Privacy Policy

Version 4.0

Effective Date: 22 July 2026

Last Updated: 31 July 2026

Version numbering is aligned with the in-app Privacy Notice (v4). This policy supersedes web policy v2.0. What changed: location is now described as precise (GPS, foreground only), and the analytics and crash-reporting processors are named with their processing locations (§7, §8).

PixellEnergy Solutions Private Limited ("PixellEnergy", "we", "us") operates the PixellEnergy EV lifestyle app and related services. We are the Data Fiduciary for the personal data described here and handle it under India's Digital Personal Data Protection Act, 2023 ("DPDP Act") and its Rules.

1. Quick Summary

2. Who We Are & Contact

Data Protection / Grievance Officer — dpo@pixellenergy.com · +91 90720 02055 · Bengaluru, Karnataka 560102, India.

3. Data We Collect

• Account: phone number (your sign-in identifier, verified by SMS one-time password), display name, optional email, vehicles.
• Location: precise (GPS), foreground only — collected only while the app is open, for chargers/trips and, if you use SOS, nearest-charger and your chosen sharing. To display the map and compute routes, your location and place-search queries are shared with Google Maps Platform (§7).
• Camera: QR scan / optional vehicle photo. QR images are read on your device and not stored.
• Payment info: via PCI-DSS Level 1 processor; we don't store full card numbers, and no card numbers transit our servers.
• Charging & wallet activity plus telemetry.
• Emergency contacts (optional SOS): the name and phone you manually enter for up to five contacts — we do not read your device's address book.
• Device & usage: device model, OS and app version, crash reports, performance metrics; plus a pseudonymous device-fingerprint hash and the IP address captured at the time you give consent, used to detect suspicious account activity — never for advertising.
• Website cookies.

4. How We Use It

• Service delivery.
• Safety & emergency response (SOS).
• Analytics & improvement (separate opt-in consent, identifiers scrubbed).
• Marketing (separate, optional).
• Legal / financial compliance.

5. Consent & Control

Consent is requested per purpose, by affirmative action, and is as easy to withdraw as to give; each consent is recorded with the exact notice shown. Service, analytics and marketing consents are independent. Withdrawal stops future processing (not what was lawfully done before, or records we must keep).

6. Safety & SOS — Data Shared Only At Your Request

The feature is off until you use it; each sharing action is your explicit choice, with a specific notice and recorded consent.

• Proactive range alerts: while the app is open, we estimate range from the battery level you enter plus foreground location and may alert you — this stays on your screen, not shared.
• Alerting your contacts (SMS): on SOS (or auto-trigger at critically low battery), if enabled, we SMS the emergency contacts you entered (via MSG91) that you may need help. You are responsible for telling those contacts you've listed them.
• Sharing your location: if you choose, we create a secure link your contacts (and linked family) can open. Default is approximate (~500 m); you may choose exact. The link expires after 2 hours and you can revoke it sooner.
• Community (V2V) broadcast: if you choose, we broadcast a help request to nearby opted-in volunteers showing only a masked approximate area.
• Mobile charging unit: if available and requested, we share the dispatch details needed to reach you.
• Emergency services: the screen can dial 112/108 via your phone's dialer; we don't place the call or share data with emergency services through the app.

Legal basis for all SOS sharing is your consent; you can delete your contacts and stop using it anytime.

7. Who We Share With (Sub-processors)

Never sold; minimum necessary:

• Payments: Razorpay (PCI DSS Level 1 payment aggregator); Cashfree may be used as a secondary processor.
• SMS: MSG91 — delivers your sign-in one-time password; receives your phone number and the one-time code.
• Hosting: Supabase (DB / auth / functions, Mumbai / ap-south-1) plus Cloudflare (CDN and secure reverse-proxy for Indian-network reachability).
• Maps: Google Maps Platform — receives your precise location and place-search queries to display the map and compute routes.
• Notifications / config: Firebase — your device's notification token is used only to route messages to your device and does not contain your name or contact details.
• Crash reporting: Sentry — may process diagnostic data outside India; identifiers scrubbed before events leave the device.
• Product analytics (opt-in only): PostHog — processes opt-in usage events on infrastructure located in the United States; PII is stripped at the client before events leave the device. Off until you consent to Analytics.
• Charging / franchise partners — to start/stop a charging session at their site (station id + session id + your user id).
• Legal where lawfully required.

8. Storage & Cross-border

Your identifiable personal data — name, phone number, email, vehicle details and payment information — is stored and processed on servers located in India (Mumbai). Some diagnostic and analytics tooling runs on infrastructure outside India: our product-analytics tool PostHog processes opt-in usage events in the United States, and our crash-reporting tool Sentry may process diagnostic data outside India. Only technical, performance and pseudonymous usage data is processed in this way, and it is stripped of information that could identify you before it leaves our systems. In addition, Cloudflare's edge may route encrypted traffic, and map features send your location queries to Google Maps Platform (§7). We do not transfer your identifiable personal information outside India.

9. Retention

• Account: while active.
• Charging & financial records: ≥ 8 years (tax / audit).
• Crash & analytics events: 90 days by default.
• Consent records: retained indefinitely as DPDP audit record.
• SOS: event and SMS-delivery logs retained for safety audit (anonymised for analytics); shared-location link expires after 2 hours.
• Deletion: soft-delete then permanent delete after 30 days, except legally-required records (retained in pseudonymised form per applicable statute).

10. Your Rights (DPDP)

Access summary, correct / update, erase, withdraw consent, nominate a representative, raise a grievance — free, via in-app Privacy controls or the DPO. Export within 7 days; other requests within legal timelines.

11. Data Breach

If a personal-data breach affects you, we will notify you without delay — as soon as we become aware and your data is identified as affected. We will also notify the Data Protection Board of India in two stages: an immediate intimation on becoming aware, followed by a detailed report within 72 hours of becoming aware (or such longer period as the Board may allow), as required by Rule 7 of the DPDP Rules, 2025.

12. Children

Not intended for under-18s; we don't knowingly collect their data. If a minor is identified, the associated data is deleted upon discovery.

13. Grievance & the Board

Contact our Grievance Officer / DPO — we acknowledge grievances within 72 hours and resolve within 30 days (45 days for complex cases). If unsatisfied, you may complain to the Data Protection Board of India.

14. Security

TLS encryption in transit, encryption at rest, role-based access control with row-level security, and periodic security review.

15. Changes

We'll post updates here with a new version and date, and seek fresh consent for material changes where the law requires. Prior versions remain retrievable upon request. This policy is served in English; translations, where provided, are for reference and the English text governs in case of any discrepancy.

16. Contact