Privacy Policy

CarVolt (“CarVolt,” “we,” “us,” or “our”) provides an electric vehicle charging station discovery, navigation, and route-planning application (the “App”) and the website at https://carvolt.app (together, the “Services”).

This Privacy Policy explains how we collect, use, disclose, retain, and protect personal data when you use the Services. It also describes your rights under applicable privacy laws, including the European Union General Data Protection Regulation (“GDPR”) and Türkiye’s Law No. 6698 on the Protection of Personal Data (“KVKK”).

By using the Services, you acknowledge the practices described in this Privacy Policy. Where consent is the legal basis for processing, you may withdraw that consent at any time.

1. Information We Collect

1.1 Information you provide

We may collect:

• Account information: your email address, password in hashed form, and name if provided.
• Authentication information: identifiers and basic profile information received when you choose Sign in with Apple or Google Sign-In. Depending on your choices and the provider, this may include your name, email address, provider-specific user identifier, and profile image.
• Vehicle information: vehicle make, model, version, battery capacity, efficiency, or other vehicle details you choose to save.
• Preferences and saved content: favorite charging stations and related account preferences.
• User-generated content: ratings, comments, station reports, and other information you submit. Comments and ratings may be visible to other users.
• Support communications: information included when you contact us or make a privacy request.

Passwords are not stored in plain text.

1.2 Location information

With your device permission, we process approximate or precise location information to show charging stations near you, calculate charging routes, support navigation, and improve the location-based experience.

You can disable location access at any time in your device settings. Some location-based features may then be unavailable. CarVolt does not sell location information and does not use it to track you across third-party apps or websites.

1.3 Device and notification information

If you enable push notifications, we collect a device push notification token and limited device-related information required to deliver notifications, such as platform, app version, locale, and notification preferences. You may disable notifications in your device settings.

1.4 Information we do not collect

CarVolt does not collect payment or credit card information, government identification information, health information, contacts or address-book data, photos or photo-library content, camera recordings, or microphone recordings.

1.5 Analytics and crash reports

We currently do not use an analytics platform and do not use advertising technologies.

We may enable a crash-reporting service, such as Firebase Crashlytics, in a future release. Before doing so, we will update this Privacy Policy and applicable App Store privacy disclosures. Crash reports may include technical diagnostics such as device model, operating-system version, app version, crash traces, and a pseudonymous installation identifier.

2. How We Use Information

We use personal data to:

• create, authenticate, secure, and manage accounts;
• provide email/password, Google, and Apple authentication;
• display nearby charging stations and calculate charging routes;
• personalize results using saved vehicles, favorites, and preferences;
• publish and moderate ratings, comments, and station reports;
• send service, security, and push notifications requested or enabled by you;
• respond to support, access, export, correction, and deletion requests;
• prevent fraud, abuse, unauthorized access, and security incidents;
• maintain, troubleshoot, and improve the reliability of the Services;
• comply with legal obligations and enforce our terms.

3. Legal Basis for Processing

Where the GDPR applies, we process personal data under one or more of the following legal bases:

• Performance of a contract: to create and operate your account and provide requested App features.
• Consent: for device location, push notifications, and other processing where your permission is required. You may withdraw consent through device settings or by contacting us.
• Legitimate interests: to secure, maintain, troubleshoot, moderate, and improve the Services, provided those interests are not overridden by your rights and freedoms.
• Legal obligations: to comply with applicable law, lawful requests, and record-keeping duties.
• Legal claims: where processing is necessary to establish, exercise, or defend legal claims.

Where the KVKK applies, personal data is processed in accordance with the conditions set out in Articles 5 and 6 of the KVKK, including explicit consent where required, necessity for the establishment or performance of a contract, compliance with legal obligations, establishment or protection of a right, and our legitimate interests where your fundamental rights and freedoms are not harmed.

Permissions granted through iOS or another device platform do not replace any consent required by applicable law.

4. Data Retention

We retain personal data only for as long as reasonably necessary for the purposes described in this Policy, including to provide the Services, comply with legal obligations, resolve disputes, and protect the Services.

• Account information, saved vehicles, and favorites are retained while your account remains active.
• Comments, ratings, and station reports are retained while published or needed for moderation, integrity, dispute resolution, or legal compliance.
• Authentication and security records are retained for a limited period necessary to protect accounts and investigate abuse.
• Push notification tokens are retained until they expire, are replaced, notifications are disabled, or your account is deleted.
• Support and privacy-request records may be retained as required to demonstrate compliance.

When you delete your account, we delete or anonymize personal data that is no longer required. Deletion from active systems may take a reasonable period, and residual copies may remain temporarily in encrypted backups until those backups are overwritten. We may retain limited information where required by law, necessary to protect legal rights, or needed to prevent fraud and abuse.

5. Data Sharing

We disclose personal data only as necessary:

• Service providers: vendors that provide hosting, email delivery, authentication, push notifications, security, or technical infrastructure under appropriate contractual and confidentiality obligations.
• Authentication providers: Apple and Google when you choose their sign-in services.
• Public content: ratings and comments you choose to publish may be visible to other users. We do not intentionally display your private account details with public content unless the App clearly indicates otherwise.
• Charging and vehicle integrations: if you choose a future charging-operator or vehicle-manufacturer integration, relevant data may be shared to provide the requested feature. We will provide any additional notice or consent required before enabling such sharing.
• Legal and safety purposes: authorities, courts, advisers, or other parties where disclosure is required by law or reasonably necessary to protect users, the public, our rights, or the security of the Services.
• Business transfers: a successor or relevant party in connection with a merger, financing, reorganization, sale of assets, or similar transaction, subject to applicable law.

We do not sell or rent personal data. We do not share personal data for cross-context behavioral advertising.

6. International Transfers

CarVolt and its service providers may process data in countries other than the country where you live. Those countries may have different data-protection laws.

Where required under the GDPR, we use an approved transfer mechanism, such as an adequacy decision, Standard Contractual Clauses, and supplementary safeguards. Where required under the KVKK, international transfers are made in accordance with Article 9 of the KVKK and applicable secondary legislation, including appropriate safeguards or explicit consent where legally necessary.

You may contact us for more information about safeguards relevant to your personal data.

7. Security

We use reasonable administrative, technical, and organizational safeguards designed to protect personal data. These include access controls, encrypted network transmission, hashed passwords, limited-access production systems, session controls, and security monitoring where appropriate.

No transmission or storage system is completely secure. We therefore cannot guarantee absolute security. You are responsible for protecting your account credentials and should notify us promptly if you believe your account has been compromised.

8. User Rights and Choices

Depending on your location and applicable law, you may have the right to:

• access personal data we hold about you and learn how it is processed;
• correct inaccurate or incomplete data;
• receive a portable copy of certain data;
• request deletion of your account and personal data;
• restrict or object to certain processing;
• withdraw consent at any time, without affecting prior lawful processing;
• object to a decision based solely on automated processing, where applicable;
• lodge a complaint with a competent data-protection authority.

Under Article 11 of the KVKK, data subjects may also learn whether personal data is processed, request information about processing, learn the purpose of processing and whether data is used accordingly, know third parties to whom data is transferred domestically or abroad, request correction or deletion in accordance with applicable conditions, request notification of those actions to recipients, object to an adverse result arising from analysis exclusively by automated systems, and claim compensation for damages caused by unlawful processing.

You can delete your account using the account-deletion option in the App, where available; request deletion, access, correction, or export by emailing support@carvolt.app; disable location access and notifications in iOS Settings; and manage Google or Apple permissions through your provider account settings.

We may need to verify your identity before completing a request. We will respond within the period required by applicable law. You may lodge a GDPR complaint with your local supervisory authority or submit a KVKK complaint to Türkiye’s Personal Data Protection Authority after using applicable controller-request procedures.

9. Children’s Privacy

CarVolt is not directed to children under 13, and we do not knowingly collect personal data from children under 13. Where local law requires a higher age for valid consent to online services, users below that age may use the Services only with authorization from a parent or legal guardian.

If you believe a child has provided personal data without appropriate authorization, contact us at support@carvolt.app. We will take appropriate steps to investigate and delete the information where required.

10. Cookies and Similar Technologies

The iOS App does not use browser cookies. Our website may use strictly necessary cookies or similar local-storage technologies required for security, network management, or essential functionality. We currently do not use advertising cookies or analytics cookies.

If we introduce non-essential cookies in the future, we will provide appropriate notice and consent controls where required.

11. Third-Party Services

The Services currently use:

• Sign in with Apple: Apple processes authentication information under Apple’s privacy policy. CarVolt receives only the data Apple makes available based on your choices, which may include a private relay email address.
• Google Sign-In: Google processes authentication information under Google’s privacy policy. CarVolt uses information received from Google only to authenticate and maintain your account and in accordance with applicable Google API Services User Data Policy requirements.
• Apple Push Notification Service (APNs): Apple processes device tokens and delivery information needed to provide push notifications.
• Email delivery providers: transactional emails, including account verification codes, are delivered through an email service provider acting on our behalf.

Future integrations may include Firebase Crashlytics, vehicle-manufacturer APIs, and charging-operator APIs. Such services may process information under their own privacy notices. We will update this Policy and request additional permission or consent where required before materially changing our practices.

Third-party websites and services are governed by their own terms and privacy policies. CarVolt is not responsible for their independent privacy practices.

12. No Advertising or Cross-App Tracking

CarVolt does not display advertising and does not track users across third-party apps or websites. We do not use information for targeted advertising and do not provide data to data brokers.

If these practices change, we will update this Policy, update our App Store disclosures, and request any consent required under Apple’s App Tracking Transparency framework or applicable law before tracking occurs.

13. Changes to This Policy

We may update this Privacy Policy to reflect changes to the Services, legal requirements, or our data practices. We will post the updated Policy at https://carvolt.app/privacy and revise the “Last Updated” date.

If a change materially affects your rights or how we use personal data, we will provide additional notice through the App, email, or another appropriate method and obtain consent where required.

14. Contact Information