Privacy Policy

1. Data Controller

The controller within the meaning of the GDPR is:
Jens Schneider (Owner, bluepolicy)
Knütgenstr. 12
53721 Siegburg, Germany
Email: support@bluepolicy.de
Website: https://merux.app

2. Overview

This Privacy Policy informs you about the nature, scope and purpose of the processing of personal data in connection with your use of: the MeruX Mobile App (iOS & Android), the MeruX Website (https://merux.app), and the MeruX API Backend (accessed by the app).

MeruX is an electric vehicle (EV) charging management platform. Users can manage wallbox chargers (via OCPP protocol), monitor charging sessions, register vehicles, and generate billing reports.

3. Data Collected and Purposes

3.1 Account Registration & Authentication

Data types: full name, email address, phone number (optional), authentication method (email with one-time code or password, Google, Apple or Microsoft sign-in), session tokens (JWT-based; in the app stored in encrypted device storage, on the website in an encrypted cookie). MeruX does not store passwords; authentication is delegated to the identity providers listed below.

Purpose: creating and managing user accounts; authentication and authorization for API access. Legal basis: Art. 6(1)(b) GDPR (performance of contract). Third-party providers: Microsoft Azure Entra External ID (CIAM) – identity management; Apple and Google – verification of sign-in tokens. Server location: EU (Germany West Central). Legal basis for transfer: Art. 46 GDPR (Standard Contractual Clauses).

3.2 User Profile & Settings

Data types: address (street, city, postal code, state, country), profile picture (optional, stored on the MeruX API server in the EU), employee ID and employee name (optional, for B2B use), currency preference, report language preference, guest mode flag (anonymous use without account).

Purpose: app personalization; assignment of charging sessions to user accounts; B2B employee identification for billing purposes. Legal basis: Art. 6(1)(b) GDPR; Art. 6(1)(f) GDPR (legitimate interest in account personalization) for optional fields.

3.3 Chargers (Wallboxes)

Data types: serial number of the charging station; user-defined name, brand, model; installation address (street, city, postal code, country); location description (free text); connection status, security profile; communication data via OCPP 1.6/2.0.1 protocol (authenticated WebSocket); connector type (plug type, max. charging power in kW).

Purpose: operation and monitoring of charging infrastructure; fault detection; charge control; OCPP communication with the charging station. Legal basis: Art. 6(1)(b) GDPR.

3.4 Vehicle Data

Data types: user-defined vehicle name; make, model; license plate number; version history (when updated, previous versions are retained with a timestamp).

Purpose: assignment of charging sessions to a vehicle; analysis of charging activities; generation of billing reports (e.g., for tax benefit-in-kind documentation). Legal basis: Art. 6(1)(b) GDPR. Note on license plates: the license plate is personal data. It is used exclusively for vehicle identification in reports and is not shared with third parties.

3.5 Charging Sessions & Meter Values

Data types: session ID, start/end time; start/end meter reading (watt-hours); total energy transferred (kWh, aggregate and per phase L1/L2/L3); charging cost (total cost in EUR); stop reason (e.g., Remote, Local, EVDisconnected); real-time meter values (timestamped MeterValues via OCPP, JSON format); OCPP transaction ID; authorization tag (RFID tag ID, if used).

Purpose: billing and cost statement; generation of charge receipts (PDF with digital signature); tax documentation for company car charging at home; energy analysis; fault detection. Legal basis: Art. 6(1)(b) GDPR; Art. 6(1)(c) GDPR (legal retention obligation for accounting records, §§ 238 et seq. HGB, 10 years).

3.6 Subscription & Payment Data

Data types: Stripe customer ID, subscription status, plan type; payment method details (card last four digits, expiry date – metadata only); billing address; transaction IDs, webhook events. Note: full payment card data (card number, etc.) is processed exclusively by Stripe. bluepolicy/MeruX does not store payment card information.

Purpose: processing subscription payments; feature unlocking; invoicing. Legal basis: Art. 6(1)(b) GDPR; Art. 6(1)(c) GDPR (tax retention obligation). Third-party provider: Stripe Payments Europe, Ltd. (Ireland, EU). Stripe is engaged as a data processor. Data may be transferred to the USA based on Standard Contractual Clauses (SCCs) pursuant to Art. 46 GDPR.

3.7 Push Notifications

Data types: Expo Push Token (device-specific token for push messages); notification content and metadata (title, body, type, timestamp).

Purpose: real-time notifications about charging start/stop, charger errors, and session completion. Legal basis: Art. 6(1)(a) GDPR (consent – granted via system permission dialog); Art. 6(1)(b) GDPR for operationally essential status notifications. Third-party providers: Expo (Expo Inc., USA) – push delivery infrastructure, transfer to USA based on SCCs; Apple APNs (Ireland/USA) and Google FCM (USA) – forwarded by Expo.

3.8 Billing Reports & Meter Evidence

Data types: name, vehicle license plate, charging session data (see 3.5); generated PDF documents with digital signature (PKCS#7; the signing key is held as a protected infrastructure secret); QR code link for verification.

Purpose: creation of legally compliant meter evidence for employees (tax proof for company car home charging); forwarding to employer for cost reimbursement. Legal basis: Art. 6(1)(b) GDPR; Art. 6(1)(c) GDPR (§ 147 AO, 10-year retention). Storage location: Azure Blob Storage (container: meter-evidence), region: EU (Germany West Central).

3.9 Guest Mode

Data types: temporary session ID (no persistent user ID); charging session data during the guest session. Purpose: enables charging without account registration for guests (e.g., visitors). Legal basis: Art. 6(1)(b) GDPR (performance of contract for guest charging session).

3.10 Family / Sub-Accounts

Data types: link between user accounts within the same household / organization; has_family_account flag. Purpose: shared use of charging infrastructure by multiple persons in a household or organizational unit. Legal basis: Art. 6(1)(b) GDPR.

3.11 Energy Prices (Tibber OAuth Integration)

Data types: Tibber OAuth access and refresh token (stored encrypted in our database); Tibber Home ID (ID of the selected household electricity supply); Tibber contract address (postal code, city, country); market price data (dynamic electricity prices, anonymized).

Purpose: dynamic cost calculation based on current market prices via OAuth-linked Tibber account (optional, only when Tibber integration is enabled). Legal basis: Art. 6(1)(a) GDPR (consent via optional activation and explicit OAuth authorization step); Art. 6(1)(b) GDPR. Third-party provider: Tibber AS (Norway, EEA), processed under GDPR-equivalent rules. Revocation: the Tibber connection can be disconnected at any time in app settings. The stored token is deleted upon disconnection.

3.12 OCR & Image Processing (AI-Powered Feature)

Data types: images of charging stations/displays (user-uploaded, optional); extracted text information (meter readings, serial numbers) and the OCR result record kept for verification. Purpose: automatic meter reading recognition via camera (optional feature for non-OCPP charging stations). Legal basis: Art. 6(1)(b) GDPR; Art. 6(1)(a) GDPR (consent for camera access). Third-party provider: OpenAI, Inc. (USA) – OCR via Vision API, transfer to USA based on SCCs. Uploaded images are re-encoded and downscaled on our server before analysis; embedded metadata (e.g. EXIF location data) is removed in the process.

EU AI Act Transparency (Art. 50 Regulation (EU) 2024/1689, applicable from August 2, 2026): this feature uses an AI system (OpenAI Vision API) for automated image analysis. No automated decision-making with legal effect takes place. Users can correct all recognized values at any time. The AI processes only the images uploaded by the user; OpenAI does not store the original data for training purposes (OpenAI API Terms of Service: no training on API data without opt-in).

3.13 Website Usage (merux.app)

Data types: IP address (anonymized after 24 hours); browser type, operating system; pages visited, timestamps, referrer; session cookies (technically necessary). Purpose: website delivery, technical operation, security (attack detection). Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure operation); § 25(2) TDDDG for technically necessary cookies. Not used: Google Analytics, Meta Pixel, or similar tracking tools on the main website (confirmed: Cloudflare security cookies only, no third-party analytics tools). Cloudflare provides us with aggregated traffic statistics (e.g. visitor numbers), built from its server logs, without cookies and without scripts in your browser. We also count clicks on the store buttons ourselves, without cookies and without IP addresses (see 3.20).

3.14 Server Logs

Data types: IP address, HTTP method, URL, status code, timestamp; rate limiting data (IP-based, Redis); IP block list (for repeated violations, max. 1 hour); pseudonymous security events (sign-in, sign-out and API access: internal user ID, event type, timestamp – no name or email address); database diagnostics (performance and error statistics, and in individual cases excerpts of slow database queries). Purpose: operational security, error correction, abuse prevention, detection of security incidents. Legal basis: Art. 6(1)(f) GDPR. Retention: server logs, security events and database diagnostics are automatically deleted after 30 days.

3.15 Reimbursement Data (Reimbursement Tracking)

Data types: month and year of reimbursement period; reimbursement status (pending / submitted / reimbursed); total energy quantity (kWh), total amount, number of charging sessions, currency; free-text notes (optional, user-entered); timestamps.

Purpose: supporting the employee reimbursement workflow vis-à-vis the employer; summarizing charging billing data by calendar month for tax and organizational purposes (German BMF letter of 11 November 2025). Legal basis: Art. 6(1)(b) GDPR; Art. 6(1)(c) GDPR (§ 147 AO statutory retention obligation). Retention: linked to the associated charging session (8 years under § 147 AO).

3.16 Company Vehicle Selection (B2B Feature)

Data types: employee consent record (employee ID, tenant ID, status, employee name, email); vehicle designation (vehicle ID, make, model, name, license plate, approval status, rejection reason, timestamp).

Purpose: linking company vehicles to employee accounts for B2B tenants; approval workflow for employer administrators. Legal basis: Art. 6(1)(b) GDPR (performance of contract in B2B context); Art. 6(1)(f) GDPR (legitimate interest of the employer in managing company vehicles). Note: this feature is only active for users belonging to a corporate account (tenant). Data is visible exclusively to the relevant employer administrator and the affected employee.

3.17 Monthly Charging Report (Email)

Data types: name, email address, the charging report for the previous month (PDF, see 3.8). Purpose: once a month we email registered users who have an email address on file their charging report for the previous month. This is a service message about your use of MeruX and contains no advertising. Legal basis: Art. 6(1)(b) GDPR. Delivery: Azure Communication Services (see section 4).

3.18 Signing Up, Signing In and Deleting Your Account on the Website

Data types: the sign-in data described in 3.1 (email address, or the sign-in token from Google, Apple or Microsoft); a website session: session ID, sign-in method, a device label derived from the browser's user agent, and the times of sign-in, last use and expiry. For email sign-in only, repeated attempts are limited using a keyed hash of the email address combined with a keyed hash of your IP address (for IPv6, of its network prefix). Your IP address itself is not passed to our API or stored by it. Requesting an email sign-in code is protected by Cloudflare Turnstile.

Purpose: creating your MeruX account (on first sign-in, as in the app); signing you in; confirming it is you before you delete your account (deletion requires a sign-in within the last 10 minutes); carrying out the deletion; preventing abuse. Using MeruX itself (chargers, vehicles, reports) happens in the app. Legal basis: Art. 6(1)(b) GDPR for creating the account, sign-in and the session; Art. 6(1)(c) GDPR in conjunction with Art. 12 and 17 GDPR for the deletion; Art. 6(1)(f) GDPR (legitimate interest in security and abuse prevention) for the attempt limits. Retention: see section 6.

3.19 App Updates (Over-the-Air Updates)

Data types: when the app starts, it checks whether an updated version of its JavaScript code is available. For this, the following is sent to Expo's update service (EAS Update): IP address (inherent to the request), platform (iOS/Android), app and runtime version, update channel, and the IDs of the installed and embedded update. No account data, names or content from the app are transmitted.

Purpose: delivering bug fixes and improvements without requiring a new download from the App Store or Google Play; ensuring the app works with the current version of our services. Legal basis: Art. 6(1)(b) GDPR (provision of the app) and Art. 6(1)(f) GDPR (legitimate interest in the stability and security of the app). Recipient: Expo, Inc., USA (see section 4). Retention: we do not store these requests ourselves; Expo processes them as our processor on our instructions.

3.20 Campaign Links and Store Click Statistics (Website)

Data types: if you reach merux.app through a link with campaign parameters (utm_source, utm_medium, utm_campaign), the page reads these parameters from the address and passes them on to the Google Play link (as a referrer) and to the App Store link (as a campaign token). When you tap a store button or scan the QR code, we store an event with: the type of event, the chosen store, the device type (iPhone/iPad, Android or computer), the page, the three campaign parameters and the time. We store no IP address, no device ID and no full browser identifier, and set no cookies for this; we cannot link an event to a person. To show the right store button, the page evaluates your browser identifier (User-Agent) in your browser; it is not stored. When you scan the QR code, our server evaluates the browser identifier only to send you to the right store; it is not stored either.

Purpose: measuring which campaigns lead to store visits and app downloads. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in measuring the success of our advertising); § 25(2) no. 2 TDDDG for reading the browser identifier and touch capability to show the right button or to send you to the right store. Storage: Microsoft Azure Table Storage (Germany). When you open a store link, Google or Apple receives the campaign parameters and processes them under their own privacy policies; App Store Connect and the Google Play Console show us aggregated figures only. Retention: see section 6.

4. Recipients and Processors

We engage the following service providers as data processors (Art. 28 GDPR):

• Microsoft Azure — cloud hosting (Container Apps, database, cache), Blob Storage, Key Vault — EU (Germany West Central) — Art. 46 GDPR (SCCs + EU DPA)
• Microsoft Azure Entra ID (CIAM) — identity management, authentication — EU / USA — Art. 46 GDPR (SCCs)
• Azure Communication Services — email delivery (monthly charging reports) — EU / USA — Art. 46 GDPR (SCCs)
• Stripe Payments Europe, Ltd. — payment processing, subscriptions — EU (Ireland) / USA — Art. 46 GDPR (SCCs)
• Expo (Expo Inc.) — push notifications; over-the-air app updates (EAS Update) — USA — Art. 46 GDPR (SCCs)
• Apple Inc. (APNs) — iOS push notifications — USA (EU routing) — Art. 46 GDPR (SCCs)
• Google LLC (FCM) — Android push notifications — USA (EU routing) — Art. 46 GDPR (SCCs)
• Apple Inc. / Google LLC — Sign in with Apple / Google sign-in (verification of sign-in tokens) — USA — Art. 46 GDPR (SCCs) / EU-U.S. DPF
• Cloudflare, Inc. — DNS, edge proxy and bot protection (Turnstile) for the website, web portals and, where enabled, the API — USA / global edge network — Art. 46 GDPR (SCCs) / EU-U.S. DPF
• OpenAI, Inc. — OCR / image analysis (optional feature) — USA — Art. 46 GDPR (SCCs)
• Tibber AS — dynamic electricity pricing (optional) — Norway (EEA) — Art. 45/46 GDPR
• Apple App Store / Google Play — app distribution — USA — own privacy policies

A complete sub-processor list is available at: https://merux.app/subprocessors

5. International Data Transfers

Some of the processors listed above process data in the USA or other third countries outside the EU/EEA. These transfers are safeguarded by: EU Standard Contractual Clauses (SCCs) pursuant to Art. 46(2)(c) GDPR (2021 edition); adequacy decisions by the European Commission (where applicable, e.g., Norway); the EU-U.S. Data Privacy Framework (for certified U.S. companies). We can provide the specific safeguards on request.

6. Retention Periods

• User account data — until account deletion + 30 days (recovery period)
• Charging session data — 3 years (active use) + up to 10 years for accounting records (§ 147 AO)
• Meter evidence (PDFs) — 10 years (§ 147 AO, statutory retention)
• Meter photos and OCR result records (see 3.12) — retained together with the associated charging session
• Push tokens — until account deletion or app uninstall; notifications can be disabled at any time in your device settings
• Server logs, security events and database diagnostics — 30 days
• Store click events (see 3.20) — 24 months
• Deleted users — pseudonymized, max. 90 days
• Website sign-in sessions (see 3.18) — until you sign out; otherwise ended after 7 days without use, and at the latest 30 days after sign-in. Attempt limits for email sign-in — 1 hour
• App sign-in sessions (one record per device, see 3.1) — until you log out; otherwise ended after 7 days without use, and at the latest 180 days after sign-in. Ended sessions are deleted; expired ones by the following day at the latest
• Redis cache (rate limiting) — max. 1 hour (IP blocks)

After the retention period expires, data is automatically deleted or anonymized unless statutory retention obligations require otherwise.

Backups: deleted or changed data may remain in encrypted database backups for a limited period (currently up to 35 days) until those backups are rotated. Backups are used only for disaster recovery and are not accessed for any other purpose.

7. Your Rights

As a data subject, you have the following rights:

• Right of access (Art. 15 GDPR): you may request information about the personal data we hold about you.
• Right to rectification (Art. 16 GDPR): you may request correction of inaccurate or incomplete data. Many details can be updated directly in the app under Settings → Profile.
• Right to erasure (Art. 17 GDPR): you may request deletion of your data. The app provides a direct option under Settings → Delete Account; deletion can also be requested without the app at https://merux.app/en/delete-account. Statutory retention obligations (e.g., accounting records under § 147 AO) may prevent full deletion.
• Right to restriction of processing (Art. 18 GDPR): you may request restriction of processing where the statutory conditions are met.
• Right to data portability (Art. 20 GDPR): you may request your data in a machine-readable format (JSON/CSV), where processing is based on consent or contract and carried out by automated means.
• Right to object (Art. 21 GDPR): you may object to processing based on Art. 6(1)(f) GDPR (legitimate interest).
• Right to withdraw consent (Art. 7(3) GDPR): you may withdraw consent at any time with effect for the future (e.g., push notifications via device settings).

Exercising your rights: please contact us by email at support@bluepolicy.de. We will process your request within 30 days.

8. Right to Lodge a Complaint

You have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work, or place of the alleged infringement. Competent authority for bluepolicy (North Rhine-Westphalia, Germany):

State Commissioner for Data Protection and Freedom of Information NRW
(Landesbeauftragte für Datenschutz und Informationsfreiheit NRW)
Postfach 20 04 44
40102 Düsseldorf, Germany
Phone: +49 211 38424-0
Email: poststelle@ldi.nrw.de
Website: https://www.ldi.nrw.de

9. Data Security

We implement technical and organizational measures (TOMs) to protect your data:

• Transport encryption: TLS 1.2+ for all API connections (HTTPS only)
• OCPP connections: WebSocket Secure (WSS) with authentication tokens
• Database connections: SSL encryption (PostgreSQL 15)
• Token storage (app): expo-secure-store (iOS Keychain / Android Keystore)
• PDF signatures: PKCS#7 digital signature; signing key held as a protected infrastructure secret
• Rate limiting: per-endpoint limits of 5 to 60 requests per minute per IP (Redis-backed)
• IP blocking: automatic one-hour block after 50 rate-limit violations
• Tenant isolation: all database queries are scoped to tenant_id
• Data at rest: Microsoft-managed encryption for database, cache and storage
• Infrastructure: Azure Container Apps in Germany West Central; database and cache reachable only inside a private virtual network; Cloudflare edge protection for web traffic

A detailed description of our security measures is provided in our Technical & Organizational Measures (TOM) document.

10. Cookies and Similar Technologies

App (iOS/Android): the MeruX app uses secure storage (expo-secure-store) for authentication tokens — technically necessary, not a cookie in the traditional sense — and a device-specific push token, only with your consent.

Website (merux.app): technically necessary cookies/session tokens required for website operation. No consent required (§ 25(2)(2) TDDDG). In detail: __Host-merux_session keeps you signed in (encrypted, at most 30 days); __Host-merux_oauth is used during Apple or Microsoft sign-in (10 minutes); __Host-merux_email_flow during email sign-in (15 minutes); __Host-merux_restore when restoring a deleted account (15 minutes); NEXT_LOCALE stores your language (1 year). Google sign-in keeps a random check value in the browser's session storage until you return from Google (at most 10 minutes). Cloudflare, which delivers and protects the website (see section 4), may set its own security cookies: __cf_bm when it checks traffic for bots (30 minutes), and cf_clearance after a completed security check (for the period Cloudflare sets, usually 30 minutes). Cloudflare Turnstile protects the contact form, the sample-report form and email sign-in against spam: it loads a check from Cloudflare that evaluates technical browser signals to tell people from bots, and is used only for that. All cookies used are technically necessary; no marketing or analytics cookies are set. You can delete cookies at any time in your browser settings; if you block technically necessary cookies, sign-in may not work. The campaign and store click statistics (see 3.20) use no cookies and store nothing in your browser (neither local storage nor session storage).

11. Special Notes for Business Users (B2B)

Where you use MeruX within an organizational context: the controller for employee data processing (e.g., license plates, charging sessions) is typically your employer (the organization). bluepolicy may act as a data processor in this context. In such cases, we enter into a Data Processing Agreement (DPA) with your employer pursuant to Art. 28 GDPR. For inquiries about your personal data, please also contact your employer.

12. Special Categories of Data

MeruX does not process special categories of personal data within the meaning of Art. 9 GDPR (e.g., no health, racial, or biometric data). Regarding travel/location profiles: charger installation addresses may allow inferences about regular locations. This data is not used for profiling purposes and is not shared with advertisers.

13. AI Systems and Automated Decision-Making (EU AI Act)

13.1 AI systems in use — pursuant to Art. 50 of Regulation (EU) 2024/1689 (EU AI Act, applicable from August 2, 2026), we inform you about the use of AI systems: OpenAI Vision API — OCR receipt capture (non-OCPP charging) — provider OpenAI, Inc., USA — minimal risk (Art. 50 transparency obligation).

13.2 Automated decision-making — no automated decision-making within the meaning of Art. 22 GDPR (including profiling with legal effects) takes place. MeruX is not a high-risk AI system within the meaning of Annex III of the EU AI Act.

14. Children

MeruX is not directed at persons under 18 years of age. We do not knowingly collect data from minors. If you are a parent or guardian and become aware that your child has submitted personal data, please contact us.

15. Changes to This Privacy Policy

We reserve the right to update this Privacy Policy if legal requirements change or we introduce new features. The current version is always available at https://merux.app/privacy. For material changes, registered users will be notified by email or in-app notification.

Version 1.5 (8 October 2026, effective upon publication): added section 3.20 – campaign links and cookieless store click statistics; added its retention period to section 6; added a note to section 10.

Version 1.4 (October 1, 2026): accounts can now be created on the website, and account deletion on the website works by signing in instead of an emailed confirmation code; 3.18 and section 6 updated accordingly; the website sign-in session added to 3.1, retention of app and website sessions to section 6, and the cookies used listed in section 10, including Cloudflare's security cookies and Cloudflare Turnstile; Cloudflare traffic statistics added to 3.13; new section 3.19 on over-the-air app updates (Expo EAS Update) and Expo's entry in section 4 extended accordingly; pseudonymous security events and database diagnostics added to 3.14 and section 6.

Version 1.3 (October 1, 2026): wording aligned with the deployed system (hosting region, sign-in methods, profile picture storage, PDF signing, Tibber token storage, OCR provider, rate limiting); new sections on the monthly charging report email and on backups; sub-processor list extended (Apple/Google sign-in, Cloudflare); push-token retention clarified; deletion via the website added, including the data it processes and how long it is kept (3.18, section 6).

16. Contact for Privacy Inquiries

For data protection questions:
Jens Schneider (Owner, bluepolicy)
Knütgenstr. 12
53721 Siegburg, Germany
Email: support@bluepolicy.de

Data Protection Officer: as a sole trader with fewer than 20 persons regularly engaged in automated processing, bluepolicy is not required to appoint a Data Protection Officer under Art. 37 GDPR.