MW-Charge Privacy Policy

1. Data Controller

The controller of personal data processed in connection with the MW-Charge app is MW-Labs, registered at 03-289 Warsaw, Ostrodzka 133/13, contact: mw@mw-labs.org ("Controller", "we", "us").

2. Scope of This Policy

This Privacy Policy explains how MW-Charge collects, uses, stores, and protects user data. The app is designed to configure, monitor, and remotely control an EV charger using local network connectivity and MQTT communication.

3. What Data We Process

• User account data, especially email address and information necessary for sign-in and authentication through Firebase Authentication.
• Optional username or display name if you choose to set it for your account.
• Configuration data for paired chargers, including device name, host or IP address, port, MQTT device ID, schedules, current limits, time zone, and other settings required for the app to function.
• Technical connection data related to the charger and MQTT broker where needed to provide app features.
• Local preferences stored on the device, such as the Remember me setting.
• The current Wi-Fi network name (SSID) and related network information during charger setup on the local network.
• Data received from the charger, such as charger status, diagnostics, and operating settings.

4. Data We Do Not Use for Marketing

• We do not sell personal data.
• We do not share personal data for advertising purposes.
• We do not use third-party analytics or advertising SDKs for user profiling.
• We do not track users across apps or websites.

5. Purposes and Legal Bases

We process data for the following purposes:

• Creating and operating user accounts.
• Sign-in, authentication, and session management.
• Storing charger configuration in the cloud and syncing it across devices.
• Local discovery, setup, and control of the charger over the local network.
• Remote communication with the charger through MQTT.
• Displaying device status, diagnostics, and executing user commands.
• Handling password reset, email verification, and account deletion.
• Maintaining security, integrity, and proper operation of the app.

Where the GDPR applies, legal bases may include:

• Article 6(1)(b) GDPR, performance of a contract or taking steps at the user's request before entering into a contract.
• Article 6(1)(f) GDPR, our legitimate interest in operating, securing, and improving the service.
• Article 6(1)(a) GDPR, consent, where processing depends on a specific system permission or consent-based action.

6. Device Permissions and Access

The app may use the following permissions or system capabilities:

• Internet access and network state access to connect to backend services, the MQTT broker, and the charger.
• Local network access to discover and configure the charger within the same network.
• On iOS, location access while using the app, only to read the current Wi-Fi network name during charger setup.

We do not use location data for tracking or marketing. The app does not declare background location use.

7. Where Data Is Stored

• Locally on the user's device, for example app preferences.
• In Google Firebase services, especially Firebase Authentication and Cloud Firestore.
• In communication infrastructure required for MQTT-based features.
• On the charger itself or in its local interface, to the extent necessary for configuration and control.

8. Data Recipients

Data may be shared with service providers only to the extent necessary to operate the app, including:

• Google Firebase.
• Hosting or network infrastructure providers used for MQTT communication.
• Technical infrastructure providers supporting the Controller's services.

We do not sell personal data to third parties.

9. Retention Period

We keep data for as long as necessary for the purposes described in this Privacy Policy, in particular:

• Account and charger configuration data until the user deletes the account or the data is otherwise removed.
• Locally stored data until it is deleted by the user, upon sign-out, app removal, or device-level app data clearing.
• Data that must be retained longer when required by law or reasonably necessary for security and fraud-prevention purposes.

10. Your Rights

To the extent provided by applicable law, you may have the right to:

• Access your data.
• Correct your data.
• Delete your data.
• Restrict processing.
• Receive your data in a portable format.
• Object to processing.
• Withdraw consent where consent is the legal basis.

You may also delete your account using the functionality available in the app.

If you are located in the EU or EEA, you also have the right to lodge a complaint with the competent data protection authority.

11. Security

We apply reasonable technical and organizational measures intended to protect data against loss, unauthorized access, disclosure, or modification. However, no Internet transmission or storage method is completely secure.

12. Children

The app is not intended for children under the age of 16 unless a different age threshold applies under local law. We do not knowingly collect children's data without a valid legal basis or any consent required by law.

13. International Transfers

Because we use third-party infrastructure providers, data may be processed outside Poland or outside the European Economic Area. Where applicable, the Controller implements appropriate legal safeguards required by law.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. The current version will be published with a new effective date.

15. Contact

For privacy-related questions, please contact us at mw@mw-labs.org.