For public and shared EV charging · Last updated: 25 August 2026 · Version 1.0
This notice explains what personal information we collect when you find, start, pay for and use EV charging through GravOS — via our app, web portal, an RFID card, Plug & Charge, or a roaming partner — and what we do with it.
Graviti AI operates GravOS in two different ways, and which one applies determines who is legally responsible for your personal information:
If you are unsure which applies to you, contact privacy@gravitienergy.ai and we will tell you and, where relevant, put you in touch with the responsible organisation.
Controller: Graviti AI. Data protection contact: privacy@gravitienergy.ai. Postal correspondence address available on request.
| Category | Examples | Source |
|---|---|---|
| Account & identity | Name, email address, mobile number, password (stored hashed), language and country | You |
| Payment | Card type, last four digits, expiry, billing postcode, payment token, transaction history. We do not store full card numbers — these are held by our PCI-DSS compliant payment processor. | You / payment processor |
| Authentication media | RFID/NFC card or fob identifier, app token, ISO 15118 Plug & Charge contract certificate identifiers | You / your vehicle |
| Vehicle information | Make, model, connector type, battery capacity, and — only if you choose to connect it — telematics data such as state of charge | You / your telematics provider |
| Charging session data | Charge point and site identifier and location, connector used, start and stop time, energy delivered (kWh), power profile, duration, idle time, price applied, amount charged, fault and error codes | Charging hardware |
| Location | Approximate or precise device location, only if you grant permission, to show nearby chargers and directions. You can withdraw permission at any time in your device settings. | Your device |
| Technical & device | IP address, device type and operating system, app version, diagnostic and crash logs | Automatically |
| Support & communications | Messages, call notes, photographs you send us about a fault, satisfaction feedback | You |
| Preferences | Marketing consent, notification settings, saved or favourite locations | You |
Sensitive information. We do not intentionally collect special category or sensitive personal information. Please do not send us health, biometric or similar information through support channels.
| Purpose | Legal basis (UK/EU GDPR) |
|---|---|
| Create and manage your account; authenticate you at a charge point | Performance of a contract |
| Deliver, monitor and safely stop a charging session | Performance of a contract |
| Take payment, issue receipts and invoices, process refunds | Performance of a contract; legal obligation (tax and accounting) |
| Enable roaming so you can charge on partner networks | Performance of a contract |
| Provide customer support and handle complaints | Performance of a contract; legitimate interests |
| Detect, investigate and prevent fraud, abuse and tampering | Legitimate interests; legal obligation |
| Maintain, troubleshoot and improve network reliability and charger uptime | Legitimate interests |
| Aggregated, de-identified reporting and analytics on network usage | Legitimate interests |
| Send service messages (session started, session complete, fault, receipt) | Performance of a contract |
| Send marketing about GravOS services | Consent — you may withdraw at any time |
| Show nearby chargers using your device location | Consent — device permission |
| Comply with law, respond to lawful requests, establish or defend legal claims | Legal obligation; legitimate interests |
Where we rely on legitimate interests we have assessed the impact on you and concluded our interests do not override your rights and freedoms. You may request a summary of that assessment.
EV charging depends on interoperability between networks. If you start a session on a network we do not operate — or a driver from another provider charges on a network we operate — limited information must be exchanged so the session can be authorised, delivered and billed. This typically includes your authentication identifier, the session record (site, time, energy, duration) and the amount payable. It is shared through roaming protocols and hubs, principally OCPI, with the charge point operator, the e-mobility service provider and, where one is used, the roaming hub.
When you charge on a partner network, that operator's own privacy notice and site rules also apply to your visit.
A current list of the service providers who process personal information on our behalf is available on request from privacy@gravitienergy.ai.
We do not sell your personal information, and we do not share it for cross-context behavioural advertising, as those terms are defined under US state privacy laws.
We keep operational records for 24 months by default. Historical records that support long-term analysis, dispute resolution and reporting are kept for three to five years, with the exact period agreed according to the needs of the network operator or site host. Financial records are kept for longer because tax law requires it.
| Record | Retention |
|---|---|
| Account profile | While your account is active, then 24 months after closure |
| Charging session records (operational) | 24 months |
| Historical session and network performance data | 3–5 years, depending on operator requirements |
| Invoices, receipts and payment records | 7 years, as required by tax and accounting law |
| Support correspondence | 24 months after the case closes |
| Marketing preferences | Until you withdraw consent, plus a suppression record so we do not contact you again |
| Fraud and security investigation records | As long as necessary for the investigation and any resulting claim |
Where we need data for analysis beyond these periods, we aggregate or de-identify it so that it no longer identifies you.
You have the right to access your information, correct it, delete it, restrict or object to processing, obtain a portable copy, and withdraw consent at any time without affecting processing already carried out. You may lodge a complaint with your supervisory authority — in the UK, the Information Commissioner's Office (ICO); elsewhere, your national data protection authority.
Depending on your state, you have the right to know what personal information we collect and disclose, to access and delete it, to correct it, to opt out of sale or sharing and of targeted advertising, to limit the use of sensitive personal information, and not to be discriminated against for exercising these rights. As stated above, we do not sell or share your information for those purposes. We honour Global Privacy Control signals where required. You may use an authorised agent, with proof of authorisation.
Email privacy@gravitienergy.ai or use the privacy controls in your account. We will verify your identity before acting and respond within the period required by applicable law — generally one month in the UK and EU, and 45 days in the United States, extendable where permitted. There is no charge unless a request is manifestly unfounded or excessive.
GravOS uses automated systems to manage charging — for example to share available power between chargers, protect a site's electrical limits, or sequence a fleet's charging. These decisions concern the operation of equipment rather than an evaluation of you personally, and do not produce legal or similarly significant effects on you. We do not carry out automated decision-making of the kind described in Article 22 of the UK/EU GDPR. If that changes, we will update this notice and tell you before it takes effect.
We protect your information using encryption in transit and at rest, role-based access control, network segmentation, logging and audit trails, and regular review of our security practices. Payment card data is handled by PCI-DSS compliant processors. No system is perfectly secure; if a breach affects your personal information we will notify you and the relevant regulator where the law requires it.
Our charging services are intended for adults who can enter into a contract. We do not knowingly collect information from children under 16 in the UK and EEA, or under 13 in the United States. If you believe a child has provided us with information, contact us and we will delete it.
We may update this notice. If a change materially affects you we will notify you in the app, by email, or both, before it takes effect. The version number and date at the top always reflect the current version, and previous versions are available on request.
Privacy questions and rights requests: privacy@gravitienergy.ai
Charging support: support@gravitienergy.ai
General enquiries: info@gravitienergy.ai
Postal correspondence address available on request.