wavestripe.app
Legal

Privacy policy

Effective date: 2026-05-20 · Last updated: 2026-10-21 · Controller: Codestripes LLC (63 N. Burritt Ave, Room 100 East PMB1323, Buffalo, WY 82834, USA)

This policy explains how Codestripes LLC (“we”) collects, uses, shares, and protects personal data when you use wavestripe.app (the “Service”). It also describes the rights you have under the EU General Data Protection Regulation (GDPR), the UK GDPR, and similar laws.

1. Data controller

The data controller for personal data processed via the Service is Codestripes LLC, 63 N. Burritt Ave, Room 100 East PMB1323, Buffalo, WY 82834, USA. For privacy questions or rights requests, use our contact form.

2. What we collect and why

Account and billing data

When you create an account or complete checkout we collect your name, email address, billing country, billing address, city, and postal code. We use this data to provide the Service, calculate applicable sales tax, and issue invoices.

Legal basis (EU/UK): performance of a contract (Art. 6(1)(b) GDPR) and compliance with tax and accounting obligations (Art. 6(1)(c)).

Payment data

We do not store card details. Card data is collected and processed directly by Stripe Payments Europe Limited. Stripe retains a token that we use to charge subsequent renewals.

Legal basis: performance of a contract (Art. 6(1)(b)) and our legitimate interest in fraud prevention (Art. 6(1)(f)).

Vehicle and diagnostic data

When you connect a vehicle, we store the vehicle identification number (VIN), software part numbers, fault codes (DTCs), routine outcomes, and an audit log of write operations. Live data streams (HV cell voltages, temperatures) are processed in your browser and are not sent to our servers unless you explicitly save a scan report.

We use this data to provide the Service, debug issues you report, and improve product quality (in aggregate / de-identified form).

Legal basis: performance of a contract (Art. 6(1)(b)) and our legitimate interest in operating and improving the Service (Art. 6(1)(f)).

AI assistant messages

When you use the assistant (the chat screen, or “explain this scan”), we send what you type, the earlier messages in that conversation, and the context of your last scan — fault codes, module and software information, and your car’s VIN — to our AI provider to generate the answer. We do not add your name or email address. Conversations are kept in your browser; our server does not keep a copy of them, only a count of how much you used the assistant (for daily limits). If you tap “Report this answer”, we keep the reported answer (up to 2,000 characters), your optional reason and your account id so we can review it.

Legal basis: performance of a contract (Art. 6(1)(b)); for reports, our legitimate interest in keeping answers accurate and safe (Art. 6(1)(f)).

Usage and device data

When you use the Service we automatically collect log data such as IP address, user agent, pages visited, and timestamps. We use this to operate, secure, and improve the Service.

Legal basis: legitimate interest (Art. 6(1)(f)) and, where required, consent (Art. 6(1)(a)).

Android app

The wavestripe Android app shows the same Service inside the app and adds native device features:

  • Bluetooth adapter connection. The app uses Android’s Bluetooth permissions to find and connect to your OBD adapter. Data read from the car goes to the Service exactly as it does from a browser (see “Vehicle and diagnostic data”). The app does not use Bluetooth to locate you or other devices.
  • Phone key and scheduled climate. If your Pro account has a phone key provisioned for your car, the app can fetch it from our authenticated service over HTTPS. We store that car credential encrypted with your account; it is not shown in the app. Android stores its offline copy encrypted with a key held by Android Keystore, tied to the account session that received it, and the app’s offline lease lasts up to 30 days between renewals. The app uses it locally for supported Bluetooth key actions and climate requests; it does not send the credential with those Bluetooth actions. Scheduled climate settings (selected time and days), a session fingerprint and the latest attempt status stay on your device. These local settings remain until replaced or the app’s storage is cleared. If you enable a schedule, Android’s exact-alarm permission wakes the app at those times so it can make a bounded Bluetooth connection attempt; climate delivery or cabin operation is not guaranteed. The schedule pauses if required permissions or notifications are unavailable, and you can turn it off in the app. Signing out in the app clears its local key and disables the schedule. Deleting your account removes the server-side key; an offline phone cannot immediately learn about deletion performed elsewhere. Sign out on each phone or clear its app storage to remove its local key.
  • Car sender for A Better Routeplanner (ABRP). If you pair the app as a car sender, it receives a random device token; we store only a one-way hash of it, linked to your account, and you can remove the device at any time from the ABRP screen. While sending, the app reads your battery’s state of charge, voltage, current and temperature and sends them to us, and we forward them to ABRP using your ABRP token. To keep sending with the screen off, the app runs an Android foreground service with a visible notification; it pauses while the car is switched off and stops when you stop it. The car sender also reads the odometer, and we store a summary of each drive (start and end time, odometer distance, energy used and recovered, battery level and temperature — no location) on your account to show your trip history. It likewise stores a summary of each charging session (start and end time, battery level, energy into the battery, power, battery temperature and odometer, plus the charger’s kWh if you type it in — no location), and the Trips screen works out parked-drain summaries from those records (computed when you view them, not stored). You can delete any trip or charging session on the Trips screen, and all of them are removed with your account. Detailed car-sender readings (each reading the app sends, with what the trip and charging detection did with it — no location) are kept for 14 days so we can troubleshoot trip and charging detection, then deleted automatically; they are also removed with your account.
  • Location — only if you opt in. If you turn on “Include my location”, the app also sends your position and speed so ABRP can plan from where you actually are. It is relayed through our server to ABRP and is not stored by us. With the option off, the app does not access your location for this purpose.
  • Beta access. If you ask to join the Android beta, we store the Google account email you enter, linked to your account, so we can add you to the app’s Google Play test track.
  • No ads, no tracking. The app contains no advertising, no third-party analytics or tracking SDKs, and does not sell or share data for advertising.

Legal basis: performance of a contract (Art. 6(1)(b)); location only with your consent (Art. 6(1)(a)), which you can withdraw by switching the option off. You can disable the climate schedule or remove the phone key from the device by signing out.

Cookies

We use a minimal set of strictly necessary cookies (session, authentication, fraud prevention). We do not use advertising cookies or sell personal data. If we later introduce analytics or marketing cookies we will request your consent first.

3. Who we share data with

We share personal data only with the processors and parties listed below:

  • Stripe Payments Europe, Ltd. — card processing. Privacy policy: stripe.com/privacy.
  • AI providers — when you use the assistant, your messages and the scan context described under “AI assistant messages” are sent to DeepSeek (our primary provider) or, if it is unavailable, to OpenAI, which process them to generate the answer. We do not include your name or email address.
  • A Better Routeplanner (Iternio) — only if you link ABRP: your car’s battery readings and, if you opt in, your location, relayed through our server and sent with your ABRP token so ABRP can plan your trip. This happens only at your request, from the web app or the Android app’s car sender.
  • Hosting and infrastructure providers — used to run the Service. They process data only on our instructions and under confidentiality obligations.
  • Authorities — where we are required by law to disclose data (e.g. tax authorities, courts).

We do not sell personal data and we do not share it for cross-context behavioural advertising.

4. International transfers

Codestripes LLC is established in the United States. When personal data is transferred from the EEA or the UK to the United States or another country outside those regions, we rely on the European Commission’s Standard Contractual Clauses or equivalent safeguards required by the GDPR.

5. How long we keep data

  • Account data: for as long as your account is active.
  • Billing and invoice data: for up to 10 years to comply with tax law.
  • Vehicle / diagnostic data: for the lifetime of your account, or until you delete it.
  • Audit log of actions sent to your car: 365 days; when you delete your account the entries are kept with the VIN removed.
  • Reported AI answers: until reviewed, and at most 365 days.
  • Server logs: typically up to 30 days, longer if needed for security investigations.

When data is no longer needed we delete or anonymise it.

Deleting your account: you can delete it yourself in the web app or the Android app (Account → Data & privacy → Delete account), or ask us to without signing in. See Delete your account for exactly what is removed and what is kept.

6. Your rights

If you are in the EU, UK, EEA, Switzerland, or a jurisdiction with similar laws, you have the following rights:

  • access to a copy of the personal data we hold about you;
  • rectification of inaccurate or incomplete data;
  • erasure of data (“right to be forgotten”) subject to legal retention;
  • restriction of processing;
  • data portability in a structured, machine-readable format;
  • objection to processing based on legitimate interest;
  • withdrawal of consent at any time, where processing is based on consent.

To exercise any of these rights, use our contact form. We will respond within 30 days. You also have the right to lodge a complaint with your national data-protection authority — for example, your country’s supervisory authority listed at edpb.europa.eu (EU) or the ICO at ico.org.uk (UK).

7. Security

We use industry-standard technical and organisational measures including TLS encryption in transit, encryption at rest where applicable, role-based access controls, and audit logging. No system can be made 100% secure; if a personal-data breach occurs we will notify affected users and supervisory authorities as required.

8. Changes to this policy

We may update this policy from time to time. The “Effective date” at the top of this page indicates when it was last revised. Material changes will be announced by email or via in-product notice.

9. Contact

Privacy questions or requests: our contact form.
Postal address: Codestripes LLC, 63 N. Burritt Ave, Room 100 East PMB1323, Buffalo, WY 82834, USA.