Privacy policy

DRAFT, not yet in force. Andronikos and a legal reviewer must approve this text before it is published. Every [[PLACEHOLDER: …]] must be filled in, and every [[REVIEW: …]] confirmed, first.

Last updated: [[PLACEHOLDER: date of publication]]

This policy explains what personal data Batterieslab collects when you use the Battery Monitor app, our websites under batterieslab.gr (the account, partner portal and battery passport pages), and our support. It says why we collect the data, who we share it with, where it is stored, how long we keep it, and how you can delete it.

1. Who we are

The controller of your personal data is:

• ELLINIKES BATARIES G.P. (ΕΛΛΗΝΙΚΕΣ ΜΠΑΤΑΡΙΕΣ Ο.Ε.), trading as Batterieslab
• Papanastasiou 31B, 57001 Thermi, Greece
• VAT number: EL803297204, General Commercial Registry (GEMI) number: 194045805000
• Email for privacy questions and requests: info@batterieslab.gr
• We have not appointed a data protection officer. Send any privacy question or request to the email above.

2. What this policy covers

• Battery Monitor, our app for iOS and Android, which connects to your battery over Bluetooth or, for batteries with an IoT tracker, over the mobile network.
• account.batterieslab.gr, where you can read this policy and our terms and delete your account.
• portal.batterieslab.gr, where our partners (distributors and installers) and their users manage the batteries they sold or installed.
• passport.batterieslab.gr, the public battery passport you reach by scanning the label on a battery. It shows the battery model, its technical and environmental data and its state of health. It shows no owner details.

Our own staff tools and the business records we keep about partners and business customers are covered in section 9.

3. What we collect and why

We don't use advertising or analytics tools in the app, and we don't sell your data.

4. Bluetooth and your phone's location

Battery Monitor uses Bluetooth to connect to your battery and read its measurements. It does this only while the app is open: it doesn't use Bluetooth in the background.

On Android, the system may ask you to allow location access before the app can scan for Bluetooth devices. The app asks for it only for that scan. The app doesn't read, store or send your phone's location. The only locations we hold are the positions that IoT batteries report themselves (section 3).

The app asks for the camera and photo library only when you attach a photo to a support case.

5. AI chat

The battery assistant in the app is answered by Claude (the Claude Haiku 5.5 model), provided by Anthropic PBC in the United States. When you send a message, our server forwards it to Anthropic with the earlier messages of the conversation and the battery summary described in section 3.

• We don't keep your conversations on our servers. The conversation is stored only on your phone, and is deleted when you sign out or delete your account. Our server logs record only technical details (status codes and the number of words, or tokens, processed), never what you wrote.
• Anthropic processes the messages to produce the answer. [[PLACEHOLDER: Anthropic's retention of API inputs and outputs, and confirmation that they are not used to train models, from the Anthropic commercial terms and data processing addendum in force]]
• Don't type personal information you don't want to share, such as other people's names or contact details, into the chat.
• Answers are generated automatically and can be wrong. See our terms of use.

5a. Remote support sessions

If your battery has a problem we can't solve from the data alone, BatteriesLab support may ask to connect to your battery through your phone. This happens only if you allow it in Battery Monitor. You can decline, and nothing is connected unless you tap Allow. Your consent covers one session only: each session needs a new request and a new Allow.

• What staff can do. While a session is connected, BatteriesLab staff have full access to your battery's management system (BMS), as if the battery were on their bench. They can read its live data and settings, change its settings, switch its output off and on, calibrate it and update its firmware. The battery may switch its output off while they work, so make sure nothing important is running from it. The prompt tells you this before you decide.
• Who. Only BatteriesLab administrators can start a session. The prompt shows the name of the administrator, your battery, the support case if there is one, and the reason. Sales staff, partners and installers cannot start or see a session.
• What we record. The session: who started it, which battery, the support case if there is one, the reason, when you allowed it, when it ended, how it ended (for example you stopped it, it expired or it was declined) and who ended it. And every message sent to and from your battery during the session: the battery's live readings and settings as its BMS reports them, and every command staff send. Passwords and other credentials that pass between the app and the battery (the battery's Bluetooth password and the Bluetooth module's commands) are removed on your phone before anything is uploaded, and are never stored. We record nothing else from your phone: not its location, and nothing from other apps.
• Who sees the record. BatteriesLab staff, and you: you can see the sessions on your battery and what was done in them. Partners and installers never see them.
• Where. The records are stored with the rest of your data (section 6, Supabase, European Union [[REVIEW: reviewer to confirm]]). During a session, the messages travel between our staff member's computer and your phone through Supabase's Realtime service. It carries the messages and stores none of them; only the record above is stored.
• Your controls. You can Stop the session at any time with the button shown on every screen of the app while it is connected. It works only while the app is open on your phone and near the battery: if the app leaves the screen, the session pauses, and it ends after 60 seconds away. It also ends when the connection to the battery or to us is lost for 60 seconds, or when no message has passed for 10 minutes. A request you don't answer expires after 5 minutes. An allowed session lasts 60 minutes; you can extend it by 30 minutes at a time from the banner, and never to more than 60 minutes from now. A session also ends at once if the battery changes owner or the administrator loses access.
• Legal basis. [[REVIEW: legal basis — consent per session (Art. 6(1)(a)) or contract/support (Art. 6(1)(b)); for the lawyer]] [[REVIEW: whether BatteriesLab's legitimate interest (Art. 6(1)(f)) also applies to keeping the record of changes made to a battery it supports, as the process document proposes]]
• How long. The session record is kept for as long as the battery exists, as the record of who changed its settings. The messages of a session in which staff changed something on the battery (settings, output, calibration, firmware, the Bluetooth module, or anything that is not only a read) are kept for as long as the battery. The messages of a session with only reads are deleted 90 days after the session ends. See section 8. [[REVIEW: reviewer to confirm the periods]]

6. Who receives your data

We share personal data only as this policy describes:

• The partner who sold or installed your battery. If your battery belongs to a partner account (a distributor or installer), that partner's users can see the battery, its readings and location, and the support cases about it, so that they can support you.
• Our staff, who need the data to support you and run the service.
• Service providers who process data for us under contract (processors):

• Apple and Google also receive data as independent controllers when you sign in with them, download the app, buy a subscription in their stores, or when the app's security check runs (Apple App Attest and DeviceCheck, Google Play Integrity). Their own privacy policies apply.
• Authorities, when the law requires it.

7. Transfers outside the EU

Some of this processing happens outside the European Union: AI chat in the United States (Anthropic), and parts of hosting (Vercel's global network and its US parent company), crash reports, notifications, subscriptions and app updates in the United States (see the table above). Your account, battery and case data are stored in the European Union (Frankfurt, Germany). [[REVIEW: reviewer to confirm]]

We protect these transfers with the European Commission's Standard Contractual Clauses, or, for providers certified under it, the EU-US Data Privacy Framework adequacy decision. [[PLACEHOLDER: confirm the safeguard for each provider in section 6]] You can ask us for a copy of the safeguards at the email in section 1.

8. How long we keep data

9. Partners, business customers and our staff tools

If you work for one of our partners or business customers, or you contact us for a quote, we keep your name, work email, phone, company, role, and our correspondence, offers, orders and invoices in our internal business system, to run our business relationship (legal basis: contract, and our legitimate interest in managing our customers and suppliers; invoices: legal obligation). Our staff sign in with Microsoft accounts. Our staff use AI models from OpenAI and Google (Gemini), and may also use Anthropic's Claude, all in the United States, to help draft emails and summaries from these records (see the table in section 6). We may look up companies in the Greek General Commercial Registry (GEMI). We keep these records for as long as the business relationship lasts and 5 years after it ends; invoices and tax records for as long as Greek tax law requires (at least 5 years after the end of the tax year). [[REVIEW: reviewer to confirm]]

10. Deleting your account

You can delete your account at any time, in two ways:

• In the app: Settings → Delete account.
• On the web: at account.batterieslab.gr, enter your email address, type the code we email you, and confirm.

When you delete your account:

• Your sign-in, profile, push tokens, AI usage, subscription record, notifications and partner memberships are deleted.
• The batteries you own stay, because they are physical products with a service history, but they are no longer linked to you: the names you gave them and every stored location are deleted.
• Photos and files you uploaded to support cases are deleted. Your messages stay in the case, with your name removed, so the battery's support history stays complete.
• Records of remote support sessions on your batteries stay with the battery, without your name (section 5a).
• Pending partner invitations to your email address are deleted.

Deletion doesn't cancel a subscription bought in the App Store or Google Play: cancel it in your store account first. If you are the only administrator of a partner account that has other users, make another user administrator first. Staff accounts are closed by Batterieslab.

11. Your rights

Under the GDPR you have the right to access your data, correct it, delete it, restrict or object to its processing, and receive it in a portable format. Where processing is based on consent, you can withdraw consent at any time. To exercise these rights, email us at the address in section 1. We answer within one month.

You can also complain to the Hellenic Data Protection Authority (www.dpa.gr), or to the authority where you live or work.

12. Children

Our services are not meant for children under 15, the age of digital consent in Greece. We don't knowingly collect their data.

13. Security

Data travels encrypted between the app, the websites and our servers. Database rules let each person see only the data they are allowed to see. Your sign-in session is stored encrypted on your phone.

14. Changes

When we change this policy, we update the date at the top. We tell you in the app or by email about important changes before they apply.