Privacy notice

Kairyo Services s.r.o., Za Arielem 1548/6, Michle, 140 00 Praha 4, Czech Republic, company number (IČO) 08898359 (“we”) is the controller for this website and for Viametry accounts. Write to privacy@viametry.com about anything in this notice. In company accounts, the company decides how its drivers' data is used: it is the controller for that data, and we process it on its behalf (see “Company cars and drivers”).

viametry.com sets no cookies, has no analytics, no advertising and no forms, and loads nothing from other sites. Like any web server, ours records the IP address, time, page and browser of each request in its logs. We use them only to keep the site secure and working (our legitimate interest, Art. 6(1)(f) GDPR) and delete them after 14 days.

Your name, email address, password (stored only as a secure hash), language and settings, records of your sign-ins (time, IP address, browser) and of important actions in your account. We need them to provide the account you signed up for (contract, Art. 6(1)(b) GDPR) and to protect it against misuse (legitimate interest, Art. 6(1)(f)).

When you connect a Tesla, you choose in Tesla's own consent screen which data Viametry may read. Tesla also processes data about your car and its use under its own Customer Privacy Notice (tesla.com/legal/privacy); for that processing Tesla is a separate controller, and Viametry has no control over it. You confirm that you have read it before you connect. We store the connection's access tokens encrypted, the car's identity (VIN, model, configuration) and the data it sends: location and route, speed, battery and charging, odometer, temperatures, tyre pressures, lock state and software version; and, for a car you switch it on for in Settings (cars from 2023 on, with recent software), how far the car drove with Tesla's assisted driving (FSD Supervised). In a business account, whoever may see a driver's speed also sees this share; nobody else does. From these we derive trips, charging sessions, costs, places, reminders and reports. This is the service you ask us for (contract, Art. 6(1)(b)). You can disconnect your Tesla account at any time in Settings: recording stops at once, and the stored connection is deleted after 30 days. What was already recorded stays in your account until you delete it.

In a business account, the company decides which cars are recorded and who sees what. Drivers can switch on private mode, working hours limit recording, managers do not see private trips or a driver's home, and drivers can see what is recorded about them. For this data the company is the controller and we are its processor under a data processing agreement, so drivers should contact their employer first. Route traces of cars driven by employees are deleted after 90 days, or sooner where the company or the country's rules say so; the logbook entries themselves are kept for the tax period. Where the law needs each employee's agreement (Austria without a works council), a driver's locations are recorded only after they agree in the app, and they can withdraw at any time. The data processing agreement is published at app.viametry.com/legal/dpa.

Payments are handled by Paddle (Paddle.com Market Limited, United Kingdom), our reseller and Merchant of Record. Before the checkout we ask for the billing details Paddle prints on your invoice: your country and, as you choose, your name, company, company and VAT numbers and address (a business account always gives its company name). We keep them with your account, where you can change them, and pass them to Paddle for the invoice (contract, Art. 6(1)(b)). Paddle collects your payment details and issues the invoice as an independent controller under its own privacy notice (paddle.com/legal/privacy). From Paddle we receive what we need to manage your subscription: your customer number, plan, number of cars, country, payment status and amounts. We never see your card details.

We send the emails your account needs (confirming your address, password resets, subscription confirmations) and the alerts and summaries you switch on; optional emails have an unsubscribe link. Emails are sent through Brevo (Sendinblue SAS, France). If you allow push notifications, your browser's push service (from Apple, Google, Mozilla or Microsoft) delivers them; their content is encrypted so that only your device can read it.

When you write to us or send feedback from the app, we use your message, the page it came from, technical details (app version, browser, window size, language) and any screenshots you attach, to answer you and fix problems (legitimate interest). Screenshots are deleted when the report is closed, and after 90 days at the latest. Our mailbox is hosted by WEDOS Internet, a.s. (Czechia).

The demo needs no sign-up and no car data. It gives your browser its own copy of a sample account for 24 hours, kept with a sign-in cookie, then the copy is deleted. To keep the demo available for everyone, we limit how many copies can be opened from one network, using its IP address (legitimate interest).

If you connect your own AI assistant to Viametry (for example Claude, ChatGPT or Grok), Viametry sends it data about the cars you choose, and only when it asks while you are using it: dates and times, place names, distances, energy, costs, trip purposes and notes, monthly summaries and the names of the people who drive those cars. It never receives the VIN, exact coordinates or raw car data, and never more than you see in Viametry. If you allow it, the assistant can also do what you would otherwise do by hand: mark trips and drives business or private, fill in purposes, notes, drivers and cost centres, add charging costs and prices, name places, and add expenses and service records. It can never sign off a logbook, lock trips, approve or pay out expenses, delete anything or change settings. We do this with your consent, which you give separately for each connection (Art. 6(1)(a) GDPR); you can withdraw it at any time under Settings → Your data → AI assistants, and every request is recorded in your account history. The assistant's provider (for example Anthropic, OpenAI or xAI) processes the data as a separate controller under its own terms, and may do so outside the EU, including in the United States; it goes there because you ask for it (Art. 49(1)(a) GDPR). If you do not want it used to train AI models, switch that off in the assistant's settings. In a business account, the company decides whether members may connect an assistant to its cars; an assistant used to check or fill in the logbook sees only what the person who connected it may see, never a driver's private trips or home.

We share personal data only where it is needed for the purposes above:

• Hetzner Online GmbH (Germany): our servers and encrypted backups, in the EU.
• Brevo (Sendinblue SAS, France): sending emails.
• WEDOS Internet, a.s. (Czechia): our email mailbox.
• Paddle.com Market Limited (United Kingdom): payments, as Merchant of Record and an independent controller.
• Tesla: the source of your car's data. Viametry sends Tesla only the requests needed to read it on your behalf; Tesla processes your data under its own privacy notice.
• The push service of your browser (Apple, Google, Mozilla or Microsoft), if you allow notifications.
• The AI assistant you connect yourself, if you do: its provider, as a separate controller (see “AI assistants”).
• Our professional advisers, such as accountants and lawyers, and public authorities where the law requires it.

We do not sell personal data or use it for advertising, and we send it to an AI service only when you connect your own assistant (see “AI assistants”). Places are named from a list on our own servers; no location is sent to a map or address service.

Your account and car data are stored in the EU. Paddle is in the United Kingdom, which the EU recognises as providing adequate data protection. The push services of Apple, Google and Microsoft may process data in the United States, under the EU–US Data Privacy Framework or standard contractual clauses; the content of notifications stays encrypted. An AI assistant you connect may process the data it receives in the United States (see “AI assistants”).

• Account and car data: while your account is active.
• After a subscription ends: until the end of the following calendar year, so you can still download your records; then deleted.
• When you delete your account: you have 14 days to change your mind (or you delete it at once if you choose), then the account and its data are deleted. Backups expire within a further 40 days.
• Detailed route traces: up to 2 years, or less if you set a shorter period for a car; after that only the start, the end and the summary of each drive are kept.
• The raw data your car streams to us: about a day, until it has been processed (and filtered for private trips).
• Sign-in, security and error records: up to 180 days. The record of important account actions (such as sign-ins, sharing and deletions): 2 years.
• Sign-ups that are never confirmed: 7 days.
• Website server logs: 14 days.
• Records the law requires us to keep, for example for accounting: for the period the law sets.

You can ask us for a copy of your data, to correct or delete it, to restrict or object to its use, and to receive it in a machine-readable format; where we rely on your consent, you can withdraw it at any time. Much of this you can do yourself: Settings has a data export, Tesla disconnection and account deletion. For anything else write to privacy@viametry.com; we answer within one month. You can also complain to the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů, uoou.gov.cz) or to the data protection authority in your country.

Connections are encrypted (HTTPS), Tesla access tokens are stored encrypted, passwords only as hashes, backups are encrypted, and inside an account each person sees only what their role allows.

This website sets no cookies. The app uses only cookies it needs to work: the one that keeps you signed in, and small ones that remember your language, the cars you selected and which tips you have already seen (and, for administrators, a role preview). None of them track you or come from anyone else, so none need consent.

We update this notice when what we do with personal data changes; the date at the top shows the current version. We tell account holders about important changes by email.