Privacy Policy

This policy describes what personal data RealRange collects about drivers and riders, why we collect it, who we share it with, and what rights you have over it. We've aimed to write it in plain language without hiding anything behind legalese.

RealRange is currently an Australian-market launch. Australian law governs our handling of personal information. We extend GDPR-grade rights to every user regardless of where they live, because we believe those rights should be the baseline rather than a regional perk.

Who we are

RealRange is a web service that helps drivers and riders understand the real-world range and energy consumption of their vehicles.

Data controller: Real Range Pty Ltd (ABN 78 696 557 294), Australia.

Contact for privacy matters: privacy@realrange.com

What data we collect

We try to collect only what the service genuinely needs. The list below is exhaustive — if it isn't here, we don't collect it.

Sensitive personal information

Precise geolocation data — trip origins, destinations, waypoints, and the locations of charge and fuel events you log — is treated as sensitive personal information under the California Privacy Rights Act (CPRA) and as a special protection interest under GDPR. We use this data only to plan routes, calculate energy use, and populate your own history; we do not share it with advertisers or use it to profile you.

If you are a California resident (or hold equivalent rights under other jurisdictions), you may request that we limit our use of sensitive personal information to what is necessary to perform the service you have requested. Contact privacy@realrange.com.

Why we collect it

We collect and use personal data on the following legal bases (GDPR Article 6 terminology, applied globally):

• Performance of a contract — to provide the RealRange service you've signed up for. Covers account identity, vehicles, trips, driving logs, charge/fuel records, and calibration.
• Legitimate interest (operations) — to run the service reliably, prevent abuse and fraud, and secure the systems. Covers hosting access logs and error monitoring. We have balanced this interest against your rights and consider it proportionate because the logs are retention-limited and not used for marketing or profiling.
• Legitimate interest (range-model accuracy) — to improve the accuracy of our range estimates for the wider user base. Covers vehicle and calibration records in aggregated form. We have balanced this against your rights and consider it proportionate because the vehicle record is reference-style data, not a profile of you.
• Consent — for the analytics cookies described below, and for any future optional integrations (for example, connecting a Tesla account). You can withdraw consent at any time via the "Cookie preferences" link in the footer or by disconnecting the integration.

Who we share data with

We do not sell your data. We do not share it with advertisers. We do not engage in "sharing" of personal information for cross-context behavioural advertising as defined by the CPRA. The following service providers process data on our behalf to make the service work. Appropriate transfer safeguards under GDPR Chapter V are identified for each.

• Vercel (hosting and CDN, USA) — runs our application servers and sees request metadata including IP addresses. Transfer mechanism: Standard Contractual Clauses (SCCs).
• Neon (managed Postgres database, USA/EU region available) — stores all your account, vehicle, and trip data encrypted at rest. Transfer mechanism: SCCs; EU-region hosting available.
• Google (sign-in, USA) — handles authentication. Google tells us your email, name, and profile image when you sign in. Transfer mechanism: Google is certified under the EU-US Data Privacy Framework.
• Google Maps Platform (USA) — renders map tiles, performs geocoding and routing. Trip origins, destinations, and waypoints are sent to Google to compute routes. Your browser's IP is visible to Google when map tiles load. Transfer mechanism: Data Privacy Framework.
• Google Analytics (USA) — measures aggregate site usage. Loaded only after you consent via the cookie banner. IP anonymisation on; Google Signals and ad personalisation off. Transfer mechanism: Data Privacy Framework.
• Open-Meteo (Germany) — supplies weather forecasts along planned routes. We send coarse coordinates and a forecast time; no account data. Transfer mechanism: EEA-based, no cross-border safeguard needed.
• Amazon Web Services (USA) — mirrors NASA SRTM terrain-elevation data used for grade calculations. We send coordinates only. Transfer mechanism: SCCs / Data Privacy Framework.
• Open Charge Map (UK) — provides EV charging station locations and details. Station additions you submit are propagated to Open Charge Map and cannot be retracted from there later (see Retention). Transfer mechanism: UK adequacy (for EU data subjects).
• State government fuel-price APIs (NSW FuelCheck, QLD Fuel Price Reporting, WA FuelWatch) — supply live fuel prices. We send no user data; only bulk data is imported.
• CarsXE (USA) — provides vehicle specification lookups. We send make, model, and year; no account data. Transfer mechanism: SCCs.

Optional future integrations (Tesla, Tessie) are listed here for transparency. They are not active at the time of writing and will only receive data if you explicitly connect your account.

Copies of the contractual safeguards for any of the transfers above are available on request to privacy@realrange.com.

Do not sell or share (CPRA)

We do not sell personal information, and we do not share personal information for cross-context behavioural advertising, as those terms are defined under the California Privacy Rights Act. Because we do not sell or share, the "Do Not Sell or Share My Personal Information" right does not result in any change in how we handle your data — the answer is already no.

Automated decision-making

We do not use automated decision-making that produces legal or similarly significant effects concerning you. Range estimates and routing recommendations are informational outputs of the service, not decisions about you or your rights.

Cookies and analytics

We use the cookies listed below. You will see a consent banner on first visit asking whether to allow the analytics cookies; essential cookies are set without a prompt because the service cannot function without them. You can change your choice at any time via the "Cookie preferences" link in the footer.

We honour the Global Privacy Control (GPC) signal. If your browser transmits GPC, analytics cookies will not be set and the consent banner is treated as declined regardless of anything else.

Beyond our own banner, you can also opt out of Google Analytics by installing Google's official opt-out browser add-on, or by clearing the rr_consent cookie and choosing "Reject" when the banner reappears.

International data transfers

Several of our service providers are based outside Australia and the European Economic Area. For each transfer we rely on the specific safeguard identified in the "Who we share data with" list above — typically Standard Contractual Clauses, the EU-US Data Privacy Framework (for Google), or UK adequacy (for the United Kingdom). Copies of the safeguards applicable to a specific transfer are available on request to privacy@realrange.com.

For Australian residents, we take reasonable steps under Australian Privacy Principle 8 to ensure that overseas recipients of your personal information do not breach the APPs. By providing us personal information you also consent to these overseas transfers within the meaning of APP 8.2(b).

How long we keep data and what happens when you delete your account

• Personal account data (email, name, profile image, preferences, age confirmation, consent record) is retained for as long as your account is active. When you delete your account, this data is erased.
• Vehicle records (make, model, variant, spec data, calibration) are retained even after you delete your account. Vehicle records are shared reference data used to improve range estimates for other owners of the same vehicle; they are independent of your user account and do not identify you.
• Your station reviews, photos, votes, price observations, and station status reports are erased when you delete your account.
• Stations you add to the map may be propagated to Open Charge Map before you delete your account. We cannot retract those submissions from Open Charge Map after the fact. The copy held on RealRange will be erased; the copy on Open Charge Map will remain subject to their policies.
• Routine hosting logs (HTTP access logs, error logs) are kept for a short period — typically up to 30 days — for operational purposes.

Your rights

You have the following rights over the personal data we hold about you. We extend each of these rights to all users, regardless of which country you are in:

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct inaccurate or incomplete data.
• Erasure — ask us to delete your account and associated personal data (subject to the vehicle-record and Open Charge Map caveats above).
• Restriction — ask us to limit how we use your data while a concern is being resolved.
• Portability — request an export of your data in a common machine-readable format.
• Objection — object to processing based on legitimate interest, including any profiling.
• Withdraw consent — for any processing based on your consent (for example, analytics cookies or optional integrations). Withdrawing consent does not affect processing that took place before you withdrew it.
• Lodge a complaint — with your local data protection authority. In Australia, that's the Office of the Australian Information Commissioner (OAIC); in the UK, the Information Commissioner's Office (ICO); in the EU, your member-state supervisory authority.

To exercise any of these rights, email privacy@realrange.com. We will respond within 30 days. We may ask you to verify your identity before acting on the request.

Universal opt-out signals

We honour the Global Privacy Control (GPC) signal as a request to opt out of analytics and any future sharing of personal information. When GPC is detected we do not set analytics cookies regardless of any banner choice. You do not need to contact us separately if your browser transmits GPC.

Children

The minimum age to use RealRange depends on where you live. Users in regions that have a statutory minimum age for online-service accounts (for example, the United States under COPPA and the United Kingdom) must confirm they are at least 13 years old when they first sign in. Users in regions without such a requirement (including Australia) are not asked for age confirmation.

The service has no social features, no user-to-user messaging, and no content that would be inappropriate for minors. If you believe a child has created an account incorrectly, or you are a parent or guardian and wish to review or delete data associated with your child's account, email privacy@realrange.com.

Anonymity and pseudonymity (Australia)

Under Australian Privacy Principle 2 you may, where practicable, interact with us anonymously or under a pseudonym. For account-based features of RealRange this is not practicable because we need to associate your vehicles, trips, and calibration records with you in order to provide the service. General browsing of the public parts of the site (for example, reading this policy) can be done without identifying yourself.

Direct marketing

We do not currently send marketing communications. If we begin to, we will obtain separate consent from you and include a clear unsubscribe mechanism in every message, consistent with Australian Privacy Principle 7 and the Australian Spam Act.

Data breach notification

If we become aware of an eligible data breach affecting your personal information we will notify you and the Office of the Australian Information Commissioner in accordance with the Notifiable Data Breaches scheme under the Privacy Act 1988. For users in the EU and UK we will meet the notification timelines in GDPR Articles 33 and 34 (supervisory authority within 72 hours; affected individuals without undue delay where the breach is likely to result in high risk).

Security

We protect your data with industry-standard measures: HTTPS everywhere, encrypted storage at our database provider, restricted access to production systems, and keyed API access to third-party services. No system is perfectly secure. If you suspect an account compromise, email privacy@realrange.com immediately.

Changes to this policy

When we make material changes to this policy we'll update the "Last updated" date at the top of the page and, where the change materially affects how your data is handled, notify affected users by email.

Contact

Questions, requests, or complaints about this policy can be sent to:

privacy@realrange.com

eu-privacy@realrange.com (for EU and UK data subjects)