Privacy policy

The controller for your personal data is Appsurge (CommV), Sergeant De Bruynestraat 38, 2140 Antwerpen, België, company number 1040.873.940.

Questions about privacy, or want to use one of your rights? Email info@appsurge.app.

You don’t need an account to search, compare prices or plan a trip. We don’t keep a profile of visitors. To deliver the website, our hosting provider handles technical request data such as your IP address and browser type (see “Who processes data for us”).

Some map features load data straight from other services. Those services see your IP address — see “Services your browser contacts directly”.

When you create an account we store:

• your name and email address;
• your password — only as a secure hash, never readable by us;
• if you sign in with Google: the name, email address and profile picture Google shares with us, plus the technical identifiers and tokens needed for sign-in. Google learns that you signed in to EVMaply;
• whether your email address has been confirmed, and when the account was created.

A session cookie keeps you signed in for up to 30 days. We send you an email to confirm your address and, if you ask for it, a link to reset your password.

To protect sign-in, we store the IP address and browser type with your session. We also keep temporary request counters containing your IP address and the authentication endpoint to limit repeated attempts. This security processing is based on our legitimate interest in preventing account abuse (Article 6(1)(f) GDPR).

Why and on what basis: to provide the account you asked for (performance of a contract, Article 6(1)(b) GDPR).

With an account you can save things so you have them on every device:

• cars in your garage — the model and the settings you chose;
• favourite chargers and saved trips;
• your own charging cards — the name and the prices you enter yourself, so we can calculate what a session costs with your card;
• email alerts for favourite chargers (when a charger is free again or gets cheaper), including the language of the emails.

Only you can see this information. Alerts are only sent to a confirmed email address, and every alert email has a one-click link to stop it.

Why and on what basis: to provide these features (performance of a contract, Article 6(1)(b) GDPR).

If you report a wrong price or another problem, we store the charger, the type of problem, your note (if you write one), your user ID if you are signed in, and a salted hash of your IP address. We use that hash only to stop abuse, such as hundreds of reports from one source; we don’t store the IP address itself.

Please don’t put personal details in the note. Reports are deleted or anonymised once they have been handled, and at the latest after 12 months.

Why and on what basis: to keep the prices correct and to prevent abuse (legitimate interest, Article 6(1)(f) GDPR).

We only send emails that belong to your account: confirming your address, resetting your password, and the alerts you switched on yourself. No newsletters and no advertising.

We use a few service providers. They process data only on our instructions and under a data processing agreement:

• Cloudflare (Cloudflare, Inc. (San Francisco, Verenigde Staten)) — hosting, database, storage and transactional email (Cloudflare Workers, D1, R2 and Email Sending). Cloudflare handles technical request data such as IP addresses to deliver and protect the website.
• Google — only if you choose “Continue with Google”, to sign you in.
• Cloudflare Web Analytics — if switched on: anonymous visitor statistics without cookies. It does not follow or identify individual visitors.

We never sell your data and we don’t share it with advertisers.

Some parts of the map are loaded by your browser straight from another service. That service sees your IP address and the request itself, but none of your account details. Their own privacy policies apply.

• OpenFreeMap — map tiles and map fonts.
• Esri — satellite images, only when you choose the satellite map.
• Photon by Komoot — place search: the text you type in the search box.
• OSRM routing server — route calculation: the coordinates of your start and destination.
• Google Maps — only when you tap “Directions”; you then leave our website.

Cloudflare and Google are US companies, so data can be processed outside the European Economic Area. Such transfers rely on the safeguards the GDPR allows, such as the European Commission’s Standard Contractual Clauses or the EU–US Data Privacy Framework where the provider takes part in it.

If you tap “use my location”, your browser asks for permission first. Your position is used in your browser to centre the map. We don’t store it. If you use it as the start of a trip, the coordinates go to the routing server to calculate the route.

• Session cookie — keeps you signed in (only when you have an account).
• Language cookie — remembers English or Dutch.
• Local storage — remembers your map style (dark, light or satellite) in your browser.

These are all needed for the website to work as you expect. We don’t use advertising or tracking cookies, which is why you don’t see a cookie banner.

• Account and everything you saved — until you delete your account. Deleting removes it from our database straight away; backups are overwritten within 30 days.
• Sessions and password reset requests — expired records are removed during the next scheduled cleanup. Sessions expire after up to 30 days without renewal.
• Sign-in request counters — removed during the next scheduled cleanup once they have been inactive for 24 hours.
• Reports — until handled, at most 12 months.
• Technical logs — as long as our hosting provider keeps them for security and operations (short-term).

You have the right to see, correct and delete your data, to limit or object to its use, and to receive your data in a portable format.

You can do most of this yourself on your account page: download all your data as a file or delete your account for good. For anything else, email info@appsurge.app. We answer within one month.

Not happy with how we handle your data? You can file a complaint with the data protection authority: Gegevensbeschermingsautoriteit (GBA) (https://www.gegevensbeschermingsautoriteit.be/burger).

All traffic is encrypted (HTTPS), passwords are stored only as a hash, and only the people who run the service have access to the systems.

You need to be at least 16 to create an account.

If we change this policy, we update the date at the top. If the change matters for you and you have an account, we let you know by email.