent only at your explicit request and, where required, after the setup Tesla asks for.
1. Data controller
The data controller is:
- Name: Gabriel Piraccini
- Tax code: PRCGRL01L08H501R
- Email for privacy requests: privacy@evmetry.com
- General contact email: gabriel@evmetry.com
For any request about how your personal data is handled, or to exercise your rights, write to the email address above.
The controller has not appointed a Data Protection Officer (DPO). Privacy requests can be sent to privacy@evmetry.com.
2. Categories of personal data processed
To deliver the Service, the controller processes the following categories of personal data:
2.1 EVmetry and Tesla account and authentication data
- EVmetry account data (e.g. email address and name) and a cryptographic hash of your password. Your EVmetry password is never stored in clear text.
- If you choose to sign in with Apple or with Google, the user identifier returned by the provider and the associated email address. EVmetry never receives your Apple or Google password.
- Tesla account identifier and the data returned by the OAuth authentication flow (e.g. user identifier, email address linked to the Tesla account, scope of the permissions granted).
- Access tokens and refresh tokens issued by Tesla, needed to query the Tesla Fleet API on your behalf. These tokens are stored encrypted (AES-256-GCM), are never exposed to the browser and are decrypted server-side only when needed.
- If you enable two-factor authentication, the TOTP secret linked to your account.
2.2 Vehicle identifiers
- Vehicle identification number (VIN), Fleet API vehicle identifier, model, configuration and other technical identifiers made available by Tesla.
2.3 Vehicle telemetry data
- Battery state and level, estimated range, charging data (power, energy, sessions), odometer, speed, vehicle state, efficiency figures and other technical telemetry made available by the Tesla Fleet API.
2.4 Location data
- Geographic position of the vehicle (GPS coordinates), routes and trip history.
- Addresses of the places you choose to save (e.g. home or work), their recognition radius and the associated charging tariff.
- Location data is especially sensitive from a privacy standpoint, because it can reveal your habits, movements and the places you visit. Access happens only after you grant the Tesla vehicle_location scope during the OAuth connection. You can withdraw that authorisation from your Tesla account or by deleting your EVmetry account.
- To turn coordinates into readable place names, to compute a route's elevation profile and to show weather conditions, some GPS coordinates are sent to the providers listed in Section 6, which states exactly what each one receives.
2.5 Payment data
- Purchases made on the website are handled by Stripe; purchases made inside the iPhone app are handled by Apple. In neither case does EVmetry receive or store full payment card details. The Service handles the subscription identifiers, status, chosen plan and the related renewal or expiry date needed to manage access.
2.6 AI Assistant conversations
- If you use the AI Assistant, the Service handles the text of your questions, the generated answers and the account data the Assistant looks up to answer: trips, charges, consumption, costs, saved place names and GPS-derived addresses for the routes you ask about. This content is sent to the provider listed in Section 6 to generate the answer.
- The current configuration does not request OpenRouter's per-request Zero Data Retention routing. OpenRouter forwards content to the selected model provider; any retention or use for training depends on that provider and on OpenRouter's routing configuration. Do not include sensitive information that is unnecessary for your question.
2.7 Notification and communication data
- Device token for push notifications (APNs), if you enable notifications in the iPhone app.
- Telegram chat identifier, if you voluntarily link the Telegram bot to receive notifications.
- Email address for transactional messages: account verification, password reset, invitations and initial subscription confirmations. The same address also receives the promotional emails described in Section 3.1, according to your account's preferences.
- Your promotional email preferences, the record of those choices (category, choice, date and channel) and the list of promotional emails we sent you (campaign, subject, date and outcome), together with the version and date on which you accepted the Terms of Service.
2.8 Social feature data
- If you choose to take part in Challenges or the Leaderboard, the Service handles the public alias you set and the efficiency scores derived from your data and, on the leaderboard, displays the vehicle model, trim and year without publishing the VIN, registration plate or real name. Taking part in the global leaderboard is optional and off by default.
- If you create a public share link for a trip, the blocks of data you choose to include become accessible to anyone holding the link, until the expiry you set.
2.9 Technical, browsing and diagnostic data
- Data collected automatically by the technical infrastructure (e.g. IP address, browser and device type, technical logs, session identifier) needed to run, secure and troubleshoot the Service.
- Error reports and diagnostic traces produced when a feature fails, used to fix defects.
3. Purposes of processing and legal bases
| # | Purpose | Legal basis (GDPR) |
|---|---|---|
| a | Delivering the Service: managing the EVmetry account, connecting through Tesla OAuth, reading telemetry via the Fleet API, showing trips, charges, battery, costs and maps | Performance of a contract to which the User is party, Art. 6(1)(b) GDPR |
| b | Managing the subscription, invoicing and payments | Performance of the contract, Art. 6(1)(b), and compliance with legal obligations such as tax and accounting rules, Art. 6(1)(c) |
| c | Processing the vehicle's location data to show maps, routes, elevation, weather and the trip history you request, once the Tesla vehicle_location scope has been granted | Performance of the contract, Art. 6(1)(b) |
| d | Running the AI Assistant on the questions you ask | Performance of the contract, Art. 6(1)(b) |
| e | Sending push notifications and, if you link them, Telegram notifications | Performance of the contract, Art. 6(1)(b); for the Telegram link, your explicit request |
| f | Taking part in Challenges and the public Leaderboard | Performance of the contract for Challenges; consent, Art. 6(1)(a), for the anonymous global leaderboard, withdrawable at any time from settings |
| g | Security of the Service, prevention of abuse and fraud, technical diagnostics and defect fixing | Legitimate interest of the controller in keeping the Service secure and working correctly, Art. 6(1)(f) |
| h | Meeting legal, accounting and tax obligations and handling any disputes | Legal obligation, Art. 6(1)(c), and legitimate interest, Art. 6(1)(f) |
| i | Sending promotional emails about EVmetry (your car's recaps, tips and news, offers), as described in Section 3.1 | For accounts created from 26 September 2026 and for users who turn the emails on in the settings, consent, Art. 6(1)(a), and Art. 130(1) of the Italian Privacy Code (Legislative Decree 196/2003); for users who purchased an EVmetry subscription, Art. 130(4) of the Italian Privacy Code (similar services), unless they object. Accounts registered before 26 September 2026, initially enrolled by default, receive promotional emails only after confirming their choice (Section 3.1) |
Providing the data under points (a) and (b) is necessary in order to use the Service: without it, the Service cannot be delivered. The features under points (d), (e), (f) and (i) are optional.
You can withdraw the Tesla vehicle_location authorisation at any time (see Section 8). Without that authorisation, or after withdrawing it, location-based features such as maps and routes cannot be delivered.
3.1 Promotional emails
Besides the emails needed to run your account, EVmetry may send you promotional emails on three topics, which you can choose one by one:
- Your car's recaps: periodic, usually monthly, summaries built from the vehicle data the Service already processes.
- Tips and news: suggestions on using your Tesla and on charging, and new EVmetry features.
- Offers: promotions, invitations and free trials of EVmetry services.
How they are turned on. For accounts created from 26 September 2026, promotional emails are on only if you choose them: right after accepting the Terms, on a dedicated screen that lists them one by one with no box pre-ticked, or later in the settings. In that case the legal basis is your consent (Art. 6(1)(a) GDPR and Art. 130(1) of the Italian Privacy Code). Accounts registered before 26 September 2026 had been enrolled by default in all three categories: we send these accounts no promotional emails until they confirm their choice on the same screen or in the settings. Users who purchased an EVmetry subscription receive emails about services similar to the ones they purchased under Art. 130(4) of the Italian Privacy Code, until they object.
How to stop them. Every promotional email contains a one-click unsubscribe link. You can also change your preferences at any time, free of charge and with no effect on the Service, in the Settings of the EVmetry website or of the iPhone and Android apps, section "Emails from EVmetry", or by replying to one of our emails or writing to privacy@evmetry.com. Account emails (address verification, password reset, subscription receipts and reminders, security alerts) keep arriving because the Service needs them.
Recipients. Emails are sent through Resend, listed in Section 6 as a processor. Your data is not passed on to third parties for their own marketing.
4. How data is processed
Data is processed with electronic and automated tools, applying technical and organisational measures appropriate to keep it secure, confidential, accurate and available. Processing is carried out by the controller and by the processors listed in Section 6.
The Service carries out no automated decision-making and no profiling producing legal or similarly significant effects on the User under Art. 22 GDPR. The AI Assistant generates text in reply to your questions and takes no decisions about you.
5. Data retention periods
Personal data is kept only as long as strictly needed for the purposes it was collected for, and in particular:
- EVmetry account, Tesla tokens (access/refresh) and telemetry and location data: for the whole duration of the contract and of the active account. After the subscription expires, is cancelled or is not renewed, automatic telemetry collection may continue for a technical tolerance window of at most 12 hours, so that a payment delay or a reactivation does not cause an accidental interruption. After that window EVmetry turns Fleet Telemetry collection off and records no new operational data until the subscription is reactivated.
- Retention after the subscription ends: if the EVmetry account stays open but the subscription is not reactivated, Tesla tokens, vehicle data, telemetry, location, trips, charges and parking data are kept for at most 6 months from the end of access to the Service, so that reactivation, export or support remain possible. After that period, this data may be deleted automatically from the operational database, while data that must be kept under a legal obligation is retained, in particular accounting and tax records. Replacing the connected Tesla account does not automatically delete the history saved in your EVmetry profile.
- EVmetry account deletion: if you delete your EVmetry account, the tokens and the data linked to the account are removed from the operational database without undue delay, without waiting for the 6-month period. Any residual copies in technical backups are removed following the infrastructure provider's overwrite and retention cycle.
- AI Assistant conversations: kept together with the account and deleted with it.
- Promotional email preferences, consent record and list of sent emails: for the whole life of the account, as evidence of the choices you made; deleted together with the account, including the email address stored with each sent email.
- Anti-abuse record for the invitation programme: a small amount of information tied to the vehicle's VIN, namely whether a given vehicle has already used an invitation or a free trial, is kept even after the account is deleted and without any reference to the deleted account, because it is the only safeguard against the same promotion being used over and over.
- Subscription and billing data: for the period required by the applicable tax and accounting rules (in Italy, as a rule 10 years under Art. 2220 of the Civil Code for accounting records).
- Technical, diagnostic and security logs: for as long as needed for security, diagnostics and abuse prevention, following the retention periods configured with the infrastructure providers and with periodic review of whether they are still needed.
Once the retention periods end, data is deleted or irreversibly anonymised.
6. Processors, sub-processors and transfers
To deliver the Service, the controller relies on third-party providers that process personal data on its behalf as processors (Art. 28 GDPR) or that act as independent controllers. The list below states, for each of them, what data they actually receive:
| Provider | Data received and why | Location / Transfers |
|---|---|---|
| Tesla, Inc. | Provides the Tesla Fleet API and OAuth authentication; it is the source of the vehicle's telemetry and location data | Tesla handles vehicle and Tesla account data as an independent controller, under its own privacy policy. |
| Vercel Inc. | Hosting and execution of the web Application; technical request data such as IP address, user agent and logs. Web Analytics limited to public pages, with no third-party cookies | US infrastructure with an EU presence. Transfers are governed by the provider's Data Processing Addendum and by the safeguards in Chapter V GDPR. |
| Supabase | Database and storage of all User data: account, encrypted tokens, telemetry, location, Assistant conversations | Database in the EU region (eu-central-1, Frankfurt, Germany). Any transfer outside the EU is governed by Standard Contractual Clauses and/or the Data Privacy Framework. |
| Amazon Web Services (AWS) | mTLS reception and forwarding of Fleet Telemetry streams: vehicle telemetry and position pass through it | Data travels through the AWS infrastructure configured by the controller. Processing may involve transfers outside the EEA depending on where the services used are located and on the applicable safeguards. |
| Mapbox | Geocoding of the addresses you save as places and reverse geocoding of the GPS coordinates of your trips' start and end points, so the street name is shown instead of raw coordinates. It therefore receives coordinates of real vehicle positions | US provider. It handles data under its own privacy policy and the related data processing agreement. |
| CARTO | Delivery of the map tiles straight to your browser or device: it receives the device's IP address and the geographic area you are viewing, not your trip history | Provider with an international delivery infrastructure. |
| Open-Meteo | GPS coordinates of the points along a route, to derive its elevation profile, and vehicle coordinates for the weather conditions shown in the Application. It receives no account identifiers | The provider handles the data under its own privacy policy. The coordinates sent are not linked to your account. |
| Stripe | Handling of payments, invoicing and the subscription bought on the website: email, name and card details collected directly by Stripe | Stripe handles payment data as an independent controller for its anti-fraud and anti-money-laundering duties. EVmetry never stores full card details. |
| Apple Inc. | Sign in with Apple, with a user identifier and email; push notifications through APNs, with the device token; and, for in-app purchases, handling of the transaction and its renewal | Apple acts as an independent controller for the App Store and the Apple ID, under its own privacy policy. |
| Google LLC | Sign in with Google, if you choose that method: user identifier and email | Google acts as an independent controller for the Google account, under its own privacy policy. |
| OpenRouter | The text of your AI Assistant questions and the account data needed to answer them, including place names and route addresses you ask about; it routes the request to the language model that generates the answer | US provider, which may in turn route the request to model providers in third countries. |
| Telegram | Only if you voluntarily link the bot: the chat identifier and the text of the notifications you chose to receive | Non-EU provider. Linking is optional and can be undone at any time from settings. |
| Sentry (Functional Software, Inc.) | Error reports and diagnostic traces, which may contain technical identifiers and fragments of the request context | US provider. Transfers are governed by the provider's Data Processing Addendum. |
| Resend / Plus Five Five, Inc. | Sending of transactional email and of the promotional email you chose to receive: address, subject and message body | Transfers are governed by the provider's Data Processing Addendum. |
The main database is hosted in the European Union, including for Users resident outside the Union. Some technical providers may involve processing or transfers to third countries. Where a transfer of personal data outside the European Economic Area is necessary, the controller verifies that the safeguards under Chapter V GDPR apply. You can ask for more information by writing to privacy@evmetry.com.
The controller does not sell your personal data and does not share it for behavioural advertising. The Service integrates no advertising networks, tracking pixels or third-party profiling tools.
An up-to-date list of processors and sub-processors can be requested at any time by contacting the controller at the addresses in Section 1.
7. Your rights as a data subject
As a data subject, you have the right to exercise the following rights, within the limits and conditions set by Articles 15 to 22 GDPR:
- Right of access (Art. 15): obtain confirmation that processing is taking place and access your personal data.
- Right to rectification (Art. 16): have inaccurate data corrected or incomplete data completed.
- Right to erasure / "right to be forgotten" (Art. 17): have your personal data deleted in the cases provided for.
- Right to restriction of processing (Art. 18): have processing restricted in the cases provided for.
- Right to data portability (Art. 20): receive the data concerning you in a structured, commonly used, machine-readable format and transmit it to another controller.
- Right to object (Art. 21): object to processing based on the controller's legitimate interest.
- Right to withdraw consent (Art. 7(3)): withdraw any consent you have given at any time, without affecting the lawfulness of processing carried out before the withdrawal.
- Right to lodge a complaint with a supervisory authority (Art. 77): lodge a complaint with the Italian Data Protection Authority (Piazza Venezia 11, 00187 Rome; www.garanteprivacy.it), without prejudice to any other administrative or judicial remedy.
8. How to exercise your rights
To exercise the rights listed above you can:
- write to the controller's email address: privacy@evmetry.com;
- use the features available inside the Application, such as account deletion.
A privacy request is always free of charge and does not require an active subscription. By writing to privacy@evmetry.com you can obtain a copy of your personal data, have it corrected or have it deleted, even if you have never taken out a subscription or your subscription has expired. This channel is separate from the commercial export features inside the Application, namely the full account backup and the CSV, Excel and PDF reports, which are a paid feature meant for everyday use: the fact that they are reserved for subscribers does not limit your right of access and portability in any way.
The controller replies to your requests without undue delay and in any case within one month of receiving them, save for the extensions allowed by Art. 12 GDPR. Exercising your rights is free of charge, except for manifestly unfounded or excessive requests.
To stop access to location data, you can withdraw the authorisation granted to EVmetry directly from your Tesla account, or delete your EVmetry account. You can also contact the controller for help.
9. Data security
The controller applies technical and organisational measures appropriate to protect personal data against unauthorised access, loss, destruction or disclosure, including:
- encryption at rest of Tesla tokens (access/refresh) with the AES-256-GCM algorithm;
- encrypted communications over HTTPS/TLS;
- data isolation between users through database-level access controls (e.g. Row Level Security (RLS)), so that each User can only reach their own data;
- data access limited to the people and systems strictly required, following the principle of least privilege;
- the main database located in the European Union, with infrastructure access limited to the systems needed to run the Service.
Despite these measures, no system can guarantee absolute security. In the event of a personal data breach posing a risk to your rights and freedoms, the controller will make the notifications required by Articles 33 and 34 GDPR and by the applicable breach-notification rules.
10. Account deletion
You can ask for your account to be deleted at any time through the features in the Application, both on the website and in the iPhone app, or by contacting the controller. Following deletion:
- the Tesla tokens are deleted and Fleet API access for your account ends;
- the Application asks for the Fleet Telemetry configuration to be removed from the vehicle before deleting local data;
- any active Stripe subscriptions are cancelled before the account is deleted; subscriptions bought through Apple must be cancelled separately in the App Store, because only Apple can stop their renewal;
- the telemetry and location data linked to your account is removed from the operational database without undue delay; any residual copies in technical backups follow the infrastructure provider's overwrite and retention cycle;
- only data that must be kept under a legal obligation is retained, such as billing records for tax and accounting purposes, together with the minimal anti-abuse information described in Section 5.
Remember that you can also withdraw the authorisation granted to EVmetry at any time from your Tesla account settings.
11. Cookies and session management
The Application uses only technical and strictly necessary cookies and technologies, needed to run the Service and to manage authentication and the User's session (e.g. keeping you signed in). Under the applicable rules these do not require prior consent, because they are strictly necessary to deliver the Service you expressly requested.
The Application does not use profiling or marketing cookies, nor tracking tools for advertising purposes. On public pages only, it uses Vercel Web Analytics for traffic statistics; according to the provider's documentation, this tool uses no third-party cookies, identifies the session temporarily through a hash derived from the request and discards that identifier automatically after 24 hours. Authenticated areas and account lifecycle pages are not sent to Web Analytics. Should non-technical cookies be introduced in future, a dedicated notice will be shown and consent collected where required, and this section will be updated.
Because the Service carries out no advertising tracking, there is no processing to stop in response to an opt-out preference signal sent by a browser.
12. Minors
The Service is not intended for minors and is not directed at children. The controller does not knowingly collect data from people who lack the capacity to enter into a valid contract, nor data from children under 13. Using the Service assumes that you own a Tesla account and a Tesla vehicle. If you believe a minor has given us personal data, write to privacy@evmetry.com and we will delete it.
13. Changes to this notice
The controller reserves the right to change or update this notice at any time, including as a result of changes to the law or to the Service. Changes will be published on this page with the "last updated" date. In the event of substantial changes, the controller may inform you through the Application or by email. Please check this page from time to time.
14. Additional information for Users in the United States
This section adds to, and does not replace, the sections above. The practices described above apply to all Users, wherever they live.
14.1 Applicability of state privacy laws
The applicability of US state privacy laws depends on thresholds, activities and definitions that vary by state and may change. Based on the operational information available on the last updated date, EVmetry believes it is below the principal quantitative thresholds of the California Consumer Privacy Act as amended by the CPRA and several similar state laws. This is a cautious assessment based on the Service's current size and practices, not a statement that no state law can apply.
Without limiting any non-waivable rights under applicable law, EVmetry voluntarily grants all US Users the substantive rights described in Section 14.4. Applicability is reassessed as activities, volumes and laws change.
Federal and state rules on unfair or deceptive trade practices and on automatically renewing subscriptions apply regardless of the size of the business: the related information is in the Terms of Service.
14.2 Categories of personal data collected
In the twelve months before the last updated date, the Service collected the following categories of personal data, all described in detail in Section 2:
| Category | Examples collected by EVmetry | Source |
|---|---|---|
| Identifiers | Name, email address, account identifier, IP address | Directly from the User; automatically from the device |
| Commercial information | Plan taken out, subscription status, renewal date, purchase history | From the User; from Stripe or Apple |
| Precise geolocation | Vehicle GPS coordinates, routes, trip history, saved places | From the Tesla Fleet API, once the vehicle_location scope is granted |
| Vehicle information | VIN, model, configuration, telemetry, battery, charges, consumption | From the Tesla Fleet API |
| Network activity and use of the Service | Technical logs, public pages visited, error reports | Automatically |
| User-generated content | Text of AI Assistant questions, public alias, saved place names, notes | Directly from the User |
The Service does not collect: identity document or social security numbers, health data, biometric data, racial or ethnic origin, religious or philosophical beliefs, sexual orientation, trade union membership, data about children, the contents of email or private messaging, or credit and creditworthiness data.
Precise geolocation is treated as sensitive data by several state laws. EVmetry uses it solely to deliver the features you ask for, namely maps, routes, place recognition, elevation, weather and charging cost attribution, and not to infer personal characteristics, for advertising or for any further purpose.
14.3 Purposes, recipients and retention
The purposes of processing are the ones listed in Section 3, the categories of recipients are listed one by one in Section 6, and the retention periods are set out in Section 5. There are no further recipients or purposes reserved for US Users.
EVmetry does not sell personal data and does not share it for cross-context behavioural advertising, as those terms are defined in state privacy laws: it receives no monetary or other valuable consideration in exchange for personal data and integrates no advertising network. For that reason the Service shows no "Do Not Sell or Share My Personal Information" link: there would be nothing to turn off. The Service does not process personal data for targeted advertising and does not use it for automated decisions producing legal or similarly significant effects, so there is no processing against which to exercise an opt-out right.
Your data is stored in the main database hosted in the European Union, in Germany: if you live in the United States, your data is therefore transferred and stored outside the United States, in addition to passing through the providers listed in Section 6.
14.4 Your rights and how to exercise them
Whatever state you live in, EVmetry grants you the right to:
- know which categories of personal data about you are processed, for what purposes and to which categories of recipients they are disclosed;
- access your personal data and receive a copy of it in a portable format;
- correct inaccurate data;
- delete your personal data, except for what must be kept under a legal obligation or to prevent documented abuse, as set out in Section 5;
- not be discriminated against for exercising any of these rights: price, plan and quality of the Service do not change.
To exercise any of these rights, write to privacy@evmetry.com, or use the account deletion features inside the Application. The request is free of charge and does not require an active subscription. To verify your identity you will be asked to write from the email address linked to the account or to confirm information already held in the account: you will never be asked for data beyond what verification requires. We reply without undue delay and in any case within 45 days, extendable once where the request is complex, and we will tell you if that happens.
An authorised agent may submit a request on your behalf by attaching written permission; we may still ask you to confirm the mandate directly.
14.5 Privacy contacts in the United States
The data controller remains Gabriel Piraccini, at the addresses in Section 1. For privacy requests, write to privacy@evmetry.com. You may also contact the Federal Trade Commission, your state Attorney General or the privacy authority competent in your state; the available authority and remedies depend on the applicable law and where you live.
This document was drafted in Italian. In the event of translation, the Italian version prevails.