Privacy Notice
Privacy Notice — European Charging Data
Version 1.2 · In force for new accounts from 2 November 2026; for existing accounts 30 days after our announcement of 31 October 2026, that is from 30 November 2026. The campaign tags described in the table below apply to new sign-ups only
Who we are. The controller is SolidRoam Oy, Konepajankuja 1, 00510 Helsinki, Finland, Business ID 3376132-4. Privacy contact: privacy@solidroam.com, legal@solidroam.com. We answer requests within one month. You have the right to complain to the Finnish Data Protection Ombudsman (Tietosuojavaltuutettu, Lintulahdenkuja 4, 00530 Helsinki, tietosuoja.fi).
What we collect and why
| Data | Why | Legal basis (GDPR) |
|---|---|---|
| Name, business e-mail, company, role, billing address, VAT number | Create and run your account, invoice you, support | Contract (Art. 6(1)(b)) |
| Invoices and payment status (card details stay with the payment provider) | Billing and bookkeeping | Contract; legal obligation (Art. 6(1)(c)) |
| Record of the terms you accepted (version, time) | Show that you accepted | Legitimate interest (Art. 6(1)(f)) |
| API-key identifiers (secrets are stored only as hashes) | Log you and your assistants in | Contract |
| Request logs: time, IP address, key, tool called, request parameters, response size, errors | Security, abuse prevention, limits, fixing faults | Legitimate interest (Art. 6(1)(f)) |
| Ephemeral visitor counts on the public pages of mcp.solidroam.com: a temporary daily keyed hash (HMAC) of your IP address and browser details, held in server memory only and never saved to disk, the page requested, and the referral source (utm_source or referrer host) | Calculate aggregated daily traffic, plan server capacity and detect crawl spikes | Legitimate interest (Art. 6(1)(f)) |
| First-touch campaign tags present in the address of the page through which you reached our sign-up (utm_source, utm_medium, utm_campaign, utm_content), stored with your account when you confirm your e-mail address | Measure the effectiveness of our marketing channels, optimise advertising spend and allocate acquisition costs | Legitimate interest (Art. 6(1)(f)); you may object at any time |
| Support e-mails | Answer you, keep a record | Contract; legitimate interest |
| Marketing e-mail address, only if you sign up for it | News about the Service | Consent (Art. 6(1)(a)); unsubscribe any time |
| Messages, bug reports and feature requests you send through the tools (your text, the tool name, your plan, an internal organisation number, your account e-mail) | Answer you, fix faults, decide what to build | Contract; legitimate interest (Art. 6(1)(f)) |
| A rating and a comment you send through your assistant | Improve the Service | Legitimate interest (Art. 6(1)(f)) |
| If you agree, a quote with your name and job title for our website | Show what customers say | Consent (Art. 6(1)(a)); withdraw any time |
| Only if you agree to marketing cookies on solidroam.com: the click identifier of the Google ad you came from (gclid, gbraid or wbraid) and the campaign tags (utm_source, utm_medium, utm_campaign, utm_term, utm_content), linked to your account, and the events sign-up confirmed, first use and first payment | Measure which ads lead to sign-ups and payments, and improve them | Consent (Art. 6(1)(a)); withdraw any time |
Why and where from. We need the account, billing and sign-in data to run the contract; without it we cannot provide the Service. Logs are created automatically. For logs our legitimate interest is keeping the Service secure, preventing abuse and fixing faults; we weigh this against your interests, collect only what is needed and keep it 90 days. We analyse aggregate query demand and per-account usage to maintain capacity, support customers proactively, manage plan limits and guide product development. Recipients are the providers below, advisers under confidentiality, and authorities when the law requires.
We do not make decisions about you by automated means that have legal effects. Rate limits and blocks affect only access to the Service and can be reviewed by a person on request. We do not sell personal data and do not use logs or your queries to train AI models. We use data for advertising measurement only in the case described under "Advertising measurement" below, and only if you agreed to it.
Advertising measurement (only if you agree)
When you reach our website solidroam.com from a Google ad, our cookie banner asks whether you accept marketing cookies. If you do not agree, nothing described here happens: the link to sign-up carries no click identifier and the Service stores none.
If you agree, the sign-up link carries the ad's click identifier and campaign tags. When you sign up, we store them with your account. When you confirm your e-mail address, make your first use of the Service or pay for the first time, we send that event together with the click identifier to Google Ads, so that Google can tell which ad led to it. We do not send your name, and we do not use the data to follow you around other sites or to build a profile of you. You can withdraw your consent at any time with "Cookie settings" on solidroam.com or by writing to the privacy contact; we then stop sending events and delete the stored click identifier. Withdrawal does not affect what happened before.
The charging data is about equipment, but can contain a few personal details
The Service contains charging-point data from public sources. It is about equipment, not people, but the source records of small operators can contain a person's contact details. We remove personal e-mail addresses and phone numbers automatically before storing a record (general support addresses and help-desk numbers of a business are kept); names in free text cannot be found reliably by machine. For such residual cases we rely on Article 14(5)(b) GDPR (disproportionate effort), and this notice is the public information. Station names and descriptions come from third parties and could in rare cases contain a person's name or phone number. If you find such data, write to the privacy contact with the record; we remove it from the live Service and caches within 7 days.
If you send us other people's data
If personal data of your own staff or customers reaches us through your queries, we process it only on your behalf as your processor, under a data processing agreement we provide on request. Please do not send personal data in queries.
Who receives data
| Provider | Role and purpose | Location |
|---|---|---|
| Hetzner Online GmbH | Processor: hosting and backups | Germany (Nuremberg, Falkenstein) and Finland (Helsinki) |
| Brevo (Sendinblue SAS) | Processor: sign-in, confirmation and notification e-mail | France |
| Google Workspace | Processor: our support and sales mailboxes | European data region; any transfer outside the EU/EEA under Standard Contractual Clauses or the EU-US Data Privacy Framework |
| GitHub, Inc. (Microsoft) | Processor: private repository for bug reports and feature requests you send through the tools, after we have read and approved them (your text, tool name, plan and an internal organisation number; no name or e-mail) | United States (Data Privacy Framework or Standard Contractual Clauses) |
| Google Ireland Limited (Google Ads) | Independent controller (under the Google Ads Controller-Controller Data Protection Terms) for conversion attribution and measurement: receives the events described under "Advertising measurement", only if you agreed to marketing cookies. | Ireland; United States (Standard Contractual Clauses or Data Privacy Framework) |
| Google LLC (YouTube, privacy-enhanced host youtube-nocookie.com) | Independent controller: plays the video guides on the connection page. The guides load only when you press play; before that your browser makes no connection to YouTube. When you press play, YouTube receives your IP address and browser details. | United States (Data Privacy Framework or Standard Contractual Clauses) |
| Lovable and Supabase | Processors: host and run our website solidroam.com, which has its own notice | [confirm: regions] |
| Stripe Payments Europe, Ltd. (with Stripe, Inc.) | Independent controller for payments and fraud prevention; processor for the subscription and invoice services we set up | Ireland; United States (Standard Contractual Clauses or Data Privacy Framework) |
| healthchecks.io | Uptime pings, no personal data | not applicable |
Your own AI assistants and clients are your tools, not our processors.
We also disclose data when a law or an authority requires it, and to advisers under confidentiality. If data goes outside the EU/EEA we use Standard Contractual Clauses or another lawful basis.
How long we keep it
| Data | Kept |
|---|---|
| Request and security logs | 90 days (periods follow how long we need the data for its purpose, or how long the law requires); after 90 days the IP address and the request parameters are removed |
| Call records without IP address and parameters (time, account, tool called, outcome, response size) | Up to 400 days, for usage statistics, billing questions and capacity planning |
| Visit hashes (public pages) | Until midnight UTC of the same day; held in memory only and lost at restart |
| Daily visit totals per page and traffic source (no personal data) | Up to 800 days |
| Account campaign tags | While the account exists; deleted 30 days after it is closed |
| Invoices and vouchers | 6 years after the end of the financial year; ledgers 10 years (Finnish Accounting Act) |
| Account data | While the account exists, plus 30 days |
| Record of the terms you accepted | For as long as needed to prove the agreement (the limitation period for contract claims) |
| Backups | Up to 35 days; deleted data leaves backups within that time |
| Support e-mails | 12 months after the matter closes |
| Marketing consent records | Until you withdraw, plus 30 days |
| Messages, bug reports, feature requests and ratings | 24 months after they were sent; then deleted or made anonymous |
| Quotes for our website | Until you withdraw, plus 30 days |
| Advertising click identifier and the events linked to it | 90 days after the click; then the identifier is deleted from the account record |
Your rights
You can ask to see, correct, delete, restrict or move your data, object to processing based on legitimate interest, and withdraw consent (for advertising measurement also with "Cookie settings" on solidroam.com). Write to the privacy contact with your account address. We may keep what the law requires (for example invoices) and will tell you what we could not delete.
Cookies and security
The portal at mcp.solidroam.com uses only strictly necessary cookies (sign-in session) and local storage for interface settings. No advertising or tracking cookies on the portal. We measure visits to the public pages without cookies: distinct visitors of a day are counted in temporary server memory using a keyed hash of your IP address and browser details; the key changes every day at midnight UTC and the hash is never written to storage. We keep only daily totals. Campaign tags present in referral links are processed on our servers and carried through the sign-up process without using cookies or local storage; we use them internally to evaluate our marketing performance and do not share them with advertising networks without your consent. The video guides on the connection page use a click-to-load mechanism: no connection or cookie goes to YouTube unless you press play. Our website solidroam.com is a separate site with its own privacy and cookie notice and its own cookie banner, where you choose whether analytics, functional and marketing cookies are used. We protect data with encryption in transit, hashed secrets, per-customer limits, logging and access limited to authorised staff. We report personal data breaches to the authority and to you as GDPR Articles 33 and 34 require.
Children and changes
The Service is for businesses and professionals, not for people under 18. We announce material changes to this notice at least 30 days ahead by e-mail or in the portal. Version 1.1 adds messages and ratings, quotes with your name, the video guides, advertising measurement with your consent, cookie-free visit counting, and shorter storage of the IP address and parameters in request logs. Version 1.2 adds the campaign tags of the page through which a new account reached sign-up.
Version e35245bed8ea