Chargalytics Privacy Policy

1. Who we are

Chargalytics is owned and operated by Incremental AS, a company registered in Norway with its registered office in Oslo. Incremental AS is the data controller responsible for your personal data. For any privacy question or request, contact us at [email protected].

2. What this policy covers

This policy covers personal data we process when you visit chargalytics.com, create an account, verify your phone number, subscribe to a paid plan, or otherwise interact with the platform. It does not cover the EV charging station, connector, or traffic data shown in the product, which is not personal data about you.

3. Data we collect

We collect the following categories of personal data:

• Account data: your name, email address, a hashed password, and, for business plans, your organisation and role.
• Phone number: collected when you choose to verify your account by SMS during registration or account recovery.
• Billing data: your subscription plan and the payment details handled by our payment processor. We never see or store full card numbers.
• Technical and usage data: IP address, browser and device information, pages viewed, and actions taken in the product.
• Security data: records of verification attempts, originating IP addresses, and rate-limit counters used to detect and prevent fraud and abuse.
• Communications: messages you send us, for example by email to [email protected].

4. How we use your data and our legal basis

We process personal data on the following legal bases under the GDPR:

• To provide the platform, manage your account, and deliver your subscription — necessary for performance of our contract with you (Art. 6(1)(b)).
• To secure the service, prevent fraud and abuse, and keep the platform reliable — our legitimate interests (Art. 6(1)(f)).
• To send you newsletter or marketing emails, and to set any non-essential cookies — only with your consent (Art. 6(1)(a)), which you can withdraw at any time.
• To meet accounting, tax, and other legal obligations — compliance with a legal obligation (Art. 6(1)(c)).

5. Phone numbers and SMS verification

If you verify your account by SMS, we use your phone number solely to send you a one-time verification code during registration or account recovery. You opt in by entering your number and choosing to continue to phone verification; we do not send marketing or promotional SMS. To deliver these codes and protect against SMS fraud, we share your number with our SMS providers (see Who we share data with) and log the verification attempt and the originating IP address. If you would rather not verify by SMS, contact [email protected] for assistance.

6. Cookies and similar technologies

We use only the cookies needed to run the platform: a session cookie to keep you signed in, a remember-me cookie if you choose to stay signed in, and a cookie that stores your language preference. We also use Cloudflare Turnstile to tell humans from bots on our sign-up and verification forms, which sets a short-lived security token. We do not use advertising or cross-site tracking cookies.

7. Who we share data with

We do not sell your personal data. We share it only with service providers who process it on our behalf, under contract and only as needed to run the platform:

• Stripe — payment processing and subscription billing.
• GatewayAPI and Telnyx — delivery of SMS verification codes.
• Cloudflare — content delivery, DNS, and bot protection for our forms.
• Google Maps — map display within the product.
• Postmark — delivery of transactional and service emails.

We may also disclose data where required by law, or to establish, exercise, or defend legal claims.

8. International transfers

Our platform and databases run on our own infrastructure. Some of our service providers are based outside the EEA, including in the United States. Where personal data is transferred outside the EEA, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or an adequacy decision, including the EU–US Data Privacy Framework.

9. How long we keep your data

We keep personal data only as long as we need it:

• Account data — for as long as your account is active, and for a limited period afterwards.
• Billing and transaction records — for up to five years, as required by Norwegian bookkeeping law.
• SMS verification and security logs — for a short period sufficient to detect and investigate fraud, after which they are deleted or anonymised.

10. How we protect your data

We use encryption in transit, hashed passwords, access controls, rate limiting, and bot and fraud protection to keep your data safe. No system is perfectly secure, but we work to protect your data and to respond quickly if something goes wrong.

11. Your rights

If you are in the EEA, you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased;
• restrict or object to how we process it;
• receive your data in a portable format;
• withdraw consent at any time, where processing is based on consent.

To exercise any of these rights, email [email protected]. You also have the right to lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet, datatilsynet.no) or your local supervisory authority.

12. Children

Chargalytics is a professional product intended for business and adult users. It is not directed to children, and we do not knowingly collect personal data from anyone under the age of 16.

13. Changes to this policy

We may update this policy from time to time. When we make material changes, we will update the effective date above and, where appropriate, notify you. The current version is always available on this page.

14. Contact us

For any question about this policy or your personal data, contact Incremental AS at [email protected].