Privacy policy
Who is responsible
ChargeViz is published by ChargeViz SAS, a société par actions simplifiée (SAS) with a share capital of 100 €, registered under 990 118 333 R.C.S. Versailles (SIREN 990 118 333), whose registered office is at 9 rue des Bouderies, 78840 Freneuse, France. We are the data controller for the personal data described here.
For anything in this document, including to exercise any of the rights listed below, write to srilhac@chargeviz.com.
Who this covers
This policy covers the people who hold a ChargeViz account — normally employees of a customer organisation that has a written agreement with us.
It is worth being explicit about what ChargeViz is not: the market data in the product describes charging infrastructure operated by companies — sites, charge points, prices, availability and usage rates. It contains no personal data about drivers. We hold no charging sessions attributable to an individual, no payment data and no vehicle data.
What we collect, and why
| Data | Why | Legal basis |
|---|---|---|
| Your e-mail address, your role, and which organisation you belong to | To give you an account and show you the data your organisation is entitled to | Performance of our agreement with your organisation, and our legitimate interest in running the service |
| Your first and last name, if you or your administrator enter them. They are optional | To show your colleagues and administrators whose account it is, and to address you in the invitation e-mail | Legitimate interest |
| Your password, stored only as a salted one-way hash | To authenticate you. We never hold your password itself and cannot recover it | Performance of the agreement |
| Your two-factor authentication secret and recovery codes | Two-factor authentication is mandatory on every account | Our legitimate interest in protecting accounts and the data behind them |
| The date your account was created and the time you last signed in | Account administration and security review | Legitimate interest |
| Your session, and short-lived counters that limit repeated sign-in attempts | To keep you signed in, and to slow down password guessing | Performance of the agreement; legitimate interest in security |
| A security audit trail: sign-ins, sign-outs, failed sign-in attempts and changes made to accounts and settings, each recorded with the account's e-mail address, the IP address and the browser user-agent | To investigate security incidents, and to show your organisation's administrators who changed what | Our legitimate interest in protecting accounts and the data behind them |
| Server logs: IP address, browser user-agent, the address requested, the time and how long it took | To keep the service running, investigate faults and detect abuse | Legitimate interest |
| A usage record: which page or panel of the product your account opened, and when. It holds nothing else — no IP address, no browser user-agent, and none of the filters, dates, places or search terms you used | To see which parts of the product are actually used, so that we improve the ones that are and stop maintaining the ones that are not | Legitimate interest |
That is the complete list. We do not ask for your telephone number or your postal address, and there is nowhere in the product to give them to us.
Cookies, analytics and tracking
ChargeViz sets two cookies and no others. One keeps you signed in; one protects forms against cross-site request forgery. Both are strictly necessary to deliver a service you have asked for, so neither requires your consent — which is why you are not being shown a cookie banner.
We run no advertising tags and no third-party trackers. Beyond those two cookies, the only thing the application keeps in your browser is a short list of your own recent map searches (your last picks in the search box), held in your browser's local storage, keyed to your account and never sent to us or to anyone else; clearing your browser data removes it. Everything the page loads — fonts, scripts, map styling and the background map itself — is served from our own infrastructure rather than from a content delivery network, so loading ChargeViz does not disclose your visit to anyone else. There is no exception: your browser contacts no server we do not operate.
We do measure how the product is used, and this is what that means. When you are signed in, we record which page or panel of the product you opened and when, together with your account and your organisation. That is the whole record: it holds no IP address, no browser user-agent, and none of the filters, dates, places or search terms you used — so it can tell us that the price chart was opened, and never what you looked at in it. It is kept for 13 months and then deleted, and it is deleted with your account if your account is deleted.
We use it to decide what to build and what to stop maintaining. It is not used to assess you, it is not shown to your colleagues or to your organisation's administrators, and it is never sold, shared or combined with anything from outside ChargeViz. It is first-party measurement: it happens on our own servers, it sets no cookie and stores nothing extra in your browser, and it cannot follow you to any other website. That is why it needs no consent banner — but if we ever change how this works in a way the law says you must agree to first, we will ask you rather than assume.
Who else processes your data
We use a single infrastructure provider, OVHcloud, a French company, for hosting, data storage and account e-mail.
Your personal data is stored and processed exclusively within the European Union and is not transferred outside the EEA. We do not sell it, rent it, or share it with anyone for their own purposes. We may disclose it if the law requires us to.
How long we keep it
- Your account — for as long as your organisation's agreement with us is in force, and then deleted. Entries that mention it in the security audit trail are kept until they reach their own limit, below.
- The security audit trail — each entry is deleted 12 months after it was recorded.
- The usage record — each entry is deleted 13 months after it was recorded. Unlike the security audit trail, it does not outlive your account: deleting your account deletes your usage record with it.
- Your session — a signed-in session expires after 12 hours without activity, and expired sessions are deleted automatically every day.
- Server logs — including the access log your IP address appears in — rotated automatically and deleted after 14 days.
Server logs exist to run and protect the service. We do not use them to build a profile of you, and nothing in them is joined to your account — the usage record described above is a separate, deliberately narrower thing, and it is the only place where what you opened is linked to who you are.
How it is protected
Access to the application is over HTTPS only. Two-factor authentication is mandatory for every account. Each organisation's data is isolated in the database itself, so a query cannot return another customer's rows. Repeated failed sign-in attempts are rate-limited.
Your rights
Under the GDPR you may ask us to give you a copy of your personal data, correct it, delete it, restrict or object to how we use it, or provide it in a portable form. Write to srilhac@chargeviz.com and we will answer within one month.
We take no automated decisions about you and carry out no profiling. If you are not satisfied with how we have handled your data you may complain to the CNIL (Commission nationale de l'informatique et des libertés).
Changes
If this policy changes materially we will update the date at the top and tell account holders by e-mail.