Privacy Policy

Last updated: 23 September 2026
Privacy contact: hello@batterypassportsoftware.com

1. What this policy covers

This policy explains how we handle personal information in the Battery Passport Software iOS and Android applications, workshop web panel, website, public Repair Passport pages, invitation and transaction links, and support service (the “Service”). “We”, “us” and “our” mean the developer and operator of Battery Passport Software. A “workshop” is the business or organisation controlling a workspace; its “Owner” and “staff” are users with assigned access rights.

The Service records battery inspection, service, repair and handover information. Its technical focus reduces the need for customer information, but does not make all records anonymous. Staff accounts, device and network information, purchase references, sole-trader business details, and records that a workshop can connect to a person may be personal information.

This policy provides information about processing. Reading it, using the Service, accepting our Terms or receiving a workshop invitation is not blanket consent to every use of personal information. Where consent is required, it must be obtained separately for the relevant purpose.

2. Our role and the workshop’s role

We determine the purposes and means of processing needed for our own account administration, service security, subscription administration, support, legal compliance and business operations. We act as controller for those activities where that term applies.

A workshop decides which battery records to create, which staff may use them, what lawful service evidence to record and what information to publish. Where we process personal information in those records solely on its documented instructions, the workshop is the controller and we act as processor or service provider. The applicable data processing agreement (“DPA”) governs that relationship. This policy does not replace a DPA or establish one by itself. Roles depend on the actual activity and applicable law, not merely on contractual labels.

A workshop must provide appropriate notices to its staff and other affected people, have a lawful basis for its instructions, grant appropriate access, and comply with applicable retention and publication requirements. A staff member cannot provide another person’s consent merely by accepting our Terms. We remain responsible for our own legal obligations; the workshop’s responsibilities do not eliminate them.

For a request concerning workshop-controlled information, contact the workshop where possible. You may also contact us. We will route or assist with the request as appropriate and will not disclose another workshop’s information without verifying authority.

3. Information processed and where it comes from

We receive information from you, authorised workshop users, the device or browser you use, Apple or Google when verifying purchases or application integrity, and our hosting and security providers. A person using an accountless approval or transfer link may provide a decision without creating an account. We do not purchase customer profiles or enrich battery records with advertising data.

Passwords are handled by Firebase Authentication. Our workshop database does not store a readable copy of your password. Purchase proofs are sent for verification where needed; a hash alone does not mean that the original proof was never processed. Apple and Google process payment details under their own notices. We do not receive your full payment-card number or card security code through in-app purchasing.

4. Information that must not be put in technical records

The core battery workflow has no dedicated customer/owner contact profile. Do not place customer names, email addresses, telephone numbers, postal addresses, identity documents, receipts, correspondence, faces, vehicle registration plates or identifying location details in technical notes, external references or evidence. Do not submit sensitive personal information, such as medical information or biometric identifiers, for this purpose.

Some obvious contact patterns are rejected and technical images are processed to remove embedded metadata. These controls cannot recognise every person, address, document or identifying detail in free text or image pixels. Review and crop or redact evidence before attaching it. Removing image metadata does not remove personal information visible in the picture.

Where the ownership workflow records an inspection of a document outside the Service, it can retain an inspection confirmation and a locally calculated digest. It is not designed to upload or retain the source identity document or receipt, its thumbnail or its extracted text. A digest or pseudonymous reference can still be personal information and does not establish identity or legal title.

If prohibited information is submitted, we may restrict access, contact the responsible workshop and remove, redact or otherwise handle it where authorised or required. We do not promise to discover every violation. Do not send further copies to support unless a secure, necessary evidence request has been agreed.

5. On-device storage, offline work and exports

The mobile application stores working records, preferences, cached workspace information and pending changes in its application storage. Selected technical evidence and locally managed documents may be stored as application files. This supports offline work after activation. An offline change has not reached the server until synchronisation succeeds. Information labelled local-only must not be assumed to have a recoverable cloud copy.

The isolated Free Demo uses demonstration content and does not create a production workspace. Production access requires a staff account and an appropriate workspace entitlement or invitation; retained access to an existing workspace may continue after its paid entitlement ends.

Camera access follows a user action. Selected photographs and files are accessed through the available system camera or picker. The Service does not intentionally inventory your entire photo library, contacts or device files. Barcode recognition operates on device; using a recognised identifier in a connected workflow can subsequently transmit that identifier to our service. Following an external link can transmit information to the destination website.

Local data benefits from device access controls and applicable platform storage protections. It is not a promise that every database has separate application-level encryption. We configure exclusions for operational app data from supported automatic backup mechanisms, but cannot control every device manufacturer, operating-system version, user-created copy or restored device image.

Files you export, share, download, photograph or save outside the application become separate copies. Your selected destination may be another device, email service, file provider or cloud account. Deleting data from our service does not remotely erase those copies. Protect shared devices, sign out when finished and manage exported copies under the workshop’s own rules. An offline device cannot receive a revocation or deletion instruction until it reconnects.

6. Private cloud storage and public information

Connected workspace records use Google Cloud/Firebase database, storage and hosting services. Structured records, permissions and transaction states are stored separately from technical evidence files. Uploaded images undergo validation and re-encoding that removes embedded metadata; an upload copy may be held temporarily while processing, and only the accepted derived image is retained. Connected workspaces can also upload validated PDF, CSV, JSON, XML and plain-text technical documents that are bound to a specific battery passport and document version. Accepted files, integrity checksums, version and lifecycle metadata are retained as private evidence; rejected or quarantined upload copies are deleted through the applicable cleanup process. The connected service does not retain a raw-original image variant. Extracted, supported measurement fields can still synchronise as structured records even when their source file remains local.

Workspace access is checked against membership and capabilities. Authorised staff may see the information necessary for their role. Our authorised personnel and service providers may access relevant information when needed to operate, secure, troubleshoot or support the Service, fulfil a lawful request or act on authorised instructions. Access is not permitted merely for curiosity or unrelated use.

A public Repair Passport is a separate, limited representation of the workshop record. It is intended to exclude customer and staff identity, opaque external references, internal notes, private photographs, uploaded technical documents, file locations, confidential quote information and link credentials. Publication requires an authorised action and server confirmation. Technical identifiers may nevertheless be identifiable through information held elsewhere.

Anyone with access to a public passport can view and copy it, and a recipient can share the link. Withdrawing publication stops further access through our controlled publication route, subject to network/cache behaviour. It cannot retrieve screenshots, printed records, downloads or copies held independently by recipients or search services. We handle legally required removal assistance separately.

Private invitation, quote-decision and ownership-acceptance links have a specific purpose and expiry and may be revoked or limited to one use. Possession of a link can confer the ability to view or act within that scope. Share it only with the intended recipient. A quote or transfer decision is workflow evidence; it does not certify the recipient’s identity or legal ownership.

7. Website storage and platform security services

The website may remember your chosen language in browser local storage. The web panel uses persistent browser authentication storage to keep you signed in. Clearing site data or signing out affects that device/browser and does not by itself delete the account or workspace.

On the public marketing website, Google Analytics is off until you choose “Allow analytics”. If you agree, it receives page views with the page title and URL path, plus standard browser and session information. We omit URL query parameters and do not send account or battery record content. The choice is stored in your browser. You can change it through “Analytics settings” in the website footer. Choosing “No, thanks” leaves the Google tag unloaded. Withdrawing consent stops future collection from that browser but does not erase data already received.

Application-integrity and abuse checks use Firebase App Check and the relevant platform service: Apple App Attest/DeviceCheck on iOS, Google Play Integrity on Android and Google reCAPTCHA Enterprise on the web. These services process integrity material, tokens and device, browser or network signals needed for their security function. Web reCAPTCHA may set a security cookie when executed. These checks are distinct from advertising and remain subject to applicable rules for device storage and personal information.

The mobile applications and authenticated web panel use Google Analytics for Firebase for product measurement. The mobile applications also use Firebase Crashlytics for crash diagnostics; Firebase Crashlytics is not available in the web panel. One mobile “Send usage and crash reports” switch controls both products, while the corresponding web “Send usage statistics” switch controls Analytics. The setting is enabled by default and can be switched off at any time in mobile Settings → Privacy and data or the web panel’s Security area. The choice is stored on that installation or browser. Switching it off calls the applicable Firebase collection controls and denies analytics storage for future collection from that client; clearing app or browser storage can reset the locally stored choice. Where applicable law requires prior consent rather than an opt-out, we will apply the required regional consent treatment before relying on this default.

Analytics is configured for product measurement, not advertising. On iOS we use the Firebase Analytics Core dependency without IDFA collection capability and do not link AdSupport for Analytics. On Android the advertising-ID and attribution permissions are removed and advertising-ID collection is disabled. On mobile and web, advertising storage, advertising user data and advertising-personalisation signals are denied. We do not request App Tracking Transparency permission for Analytics, perform cross-app or cross-site advertising tracking, or intentionally send account email, authentication UID, names, photographs, battery identifiers, serial numbers, technical notes, search text, file contents, purchase credentials or other Customer Content as Analytics events, parameters or user properties. Apple’s vendor identifier, Firebase app-instance identifiers and a web Analytics client identifier may still be processed for first-party measurement where the platform supplies them and collection is enabled.

Firebase Analytics automatically records limited technical and engagement events and the web panel records only a privacy-safe section name for its custom navigation event. On mobile, Crashlytics receives uncaught Flutter and platform-native crash reports while the shared setting is enabled. We do not configure Crashlytics user IDs, custom keys or custom logs. An exception message or technical stack state can nevertheless contain information placed there by application or platform code, so Customer Content must not be included intentionally in error text. Firebase states that, after collection is switched off, a crash can remain locally on the device and be sent if the setting is later switched on. The application asks Crashlytics to delete unsent reports when collection is disabled and again before it is re-enabled, but that request does not retroactively erase reports already received. We use these data to understand feature adoption, reliability and interface improvements. Advertising SDKs are not included. We also use limited server operational information and diagnostics made available by the app stores to operate and investigate the Service. Hosting and platform security logs are separate and may still process network addresses and request metadata.

On Android, the Google ML Kit barcode SDK separately sends technical metrics to Google, including device/app information, an installation identifier and performance, configuration, feature-use and error information. Google states that its scanning input and output remain on device. This SDK processing can occur when scanning in Demo as well as in a production workspace, and is not controlled by a first-party analytics switch. See Google’s ML Kit data disclosure.

8. Purposes and legal grounds

Where a law requires a legal basis, we use the basis appropriate to the activity and relationship:

• Providing an individual’s contracted service: account access, requested functions and subscription administration, where necessary to perform that contract or requested pre-contract steps.
• Operating a business customer’s service: account and staff administration and communications can rely on legitimate interests in providing the workshop’s service when an individual staff member is not personally party to the contract. Workshop-controlled content is processed under the workshop’s instructions and applicable DPA.
• Security and integrity: proportionate prevention of unauthorised access, abuse, duplicate transactions and misuse; incident investigation and maintenance of reliable records rely on legitimate interests, and on legal obligations where applicable.
• Product improvement and reliability: limited, privacy-minimised usage measurement and mobile crash diagnostics can rely on legitimate interests where permitted, taking account of the default-on control, opt-out and exclusion of advertising identifiers and intentionally supplied Customer Content. Where consent is legally required for Analytics, Crashlytics or related device/browser storage, consent is the basis and collection must remain off until that consent is obtained.
• Support, disputes and legal administration: responding to requests, documenting decisions, resolving claims and preserving necessary evidence rely on contract, legitimate interests or an applicable legal obligation, according to the circumstances.
• Consent: used where a particular optional activity or applicable local law requires it. Consent can be withdrawn without making earlier lawful processing unlawful.

We assess necessity and competing rights when relying on legitimate interests. We do not treat a commercial interest as an unlimited entitlement to process information. We do not repurpose private workshop content for advertising, sale, unrelated profiling or training general-purpose AI models.

Account and security information necessary for connected access cannot be omitted while retaining that same functionality. Camera access and attachments are optional; manual entry and unattached records remain available where the workflow permits. A workshop may require particular evidence before allowing a service action.

9. Recipients and service providers

Information is disclosed only as appropriate to its purpose:

• to authorised workshop users and recipients of deliberately published records or scoped links;
• to Google Cloud/Firebase for hosting, database, object storage, authentication, application protection, Google Analytics for Firebase, Firebase Crashlytics and infrastructure operations;
• to Apple and Google for purchase processing/verification and platform integrity, and to Google for the Android scanner’s disclosed technical processing;
• to the email/support provider used to receive and answer your correspondence;
• to professional advisers and authorities where necessary for a lawful obligation, investigation or claim; and
• to a prospective or actual successor in a business transaction, with appropriate confidentiality and data-protection safeguards and any required notice.

Providers processing information on our behalf must have appropriate contractual restrictions. Apple/Google may separately act for their own platform, store or security purposes under their applicable notices. We do not describe all provider activities as processing solely on our behalf.

We do not sell personal information or share it for cross-context behavioural advertising. Publishing workshop-selected records and using service providers are different activities, described above. Disclosure in response to an authority is assessed for a lawful basis and scope; we do not grant indiscriminate access on request.

Provider information is available in Firebase privacy information, Google Cloud’s data processing terms, Google’s privacy policy and Apple’s privacy policy. The applicable DPA/subprocessor information identifies processors used for workshop content. Contact us for relevant details and safeguards.

10. Storage locations and international access

Our configured primary region for the connected database and backend processing is Belgium in the European Union. Technical-object storage is configured in the EU. These settings do not mean that every category of information remains exclusively in the EU.

Firebase Authentication, Google Analytics for Firebase, Firebase Crashlytics, platform security, the Android scanner’s technical metrics, app-store transactions, support correspondence and globally distributed website delivery may involve processing in the United States and other countries. Authorised support or administration from outside the EU may also constitute an international transfer. A local file or export is stored in the location of the device or destination you choose.

For transfers subject to specific legal restrictions, appropriate arrangements must cover the actual recipient and purpose. Depending on the transfer, these can include an applicable adequacy decision or contractual safeguards, including standard contractual clauses and necessary supplementary measures. We do not treat a provider’s certification as proof that every transfer is covered. You may request information or a copy of relevant safeguards, subject to lawful redactions protecting others and confidential commercial or security information.

11. Retention and deletion timing

We retain information for the period needed for its specified purpose, relevant service instructions and applicable legal requirements. Retention is category-specific. Subscription expiry alone does not delete the workspace: retained reading, export and permitted protective actions support the existing service relationship.

Scheduled expiry is not a guarantee of erasure at the exact second it occurs. Retries, provider processing and backup rotation can affect final erasure. Information retained for a particular legal obligation or claim is restricted to that purpose and deleted or de-identified when no longer necessary; this is not permission to retain all workshop content indefinitely “for legal reasons”.

Our recovery configuration provides up to seven days of database point-in-time history and daily database backups retained for 14 weeks. Storage recovery copies may persist after operational deletion for the configured soft-delete period, up to 30 days for private evidence and 14 days for the public-projection storage class. These are recovery windows after creation/deletion of the relevant copy, not a guarantee that every copy has been created or that a user can recover it. Backup expiry and permanent erasure follow the provider’s deletion process. Recovery must preserve valid deletion instructions and prevent deleted information from being returned to ordinary service use.

Firebase states that Authentication data is removed from its live and backup systems within 180 days after the customer initiates account deletion; its authentication IP logs last a few weeks, and Hosting IP information can last a few months. These provider periods are distinct from loss of account access and our application records. Scanner, integrity and store data are subject to the relevant provider’s processing and deletion terms; we do not promise that our account-deletion button erases all independently held Apple/Google records. Firebase retention information.

12. How account, workspace and subscription deletion differ

Staff account. Use the account-deletion control in the mobile connected-workspace settings or web panel security/account area. Sensitive actions require recent authentication. Account deletion removes your sign-in account and memberships. Shared workshop records can remain with pseudonymous actor references under the workshop’s lawful retention instructions. Those references are not necessarily anonymous.

Workspace. An authorised Owner can request deletion of the workspace. The request restricts operational access and revokes controlled public passports and private invitations/decision links. Permanent deletion starts after a seven-day cancellation period. Cancelling within that period does not automatically reactivate revoked links. The process removes operational workspace records and associated media, subject to the separate retention and backup handling above. The Owner’s account is retained so that other workspaces are not affected.

An Owner must transfer or delete owned workspaces before completing the normal self-service account deletion. This safeguard does not remove a person’s statutory right to make a privacy request or permit unreasonable delay; contact us if the self-service path cannot address your circumstances.

Subscription. Account or workspace deletion does not automatically cancel an Apple or Google subscription. Cancel renewal in the store account that made the purchase. Conversely, cancelling renewal does not request erasure. See account and workspace deletion guidance.

If controls are unavailable, email hello@batterypassportsoftware.com. Describe the request and, if known, the account or workshop concerned. Do not send passwords, verification codes, purchase tokens or identity documents. We will request only proportionate verification through an appropriate channel. A request affecting one person does not automatically authorise disclosure or deletion of all other users’ records.

13. Accuracy, append-only records and requests

The workflow preserves corrections and event history to support reliable technical records. This design is not an exemption from data-protection law. Depending on the record, a correction can be recorded through a linked amendment while direct identifiers are removed, restricted or otherwise addressed where required. We consider the nature of the information, affected rights, the workshop’s instructions and any specific legal retention duty.

We do not collect additional identity information simply to re-identify a technical record that cannot reasonably be linked to you. If you provide enough information to locate a relevant record, we assess the request; we do not treat every digest or random reference as irreversibly anonymous.

14. Your privacy rights

Depending on applicable law and our role, you may request access, correction, erasure, restriction, portability or information about recipients and safeguards. You may object to processing based on legitimate interests and withdraw consent where processing relies on it. You can also stop future Firebase product analytics and mobile crash reporting from the in-product collection control without losing core Service functionality. Where applicable, you may use an authorised agent and exercise rights without unlawful discrimination.

Contact hello@batterypassportsoftware.com. We may need limited verification to prevent disclosure to the wrong person. We will explain any lawful refusal or partial response and available complaint options. Where GDPR applies, we normally respond within one month; if a permitted extension is necessary because of complexity or request volume, we notify you within that first month. Other applicable deadlines and rights remain unaffected.

You may complain to the competent data-protection authority or seek a judicial remedy without first using our support procedure. For Montenegro, the authority is the Agency for Personal Data Protection and Free Access to Information. Where GDPR applies, you may also complain to a competent authority in the relevant EEA country, including where you live or work or where the alleged infringement occurred. UK users may contact the Information Commissioner’s Office.

15. Security and incident handling

Safeguards include encrypted network transport, platform storage protections, authenticated and capability-controlled access, scoped links, limited operational logging and separation of public projections from private evidence. They are designed to reduce unauthorised access and disclosure, not to guarantee that a device, network, provider or service can never be compromised.

The connected service is not end-to-end encrypted against its operator: authorised backend processing needs access to records. We do not claim an independent security certification for this application merely because a hosting provider has one. Security reports can be sent to our contact address without including live credentials or unnecessary personal content. We assess incidents and notify affected customers, individuals and authorities when required by applicable law and our obligations.

16. Automated processing and technical decisions

The Service can calculate technical values from supplied measurements, check consistency, reject invalid input, enforce access and subscription rules, and block actions according to recorded workflow conditions. Platform security services can assess integrity and abuse signals. These functions do not certify battery safety, a person’s identity or legal ownership. We do not use private service records for advertising profiles or intend to make solely automated decisions about individuals with legal or similarly significant effects. Contact us if an automated access restriction appears incorrect so that it can be investigated.

17. Children, external services and changes

The workshop service is designed for adults acting in a professional capacity and is not directed to children. Do not intentionally submit children’s personal information. Contact us if you believe it has been included so that we can assess and address it.

External websites, stores and destinations you select operate under their own privacy notices. That distinction does not remove our responsibility for disclosures we initiate or processors acting on our behalf.

We will publish an updated policy when relevant practices change and identify its effective date. We will give additional notice or obtain fresh consent where required. A policy update does not retroactively authorise an incompatible use of previously collected information. Translated interfaces do not necessarily mean that every legal document has been translated; required local-language notices and mandatory rights remain applicable.

18. Relationship to the Terms and contact

Our Terms of Use address contractual use, professional responsibilities and any lawful allocation of liability. This policy does not waive privacy rights, excuse our own unlawful conduct or limit a regulator’s powers. Applicable law prevails; a DPA governs processing on a workshop’s behalf where applicable.

Privacy, access, correction, deletion, security and support requests: hello@batterypassportsoftware.com. A descriptive subject helps routing but is not a condition for exercising your rights.