Privacy Policy

1. Data We Collect

Account data: your email address and a password hash — never your plaintext password. Passwords are hashed with salted PBKDF2-HMAC-SHA256 (210,000 iterations, current OWASP-recommended minimum) before they're ever written to storage; if you sign in with Google instead, we store your Google account's email and its unique ID, not a password.

Gateway & telemetry data: your gateway's claim token and identifiers, and the battery telemetry it reports (voltage, current, state of charge, temperature, and per-cell voltages) — all read-only data your BMS already broadcasts (see the Terms of Service's Read-Only Device Access section).

Sign-in & security data: each time you sign in, we record the IP address, an approximate location derived from it (city/region/country), your browser/device information, and the sign-in method used (password, Google, or emailed one-time code). This is used for account security and is shown back to you on your own Account page as your recent sign-in history, so you can spot and revoke access from a device or location you don't recognize.

Website analytics: standard usage analytics via the tag described in Section 4 — only loaded after you accept the cookie banner shown on your first visit; declining means it never loads.

2. Payment & Billing Data

Every payment — the one-time gateway license and Cloud Service subscriptions — is processed by Polar.sh on their own hosted checkout page. Your card number, expiry date, and CVV are entered directly into Polar's systems; they are never transmitted to, processed by, or stored on JKBMSR's servers. We have no access to your full card details at any point.

What we do receive from Polar and store, once a payment or subscription event is confirmed:

• The order or subscription ID, and which gateway (if any) it's tied to
• The billing name and email address you checked out with
• Which product and price tier was purchased, plus the amount and currency charged
• Its current status (paid, refunded, active, canceled, etc.) and, for subscriptions, the current billing period's end date
• A copy of the underlying webhook event Polar sent us confirming the transaction, kept for audit and support purposes

This billing data is used only to unlock the gateway license or Cloud Service tier you paid for, to show your own purchase history back to you, and to handle support or refund requests. It is never sold or shared with third parties for marketing.

3. Facebook Page & Messenger

If you message the JKBMSR Facebook Page, we store your Page-Scoped ID, your name (when Facebook provides it), and the conversation text, so we can view and reply. See Data Deletion Instructions for how to have this removed.

4. Analytics Tag

This website uses Google Analytics through tag ID G-N0SRWGZ7YJ to understand public web traffic and improve performance. It is not loaded until you accept the cookie banner shown on your first visit — declining, or not responding, means it never runs. You can change your choice at any time by clearing your browser's stored site data for jkbmsr.com, which brings the banner back.

5. Data Retention

Raw telemetry readings are kept for 7 days. Beyond that, an hourly summary (min/max/average per hour) is kept for 180 days for long-range trend charts and the Cloud Service history/export feature — the raw, second-by-second readings themselves are not retained past 7 days. OTA update history is kept for 90 days. Account, billing, and gateway records are kept for as long as your account exists, or as required to resolve an active support or refund request.

6. Data Security & Storage

Telemetry data is transmitted securely over TLS. Gateway tokens and claim codes are cryptographically generated and, like passwords, are never stored in plaintext. Everything is hosted on Cloudflare infrastructure (Workers, D1, R2) rather than a self-managed server.

7. Your Data & Account Deletion

You can delete your account at any time from your account settings (password or email confirmation required). This signs you out everywhere immediately and blocks further sign-in. Every gateway you own, its telemetry and alert history, and your account itself are then permanently deleted after a 30-day retention window — kept that long in case the deletion wasn't intentional or a compliance review is needed, and held longer still if an order on the account has an unresolved payment dispute. Billing records tied to your license and subscription history are retained beyond that (as many jurisdictions require for tax and audit purposes) but stripped of your email and name so they no longer identify you. If you'd rather we handle a deletion or export request manually, or you only want a specific gateway removed rather than the whole account, reach out through the Contact page.

8. Your Rights Under GDPR & CCPA

If you're located in the European Economic Area, UK, or California, you have specific rights over your personal data in addition to the account deletion described above:

• Access & portability — request a copy of the personal data we hold about you, in a portable format.
• Rectification — correct inaccurate account data (most of this you can already edit directly from Account Settings).
• Erasure — request deletion of your account and associated data (also self-serve from Account Settings — see Section 7 above).
• Restriction & objection — ask us to limit certain processing, or object to it, where applicable.
• Do Not Sell or Share (California) — we do not sell or share your personal information with third parties for cross-context behavioral advertising. There is nothing to opt out of.

Our legal basis for processing account and telemetry data is performance of the contract you enter into by creating an account (GDPR Article 6(1)(b)); for website analytics, it's our legitimate interest in understanding site usage (Article 6(1)(f)), subject to the cookie consent described in Section 4.

To exercise any of these rights, contact us through the Contact page. We'll respond within 30 days.

9. Contact

Privacy inquiries can be submitted via the Contact Form.