Privacy Statement
Effective date: 31 October 2026
This statement explains which personal data Zengia uses, why, who else gets it and what your rights are. We have kept it as short and clear as we can. Questions? Email us at support@zengia.app.
The short version:
We never sell your data.
We only share it with service providers that help us run Zengia and act on our instructions, with Tesla and Enphase because you connect them, with Google if you accept advertising cookies, and where the law requires it.
You can delete your account at any time. We then delete your personal data within 24 hours, except data we must keep by law.
1. Which data we use and where it comes from
From you
Account: your email address and password. We store the password only in hashed form (via our database provider).
Settings: language, theme, country, time zone, your availability schedules, charge settings (such as minimum charge and charge limit) and notification preferences.
Your charging location: the address you enter (street, number, postcode, town, country) and the coordinates we look up for it.
Messages: what you send us through the contact form, feedback form or email, including your name and email address if you provide them.
From Tesla, after you connect your Tesla account
Access tokens that let Zengia act for you. We never see your Tesla password.
Car details: VIN, the name of your car, model details we derive from the VIN (such as estimated battery type and capacity).
Charging data: battery level, range, charge limit, charging status and charging current.
The car's location (latitude and longitude). We use it to check whether the car is at your charging location, so that we only control charging there. We keep only the latest position, not a location history.
From Enphase, after you connect your Enphase account
Access tokens and your Enphase system ID.
Solar production data, which we use to detect surplus solar power.
Created by Zengia
A log of the charge commands we send to your car (time, command, reason, battery level, solar power at that moment and Tesla's response).
Notifications we show you, and the push subscription of your browser if you turn on push notifications.
Technical and security data: IP address, browser type, time of requests and error messages. For abuse protection we keep IP addresses only as a one-way hash (a scrambled code), not in readable form.
From your browser when you visit zengia.app
See section 8 (cookies and similar technologies).
We do not use public or third-party sources to learn more about you, other than Tesla and Enphase as described above.
2. Why we use your data and on what legal basis
Purpose | Data | Legal basis (GDPR)
Creating and running your account | Account data, settings | Performing our contract with you (art. 6(1)(b))
Connecting Tesla and Enphase and starting, stopping and adjusting charging within your schedules | Tokens, car and charging data, solar data, schedules, charge settings | Performing our contract with you (art. 6(1)(b))
Checking whether your car is at your charging location | Car location, your charging address and its coordinates | Performing our contract with you (art. 6(1)(b))
Showing your car on a map in the app | Car location | Performing our contract with you (art. 6(1)(b))
Notifications (in the app, by push or by email) about charging | Charging data, push subscription, email address | Performing our contract with you (art. 6(1)(b)). Push notifications only after you allow them in your browser.
Service emails (confirming your email address, password reset, getting started, account deletion) | Email address | Performing our contract (art. 6(1)(b)); for the getting-started email: our legitimate interest in helping you use Zengia (art. 6(1)(f))
Answering your questions and feedback | Message, name, email address | Our legitimate interest in helping you and improving Zengia (art. 6(1)(f))
Security, preventing abuse, finding and fixing errors | Technical data, hashed IP addresses, error messages, command log | Our legitimate interest in a safe and working service (art. 6(1)(f))
Counting visits to our website (statistics without profiles) | See section 8 | Our legitimate interest in understanding how our website is used (art. 6(1)(f))
Measuring whether our Google ads lead to sign-ups, and showing our ads again to people who visited zengia.app | See section 8 | Your consent (art. 6(1)(a)); you can withdraw it at any time
Complying with the law and handling legal claims | What is needed in the specific case | Legal obligation (art. 6(1)(c)) or our legitimate interest (art. 6(1)(f))
Where we rely on legitimate interest, we have weighed our interest against your privacy. You can object to it at any time (see section 6).
Providing your email address and connecting a Tesla is necessary to use Zengia. Without them we cannot provide the service. Enphase is optional.
3. Who receives your data
We never sell your personal data, and we do not share it with data brokers or advertisers.
Service providers (processors). These companies process data for us, only on our instructions and only to run Zengia:
Provider | What they do for us | Where
Supabase Inc. | Database, login, server functions, storing your data | Data stored in London, United Kingdom; support access may come from other countries
Lovable Labs AB (with Cloudflare and Google Cloud) | Hosting the website and app, visit statistics | Sweden/EU; Cloudflare's network worldwide
n8n GmbH | Running automated tasks such as charge scheduling, token refresh and daily notifications | Frankfurt, Germany
Resend (Plus Five Five, Inc.) | Sending service emails | Sent from Ireland, stored in the United States
Pushover LLC | Error alerts to us; may contain technical details of an error | United States
Google LLC (Google Sheets) | Error log | EU/United States
Parties that decide for themselves how they use data (independent controllers):
Tesla. When you connect your Tesla, Zengia sends requests and commands to Tesla on your behalf. Tesla may use the information it receives from Zengia in line with Tesla's own privacy notice: https://www.tesla.com/legal/privacy.
Enphase Energy. When you connect Enphase, Zengia reads your solar data through Enphase. Enphase's own privacy policy applies: https://enphase.com/legal/privacy-policy.
Google, for the Google Ads cookies after your consent (see section 8). Google's privacy policy: https://policies.google.com/privacy. How Google uses data from sites that use its services: https://policies.google.com/technologies/partner-sites.
OpenStreetMap Foundation (United Kingdom). We look up the coordinates of the charging address you enter through its Nominatim service. When the app shows your car on a map, your browser loads the map from openstreetmap.org, which receives your IP address and the map area around the car. Privacy policy: https://osmfoundation.org/wiki/Privacy_Policy.
Your browser's push service (for example Google for Chrome, Mozilla for Firefox or Apple for Safari) delivers push notifications if you turn them on. The content is encrypted on the way.
Price data comes from ENTSO-E. We send no personal data to ENTSO-E.
Where the law requires it. We share data with authorities, such as the police or a court, only if we are legally obliged to.
If Zengia changes hands. If we transfer Zengia to another company, your data goes with it. We will tell you in advance, and you can delete your account before then.
4. Data outside the European Economic Area
Some providers are located, or store data, outside the EEA. We only allow this with the protections required by the GDPR:
United Kingdom (Supabase data storage, OpenStreetMap): the European Commission has decided that the UK offers adequate protection (adequacy decision, renewed in 2025).
United States:
Resend, Google and Cloudflare are certified under the EU-US Data Privacy Framework, which the European Commission recognises as adequate. Resend also signs the EU Standard Contractual Clauses.
Supabase, Pushover and other providers without that certification: Standard Contractual Clauses approved by the European Commission.
You can ask us for a copy of the safeguards that apply (email support@zengia.app).
5. How long we keep your data
Data | How long
Account, settings, charging address, car and solar data, tokens | As long as you have an account. When you disconnect Tesla or Enphase, we delete those tokens.
Car location and charging status | Only the latest reading; each new reading replaces the previous one
Charge command log | 90 days
Hashed IP addresses for abuse protection | Up to 2 days
Records of contact form emails sent | 90 days
Your messages to us | As long as needed to handle them, at most 1 year
Copies of emails at our email provider | 30 days
Technical logs at our database and automation providers | From about 1 day up to 30 days, depending on the provider
Cookie choice | Until you change it or clear your browser data
Google Ads cookie (_gcl_au) | Up to 90 days
When you delete your account, we delete your personal data and the tokens we hold within 24 hours, except data we must keep by law. Data at our providers that is only kept for a short time (such as logs and email copies) is removed at the end of the periods above.
6. Your rights
You have the right to:
access the personal data we hold about you and get a copy;
rectification of incorrect data. You can change most of it yourself in Zengia;
erasure of your data. The quickest way is to delete your account in Zengia;
restriction: ask us to temporarily stop using your data, for example while we check whether it is correct;
data portability: receive the data you gave us, and that we process under our contract or your consent, in a common machine-readable format, or have it sent to another provider;
object to processing based on our legitimate interest. We then stop unless we have compelling reasons. You can always object to direct marketing;
withdraw consent at any time, for example by changing your cookie choice through the link in the footer of our website or by turning off push notifications in your browser. This does not affect what we did before you withdrew.
Send your request to support@zengia.app. We respond within one month. In some cases we may ask you to confirm your identity first. Exercising your rights is free.
7. Complaints
Not happy with how we handle your data? Tell us first at support@zengia.app and we will try to solve it. You also have the right to complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, https://www.autoriteitpersoonsgegevens.nl) or to the data protection authority in the country where you live or work. You can find the list here: https://www.edpb.europa.eu/about-edpb/our-members_en.
8. Cookies and similar technologies
We use cookies and similar storage in your browser (such as local storage). Some are needed for Zengia to work; others only run if you agree.
Strictly necessary (no consent needed)
Login session and security, so you stay logged in and your account stays safe.
Your preferences: language, theme, time zone, your cookie choice and where you are in the getting-started steps.
__cf_bm (Cloudflare, 30 minutes): telling people and bots apart to protect the website.
__dpl (Lovable): making sure you get the correct version of the website.
Visit statistics (no consent needed, no profiles)
Our hosting provider Lovable counts visits for us: which pages are viewed, where visitors come from (the referring website), browser and device type, language, an approximate country (derived from your time zone) and page performance. For this it uses a random visit ID in a cookie (session-id) that expires after 30 minutes. The statistics do not follow you across visits and are not used for advertising.
Advertising measurement: Google Ads (only with your consent)
We advertise on Google. To see whether our ads lead to sign-ups, we use the Google Ads tag (Google Consent Mode v2).
Before you choose, or if you decline: the Google tag is loaded with all consent settings "denied". It sets no cookies and reads none, but your browser does send Google a basic signal without identifiers when a page loads, including your IP address and the page address.
If you accept: Google sets cookies (such as _gcl_au, up to 90 days, and a test cookie on doubleclick.net) and receives information about your visit and whether you signed up after clicking an ad. Google may also use this to show our ads again to people who visited zengia.app (remarketing) and to personalise ads. Google acts as an independent controller for this and may combine it with other data it has about you under its own privacy policy.
You can change your choice at any time through Cookie settings in the footer of our website. Declining has no effect on how Zengia works.
9. Security
We protect your data with appropriate technical and organisational measures, including:
encrypted connections (HTTPS) for the website, app and our connections to Tesla, Enphase and our providers;
access control on every database table, so each user can only reach their own data;
logging in with Tesla and Enphase through their official login (OAuth), so we never see your passwords;
storing IP addresses for abuse protection only as a hash;
only working with providers that commit to protecting data.
No system is perfectly secure. If a data breach is likely to put you at high risk, we will inform you without undue delay.
10. Children
Zengia is for people aged 18 and older (see our terms). It is not intended for children under 16, and we do not knowingly collect their data. If you believe a child has given us personal data, please contact us and we will delete it.
11. Data about other people
Zengia can reveal things about other people than you:
The car's location also says where the person driving it is. If others use the car, for example family members, let them know that Zengia reads the car's location to control charging at your charging location.
Solar and charging data can say something about when people are at home.
Only connect a car and solar system you are allowed to use (see our terms), and inform the people this affects, such as members of your household. They can contact us directly with questions about their data.
12. Changes
We may update this statement, for example because of new features, new providers or new laws. The date at the top shows when it was last changed. We will tell you about important changes by email or in the app before they take effect.
This statement is available in English, Dutch and German. If the versions differ, the Dutch version prevails.