Privacy policy

• Account: your phone number, and the name and language you choose.
• Vehicles: the details you add, such as make, model and number plate.
• Charging: which device you used, when, the energy delivered and what you paid, plus the readings the device sends during a session.
• Wallet: your balance and every top-up, hold and charge.
• Problem reports: the phone number you give, your description, the device code or place, and a photo if you add one.
• Notifications: if you turn them on, the address your browser gives us for sending push notifications.
• Shop owners: shop name, type, contact phone and location.

We ask for your location only when you use the map, and only with your permission, so the map can show where you are. Your position stays on your phone and is not sent to us. Searching for a charge point happens on your phone too, across Charmi's own charge points — it is not a general place search and nothing you type is sent anywhere.

Tapping Navigate opens Google Maps with the charge point's coordinates. From that point you are using Google Maps, under Google's own terms and privacy policy; we send Google nothing about you.

• To sign you in and keep your account secure.
• To start, bill and settle charging sessions, and keep your wallet accurate.
• To send sign-in codes, receipts and session notifications.
• To investigate problem reports and billing questions, and to fix devices.
• To pay shops their share, and to meet legal and accounting obligations.

We do not sell your data, show advertising, or use analytics or tracking tools.

We use these service providers, each only for the job described:

• Supabase: database, sign-in and file storage.
• Vercel: hosting the app and website.
• SMSLenz: delivering SMS codes and receipts to your phone number.
• Your browser's push service (for example Google, Apple or Mozilla): delivering notifications, if you turn them on.
• OpenFreeMap: the map images themselves.
• Payment providers: when online top-up is available, the provider you pay with processes that payment.

Shops see the sessions at their own devices (times, energy and amounts) but not your name or phone number. Some of these providers may store data outside Sri Lanka.

• Detailed device readings are deleted after 90 days.
• Session and wallet records are kept for as long as they are needed for accounting, disputes and legal obligations.
• Other account data is kept while your account is open. When you close your account it stays restorable for 30 days and is then permanently deleted within 60 days, except the records we are required to keep — see delete your account, which lists exactly what goes and what stays.

We use only what the app needs to work: sign-in cookies, and small settings for your language and whether you are in rider or shop mode. Your phone also remembers your theme and whether you dismissed the install banner. We do not use tracking or advertising cookies.

You can ask us for a copy of your data, to correct it, to delete it, or to stop using it for a purpose you agreed to. Email support@pepulux.com from the account holder, or call us from the phone number on the account. We may need to confirm it is you before we act.

Data is encrypted in transit, and access rules in our database let each account see only its own records. No system is perfectly secure; if we learn of a breach that affects you, we will tell you.

When we change this policy we update the date at the top, and we tell you in the app about any important change.