This is a courtesy translation: the Italian version is the only authoritative one and prevails in the event of any discrepancy.
Privacy Policy
Last updated: 5 June 2026
This notice on the processing of personal data is provided pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 ("GDPR") to users ("User", "you") of the EVmetry service (the "Application" or the "Service"), available at https://evmetry.com.
EVmetry is a web application that lets the User create an EVmetry account and connect an official Tesla account through Tesla OAuth. The Service reads telemetry data from the User's Tesla vehicle through the official Tesla Fleet API and displays information such as trips, charging sessions, battery state, estimated costs and maps.
The Service's automatic polling is read-only and does not "wake" the vehicle (no automatic wake-up). Any wake-ups or remote commands are sent only at the User's explicit request and, where required, after the configuration Tesla asks for.
1. Data controller
The data controller is:
- Name: Gabriel Piraccini
- Italian tax code: PRCGRL01L08H501R
- Email for privacy requests: privacy@evmetry.com
- General contact email: gabriel@evmetry.com
For any request concerning the processing of your personal data or the exercise of your rights, you can write to the email address above.
The controller has not appointed a Data Protection Officer (DPO). Privacy requests can be sent to privacy@evmetry.com.
2. Categories of personal data processed
In providing the Service, the controller processes the following categories of personal data:
2.1 EVmetry and Tesla account data and authentication data
- EVmetry account data (e.g. email address and name) and a cryptographic hash of the password. The EVmetry password is not stored in clear text.
- Tesla account identifier and data returned by the OAuth authentication process (e.g. user identifier, email address associated with the Tesla account, scope of the permissions granted).
- Access tokens and refresh tokens issued by Tesla, needed to query the Tesla Fleet API on the User's behalf. These tokens are stored encrypted (AES-256-GCM encryption), are never exposed to the browser and are decrypted server-side only when needed.
2.2 Vehicle identifiers
- Vehicle identification number (VIN), vehicle identifier in the Fleet API, model, configuration and other technical identifiers made available by Tesla.
2.3 Vehicle telemetry data
- Battery state and level, estimated range, charging data (power, energy, sessions), mileage (odometer), speed, vehicle state, efficiency parameters and other technical telemetry data made available by the Tesla Fleet API.
2.4 Location data
- Geographic position of the vehicle (GPS coordinates), routes and trip history.
- Addresses of the places you choose to save (e.g. home or work), their recognition radius and the associated charging tariff. When you save or edit a place, the address is sent to the geocoding service to obtain its coordinates.
- Location data is particularly significant in terms of confidentiality, since it can reveal the User's habits, movements and the places they visit. Access happens only after you authorise the Tesla vehicle_location scope during the OAuth connection. You can revoke the authorisation from your Tesla account or by deleting your EVmetry account.
2.5 Payment data
- Payments and subscriptions are handled through Stripe. EVmetry neither receives nor stores full payment card details. The Service processes the Stripe identifiers, the subscription status, the chosen plan and its renewal or expiry date, all needed to manage access.
2.6 Technical and browsing data
- Data collected automatically by the technical infrastructure (e.g. IP address, browser and device type, technical logs, session identifier) needed for the operation, security and diagnostics of the Service.
3. Purposes of processing and legal bases
| # | Purpose | Legal basis (GDPR) |
|---|---|---|
| a | Providing the Service: managing the EVmetry account, connecting through Tesla OAuth, reading telemetry via the Fleet API, displaying trips, charges, battery, costs and maps | Performance of a contract to which the User is party, Art. 6(1)(b) GDPR |
| b | Managing the subscription, invoicing and payments | Performance of the contract, Art. 6(1)(b), and compliance with legal obligations (e.g. tax and accounting), Art. 6(1)(c) |
| c | Processing the vehicle's location data to show maps, routes and trip history requested by the User, subject to the Tesla vehicle_location scope being granted | Performance of the contract, Art. 6(1)(b) |
| d | Security of the Service, prevention of abuse and fraud, technical diagnostics | Legitimate interest of the controller in ensuring the security and correct operation of the Service, Art. 6(1)(f) |
| e | Compliance with legal, accounting and tax obligations and handling of any disputes | Legal obligation, Art. 6(1)(c), and legitimate interest, Art. 6(1)(f) |
Providing the data under points (a) and (b) is necessary in order to use the Service: without it, the Service cannot be provided.
You can withdraw the Tesla authorisation for the vehicle_location scope at any time (see Section 8). If the authorisation is not granted or is withdrawn, location-based features such as maps and routes cannot be provided.
4. How data is processed
Data is processed with electronic and automated tools, applying technical and organisational measures appropriate to ensure the security, confidentiality, integrity and availability of the data. Processing is carried out by the controller and by the processors listed in Section 6.
The Service carries out no automated decision-making and no profiling producing legal or otherwise significant effects on the User within the meaning of Art. 22 GDPR.
5. Data retention periods
Personal data is kept for the time strictly necessary to achieve the purposes for which it was collected and, in particular:
- EVmetry account, Tesla tokens (access/refresh) and telemetry and location data: for the whole duration of the contractual relationship / of the active account. After expiry, cancellation or non-renewal of the subscription, automatic telemetry collection may continue for a technical grace period of at most 12 hours, designed to avoid interruptions caused by payment or reactivation delays. Once that period ends, EVmetry switches off Fleet Telemetry collection and records no new operational data until the subscription is reactivated.
- Retention after the subscription ends: if the EVmetry account stays open but the subscription is not reactivated, the Tesla tokens, vehicle data, telemetry, location data, trips, charges and stops are kept for at most 6 months from the end of access to the Service, to allow reactivation, export or support. After that term, such data may be deleted automatically from the operational database, while data whose retention is required by law — in particular accounting and tax data — is kept. Replacing the connected Tesla account does not automatically delete the history saved in the EVmetry profile.
- Deletion of the EVmetry account: if the EVmetry account is deleted, the tokens and the data associated with the account are removed from the operational database without undue delay, without waiting for the 6-month period. Any residual copies in technical backups are deleted according to the infrastructure provider's overwrite and retention cycle.
- Subscription and invoicing data: for the period required by applicable tax and accounting rules (in Italy, as a rule 10 years under Art. 2220 of the Italian Civil Code for accounting records).
- Technical and security logs: for the time needed for security, diagnostics and abuse prevention, according to the retention periods configured at the infrastructure providers and with periodic review of their necessity.
At the end of the retention periods, data is deleted or irreversibly anonymised.
6. Processors, sub-processors and transfers
To provide the Service, the controller relies on third-party providers that process personal data on its behalf as processors (Art. 28 GDPR) or that act as independent controllers. The main ones are:
| Provider | Role / Service | Location / Transfers |
|---|---|---|
| Tesla, Inc. / Tesla | Provision of the Tesla Fleet API and OAuth authentication; source of the vehicle's telemetry and location data | Tesla processes vehicle and Tesla account data according to its own privacy policy. |
| Vercel Inc. | Hosting, delivery of the web Application and Web Analytics limited to public pages | Vercel may process technical data according to its own privacy policy and the applicable agreements. Web Analytics collects aggregate statistics without third-party cookies. |
| Supabase | Database and storage of User data (encrypted tokens, telemetry data, account data) | Database in the EU region (eu-central-1, Frankfurt, Germany). Any transfers outside the EU are governed by Standard Contractual Clauses and/or the Data Privacy Framework. |
| Amazon Web Services (AWS) | mTLS reception, forwarding and technical processing of Fleet Telemetry streams through cloud infrastructure | Data transits the AWS infrastructure configured by the controller. Processing may involve transfers outside the EEA depending on the location of the services used and the applicable safeguards. |
| Mapbox | Geocoding of the address entered by the User, only when saving or editing a place and only when the feature is enabled | The service receives strictly the address needed to obtain its coordinates and processes data according to its own privacy policy. |
| Stripe | Payment, invoicing and subscription management | Stripe processes payment data according to its own privacy policy. EVmetry does not store full card details. |
| Resend / Plus Five Five, Inc. | Sending transactional email, such as account verification and password reset | The service receives the email address, subject and content of the message. Transfers are governed by the provider's Data Processing Addendum. |
The main database is hosted in the European Union. Some technical providers may involve processing or transfers to third countries. Where a transfer of personal data outside the European Economic Area is necessary, the controller verifies that the safeguards under Chapter V of the GDPR apply. You can ask for more information by writing to privacy@evmetry.com.
An up-to-date list of processors and sub-processors can be requested at any time by contacting the controller at the details in Section 1.
7. Your rights as a data subject
As a data subject you have the right to exercise, within the limits and under the conditions of Articles 15 to 22 GDPR, the following rights:
- Right of access (Art. 15): obtain confirmation that processing is taking place and access your personal data.
- Right to rectification (Art. 16): have inaccurate data corrected or incomplete data completed.
- Right to erasure / "right to be forgotten" (Art. 17): have your personal data erased in the cases provided for.
- Right to restriction of processing (Art. 18): obtain restriction of processing in the cases provided for.
- Right to data portability (Art. 20): receive the data concerning you in a structured, commonly used, machine-readable format and transmit it to another controller.
- Right to object (Art. 21): object to processing based on the controller's legitimate interest.
- Right to withdraw consent (Art. 7(3)): withdraw at any time any consent given, without affecting the lawfulness of processing carried out before the withdrawal.
- Right to lodge a complaint with a supervisory authority (Art. 77): lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome; www.garanteprivacy.it), without prejudice to any other administrative or judicial remedy.
8. How to exercise your rights
To exercise the rights listed above you can:
- write to the controller's email address: privacy@evmetry.com;
- use the functions available inside the Application, such as account deletion.
The controller replies to your requests without undue delay and in any case within one month of receiving the request, save for extensions in the cases provided for by Art. 12 GDPR. Exercising your rights is free of charge, except for manifestly unfounded or excessive requests.
To stop access to location data, you can revoke the authorisation granted to EVmetry directly from your Tesla account, or delete your EVmetry account. You can also contact the controller for assistance.
9. Data security
The controller applies technical and organisational measures appropriate to protect personal data against unauthorised access, loss, destruction or disclosure, including:
- encryption at rest of Tesla tokens (access/refresh) using AES-256-GCM;
- encrypted communications over HTTPS/TLS;
- data isolation between users through database-level access control (e.g. Row Level Security (RLS)), so that each User can only access their own data;
- data access limited to the personnel and systems strictly necessary, on a least-privilege basis;
- main database located in the European Union and infrastructure access limited to the systems needed to provide the Service.
Despite these measures, no system can guarantee absolute security. In the event of a personal data breach that entails a risk to your rights and freedoms, the controller will make the notifications required by Articles 33 and 34 GDPR.
10. Account deletion
You can ask for your account to be deleted at any time through the Application's functions or by contacting the controller. Following deletion:
- the Tesla tokens are deleted and Fleet API access for your account ceases;
- the Application asks for the Fleet Telemetry configuration to be removed from the vehicle before deleting local data;
- any active Stripe subscriptions are cancelled before the account is deleted;
- the telemetry and location data associated with your account is removed from the operational database without undue delay; any residual copies in technical backups follow the infrastructure provider's overwrite and retention cycle;
- only data whose retention is required by law is kept (e.g. invoicing data for tax and accounting purposes).
Note that you can also revoke the authorisation granted to EVmetry at any time directly from your Tesla account settings.
11. Cookies and session management
The Application uses exclusively technical/necessary cookies and technologies for the operation of the Service and for managing the User's authentication and session (e.g. keeping the login state). Under applicable law these tools do not require prior consent, since they are strictly necessary to provide the Service you expressly requested.
The Application does not use profiling or marketing cookies, nor tracking tools for advertising purposes. On public pages only, it uses Vercel Web Analytics for traffic statistics; according to the provider's documentation, this tool uses no third-party cookies, identifies the session temporarily through a hash derived from the request and automatically discards that identifier after 24 hours. Authenticated areas and account lifecycle pages are not sent to Web Analytics. Should non-technical cookies be introduced in future, a dedicated notice will be shown and consent collected where required, and this section will be updated.
12. Minors
The Service is not intended for minors. The controller does not knowingly collect data from people who lack the capacity to enter into a valid contract. Using the Service presupposes holding a Tesla account and a Tesla vehicle.
13. Changes to this notice
The controller reserves the right to amend or update this notice at any time, including as a result of changes in the law or in the Service. Changes will be published on this page together with the "last updated" date. In the event of material changes, the controller may inform you through the Application or by email. Please check this page from time to time.
This document was drafted in Italian. In the event of translations, the Italian version prevails.