Privacy Policy

Last Updated: 2026-07-17

ChargeHive EV ("ChargeHive EV", "ChargeHive", "we", "us", "our") is an electric-vehicle technology ecosystem operated by Lotus Scientific Solutions (also operating under the LotusFlowAI brand).

This Privacy Policy is issued in compliance with the Digital Personal Data Protection Act, 2023 (the "DPDP Act"); the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (the "SPDI Rules"); the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 (the "IT Rules 2021"); the Consumer Protection Act, 2019 and the Consumer Protection (E-Commerce) Rules, 2020; and applicable Indian tax law. It also serves as the privacy notice required under Section 5 of the DPDP Act.

For the purposes of the DPDP Act, Lotus Scientific Solutions is the Data Fiduciary that determines the purpose and means of processing your personal data.

1. Scope of This Privacy Policy

This Privacy Policy applies to every ChargeHive EV product and service, including:

• The ChargeHive EV mobile and web app — peer-to-peer charging, Emergency Roadside Assistance ("ERA"), subscriptions, the social-club gateway, and dealership plan activation
• The invite-only ChargeHive EV Social Platform
• The ChargeHive EV Dealership Suite and partner dealership enrollment, including details collected at a showroom
• The ChargeHive EV Sales Representative and Distributor apps
• The ChargeHive EV administrative consoles (God Admin, Super Admin, Admin)
• The ChargeHive EV websites, notifications, and support channels

By accessing or using ChargeHive EV, you agree to the collection and use of information in accordance with this Privacy Policy. Where the law requires consent, we ask for it separately and explicitly.

2. Definitions

• Personal Data — any data about an individual who is identifiable by or in relation to such data
• Data Principal — the individual the data relates to (you). For a child under 18, it includes the parent or lawful guardian
• Data Fiduciary — the person who determines the purpose and means of processing (us)
• Data Processor — a person who processes data on our behalf, such as our cloud and payment providers
• SPDI — Sensitive Personal Data or Information, including passwords and financial information such as payment-instrument details
• ERA Vendor / Technician — an independent third-party roadside-assistance provider and its assigned technician

3. Nature of Our Platform (Important)

ChargeHive EV is:

• A host-to-guest discovery and connection platform for EV charging
• A facilitator that routes Emergency Roadside Assistance requests to independent third-party vendors
• An invite-only social platform that acts as an intermediary hosting member content
• A subscription-based service (for access to platform features)
• Not an EV charging service provider, and not an electricity supplier
• Not a payment processor for host-guest charging sessions
• Not the provider of the physical roadside service

4. How Our Services Work (Data-Flow Context)

4.1 Peer-to-peer charging

Hosts list private or home charging points; Guests discover, book, and use them; Master users do both. We provide discovery, listings, booking coordination, messaging, ratings, and safety tooling.

4.2 Emergency Roadside Assistance (ERA)

When you request roadside help, we capture your precise location, contact details, and a description of the issue, and route the request to an independent third-party roadside vendor and its assigned technician, who perform the physical service. Pricing (base fee, GST, service charge, optional tip) is shown before you confirm.

4.3 Invite-only Social Platform

Access requires an approved invitation or eligibility (an active Master Control subscription, an active dealership plan, or an invited influencer or business account). Members share posts and short video, message each other, discover nearby members (including via Bluetooth, NFC, and location), apply to jobs, run or apply to sponsored content and ads, and purchase verified badges.

4.4 Dealerships

Partner dealerships enroll EV buyers, record contact, address and vehicle details, issue a GST invoice, and publish a limited activation directory record. You later redeem the plan in the app using the email you gave at purchase.

4.5 Sales, distribution and administration

Our sales representatives, distributors, and administrators operate the ecosystem under a strict role hierarchy (super admin, admin, sales rep / distributor, customer). Each staff account can access data only to the extent its role permits.

5. Personal Data We Collect and Why We Collect It

For each category below: what we collect, why we use it, and the legal basis under the DPDP Act — either your consent, or a legitimate use permitted by Section 7 such as the specified purpose for which you voluntarily provided data, performing our contract with you, responding to an emergency, or complying with law.

5.1 Account, identity and authentication

• Name — create and identify your account; show booking and roadside participants who they are dealing with. Basis: consent / contract
• Email address — authenticate you; send service and transactional notices; handle support, privacy, and grievance requests; invite-only social gating. Basis: consent / contract / legal
• Mobile phone numbers, including an optional secondary number — verify identity; enable host-guest and technician-customer coordination; safety follow-up. Basis: consent / contract
• Password — secure sign-in. Stored only in hashed or encrypted form by our authentication provider, never visible to us in plain text. Basis: contract / legal
• Third-party sign-in identifiers (Google Sign-In, Meta/Facebook Login) — let you sign in with those providers; we receive basic profile data per your provider settings. Basis: consent
• User role and tier (Guest, Host, Master, dealership member, staff) — provision the correct features and permissions. Basis: contract
• Consent records — the checkboxes you accepted, policy versions, timestamp, device, country, and auth provider, to prove and honour your consent. Basis: legal / consent

5.2 Profile, vehicle and host/charger information

• Profile photo (optional) — help users recognise each other. Basis: consent
• City, district and State — localise discovery, roadside routing, and content. Basis: consent / contract
• Vehicle information (type, make, model, year, connector type, battery size) — match compatible chargers; personalise ERA; dealership records. Basis: consent / contract
• Vehicle registration number (optional) — help a host or technician identify your arriving or stranded vehicle when you choose to provide it. Basis: consent
• Charger listing data (map location, availability, power rating, connector type, pricing, photos, pause/active status) — publish and operate your host listing. Basis: consent / contract
• Home or charger address — show location for discovery, booking, and navigation after the host consents to share it. Basis: consent
• Optional host payment handle (UPI ID) — shown to a guest only if you choose to share it, so they can pay you directly. We do not initiate or verify the payment. Basis: consent

5.3 Location data

• Approximate (city-level) location — show nearby chargers and relevant content. Basis: consent
• Precise GPS location (latitude/longitude and a reverse-geocoded address), captured when you request roadside assistance or pin your vehicle on the map — locate your stranded vehicle and route the vendor to you accurately. Basis: consent, feature-triggered
• Nearby-discovery signals on the Social Platform (location and, where enabled, Bluetooth/NFC proximity) — discover members you choose to be discoverable to. Basis: consent, opt-in

Location is requested only when a feature needs it, with an on-screen explanation, and you can revoke the permission at any time in your device settings.

5.4 Bookings, sessions, roadside orders and reviews

• Charging bookings and sessions — operate the booking lifecycle and your history. Basis: contract
• ERA orders — service selected, vendor, precise location and address, contact name and phone numbers, issue notes, optional tip, assigned technician name and phone, ETA, order status, and cancellation or completion notes, to place, track, fulfil, invoice, and support your request. Basis: consent / contract / legal (tax)
• Ratings and reviews — maintain trust, charger quality signals, and community accountability. Basis: consent / legitimate use
• Reported issues and feedback — investigate problems, safety, and abuse. Basis: legitimate use / legal

5.5 Social Platform data

• Profile and handle — operate your profile and the invite-only gate. Basis: consent / contract
• Posts and media (images, videos, short text posts, captions, voice-overs) — publish and display the content you create. Basis: consent
• Interactions (likes, comments, views, follows, friend requests) — operate the social graph. Basis: consent / contract
• Direct messages — deliver private messaging between members. Basis: consent / contract
• Discovery records — power nearby discovery you opt into. Basis: consent
• Jobs and applications, including uploaded résumés — operate the jobs feature. Basis: consent
• Ads and sponsored content — operate advertising and measure delivery. Basis: consent / contract
• Badge subscriptions — provide and display verification badges. Basis: contract
• Reports and moderation data — keep the community safe and comply with IT Rules 2021 intermediary due-diligence obligations. Basis: legal / legitimate use

5.6 Payments, subscriptions and tax data

• Subscription details (plan, billing cycle, start/expiry, status) — provide and manage paid access and renewals. Basis: contract
• Payment confirmation data from Stripe, Razorpay, Google Play Billing, or the Apple App Store — confirm payments, activate plans, prevent fraud, support refunds. Basis: contract / legal
• Dealership plan and invoice data — activate and evidence a dealership-purchased plan. Basis: contract / legal (tax)
• ERA pricing and GST (base price, GST, service charge, service GST, tip, total payable) — charge, invoice, and account for roadside orders under GST law. Basis: contract / legal (tax)
• Financial information (SPDI) such as a shared UPI ID and payment metadata — enable payment, with heightened safeguards. Basis: consent / contract

5.7 Device, technical, usage and diagnostic data

• Device information (model, OS and version, app version) — deliver a compatible experience, protect accounts, diagnose issues. Basis: legitimate use
• Log and usage data (IP address, access date and time, screens visited, features used, referral codes) — security, fraud prevention, analytics, and product improvement. Basis: legitimate use / consent
• Crash and error diagnostics (Firebase Crashlytics) — detect and fix crashes. Basis: legitimate use
• Analytics events (Firebase / Google Analytics), where enabled — understand usage and improve the Services. Basis: consent where required
• Cookies and local storage — keep you signed in, remember preferences, secure sessions; optional analytics and marketing. Basis: consent / legitimate use

6. Information We Do NOT Collect

Unless you explicitly and separately consent, or the law later requires it, we do not collect:

• Full credit or debit card numbers, or CVV
• Net-banking credentials
• Biometric data
• Caste, religion, or political opinions
• Government identity numbers such as Aadhaar or PAN — except where a specific verification, KYC, tax, or legal requirement applies and is disclosed to you at the point of collection

7. How We Use Your Information

• Create, secure, operate, and support your account and profile
• Provide the core Services — charger discovery and booking, host listings, ERA, the social platform, subscriptions, and dealership activation
• Route emergency roadside requests to vendors and technicians and enable their fulfilment
• Enable communication between users, hosts, guests, technicians, dealerships, and support
• Process subscriptions, payments, invoices, and GST, and prevent fraud, abuse, and security incidents
• Operate the invite-only social platform, including content display, discovery, jobs, ads, badges, moderation, and grievance handling under the IT Rules 2021
• Personalise content, discovery, and recommendations, and — only with your consent — show relevant advertising and partner or dealership offers
• Maintain trust and safety through ratings, reporting, moderation, and abuse prevention
• Analyse and improve performance, reliability, and features, using anonymised or aggregated data where possible
• Comply with law, tax, regulatory, and court or government requirements, and enforce our Terms
• Send you service notices, and — only if you opt in — marketing communications

We do not sell your personal data, and we will not use it for a new, incompatible purpose without informing you and, where required, obtaining fresh consent.

8. Legal Bases for Processing (DPDP Act)

• Consent (Section 6) — for most processing of the data you provide, given by a clear affirmative action such as the consent checkboxes at sign-up, at dealership activation, or in the Privacy Center. Consent is specific, informed, unconditional, and unambiguous, and limited to the data necessary for the stated purpose.
• Certain legitimate uses (Section 7) — including the specified purpose for which you voluntarily provided data and did not object; performance of our contract with you; responding to an emergency threatening life or safety (relevant to ERA); and compliance with law and court orders.

Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing before withdrawal, and some processing may continue where another legal basis applies, such as completing a transaction, tax records, or fraud prevention.

9. Sensitive Personal Data (SPDI Rules)

Financial information such as a shared UPI ID and payment metadata is treated as Sensitive Personal Data or Information. We collect SPDI only with your consent for a lawful, connected purpose, apply reasonable security practices, and share it only as described in this Policy. You may withdraw consent, in which case we may be unable to provide the related feature.

10. Children

ChargeHive EV is intended for users aged 18 and above. We do not knowingly create accounts for, or knowingly process the personal data of, children under 18. Consistent with the DPDP Act, we will not process a child's personal data in a manner likely to cause detriment, and we will not undertake tracking, behavioural monitoring, or targeted advertising directed at children. If we learn we have collected a child's data without verifiable consent of a parent or lawful guardian, we will delete it promptly.

11. Data Sharing and Disclosure

We do not sell your personal data. We share it only in the following cases:

11.1 With other users

• Host and Guest — profile name, ratings and reviews, charger listing details, pricing and availability, and any contact or payment handle the host chooses to share, only as needed to coordinate a booking
• Social Platform — your profile and content are visible to other members per the platform's visibility model; direct messages are visible to conversation participants; discovery data is shared with members you choose to be discoverable to

11.2 With ERA vendors and technicians

To fulfil a roadside request we share your name, phone numbers, precise location and address, vehicle details, and issue notes with the assigned third-party roadside vendor and technician. They use this data as independent service providers to reach and assist you.

11.3 With partner dealerships

Where you are a dealership-enrolled customer, relevant enrollment, plan, activation, and (if you request it) social-access data may be shared between ChargeHive and the enrolling dealership to service your plan and honour benefits.

11.4 With our staff, sales reps and distributors

Authorised personnel access personal data strictly on a need-to-know basis under a role-based access model, to operate, support, and administer the Services.

11.5 Legal, safety and business transfers

• We may disclose personal data where required by Indian law, a valid legal or regulatory request, a court order, or a government or law-enforcement authority; to enforce our Terms; to prevent fraud, security incidents, or harm; or to protect the rights, property, or safety of users, the public, or the Company
• If we are involved in a merger, acquisition, financing, reorganisation, or sale of assets, personal data may be transferred as part of that transaction, subject to this Policy and applicable law

12. Third-Party Services and Sub-Processors

The Services are built on the following platforms, which may process personal data as our Data Processors or, for their own purposes, as independent Data Fiduciaries under their own privacy policies:

• Google Firebase (Authentication, Cloud Firestore, Cloud Storage, Analytics, Crashlytics, Cloud Messaging, Hosting) — core cloud backend, auth, database, file storage, analytics, crash reporting, push notifications
• Google Sign-In, Google Maps and Geocoding — social sign-in; maps, location display, and reverse-geocoding
• Meta (Facebook) Login SDK — optional social sign-in
• Stripe — subscription and payment processing
• Razorpay — payment processing for the Social Platform and applicable Indian payments
• Google Play Billing / Apple App Store — in-app subscription purchases
• Supabase — backend for the Sales Rep and Distributor apps
• Expo / EAS — mobile app build and push-notification delivery
• Vercel and equivalent web hosts — web hosting and delivery

We may add or change sub-processors as the Services evolve and will keep this Policy updated. We require sub-processors to protect personal data to standards consistent with this Policy and Indian law.

13. Cross-Border Data Transfers

Our providers may store or process personal data on servers located outside India. Where personal data is transferred outside India, we do so in accordance with the DPDP Act, including any restrictions the Central Government may notify on transfers to specified countries, and we require appropriate contractual and security safeguards.

14. Consent and How to Withdraw It

• Giving consent — through clear affirmative actions: accepting the consent checkboxes at sign-up, at dealership activation, or in the Privacy Center; enabling a permission; or opting in to marketing
• Granularity — required consents (privacy policy, terms, core data processing) are separate from optional consents (marketing updates, partner and dealership offers, personalised ads). You can decline the optional ones and still use the core Services
• Withdrawing consent — at any time from the in-app Privacy Center, by changing device permissions or marketing preferences, or by emailing the Grievance Officer. Withdrawal is as easy as giving consent
• Consent Managers — where a registered Consent Manager mechanism becomes available under the DPDP Act, you will be able to give, manage, and withdraw consent through it

15. Your Rights as a Data Principal

Subject to the DPDP Act and applicable law, you have the right to:

• Access — obtain a summary of the personal data we process about you and the processing activities
• Correction and updating — correct inaccurate or misleading data and complete incomplete data
• Erasure — request deletion where the data is no longer necessary or where you withdraw consent, subject to legal retention
• Grievance redressal — raise grievances with us
• Nominate — nominate another individual to exercise your rights in the event of your death or incapacity
• Withdraw consent — at any time
• Opt out of marketing — without affecting the core Services

The in-app Privacy Center lets you view your data, export a copy of your account data, update marketing preferences, submit access, correction, deletion, and withdrawal requests, and permanently delete your account after password re-authentication and final confirmation. You may also exercise any right by contacting the Grievance Officer. We respond to verified requests within the timeframes required by law, and may need to verify your identity first.

16. App Permissions

Permissions are requested inside the feature that needs them, with an explanation shown first:

• Location — find nearby chargers, improve booking accuracy, and locate your vehicle for emergency roadside support
• Camera (optional) — charger photos, profile pictures, and issue reports
• Photos / Media Library (optional) — pick existing images for listings, profile pictures, and issue reports
• Notifications (optional) — booking updates, roadside status, and important alerts

You can control or revoke permissions at any time through your device settings.

17. Cookies and Local Storage

We use essential storage (authentication state, security tokens, theme, consent status, app reliability), analytics and diagnostics where enabled, and — only if you opt in — marketing and personalisation storage. You can clear cookies or app storage, reset advertising identifiers, revoke permissions, or withdraw consent at any time. Disabling essential storage may stop parts of the Services from working.

18. Data Retention

• Active account, profile and service data — retained while your account is active and needed to provide the Services
• Deleted-account data — queued for purge after deletion, except records retained for legal, tax, fraud-prevention, dispute, or audit purposes
• Consent and deletion audit logs — retained as immutable compliance evidence for the period required by law or legitimate audit need
• Transaction, invoice and GST records — retained for the period required under Indian tax and financial law
• Crash, security and operational logs — retained only as long as needed for reliability, fraud prevention, and security
• Marketing preferences — retained until you change them, withdraw consent, or delete your account
• Social Platform content — retained while published; removed content and moderation records retained as needed for safety and legal compliance

When retention ends, we delete or irreversibly anonymise the data.

19. Data Storage & Security

We implement reasonable security practices and procedures proportionate to the sensitivity of the data, consistent with the SPDI Rules and the DPDP Act, including:

• Encryption in transit, and at rest where supported by our providers
• Passwords stored only in hashed or encrypted form via our authentication provider
• Role-based access control and least-privilege access for staff, sales reps, distributors, and administrators, enforced by a server-side role directory and security rules
• Server-side security rules restricting which data each account can read or write
• Restricting card and bank data to PCI-DSS-compliant / RBI-authorised payment processors
• Monitoring, logging, and regular security updates

20. Personal Data Breach

In the event of a personal data breach, we will take remedial action and notify the Data Protection Board of India and affected Data Principals in the manner and within the timelines required by the DPDP Act and applicable rules.

21. Advertising, Personalisation and Automated Processing

• Marketing and partner offers are optional and sent only if you opt in; change this anytime in Profile, Settings, or Privacy Center
• We may use your activity and preferences to personalise content, discovery, and ads. This automated processing supports features such as nearby discovery, charger matching, and relevant offers; it does not produce legal or similarly significant decisions about you without a lawful basis
• We do not carry out behavioural tracking or targeted advertising directed at children

22. Third-Party Links & Services

The Services may link to or integrate with third-party websites, apps, or services, including payment providers, maps, dealerships, and advertisers. We are not responsible for their privacy practices. Please review their policies before providing data to them.

23. Platform Role Disclaimer

ChargeHive EV:

• Does not own or operate chargers
• Does not provide EV charging services or supply electricity
• Does not guarantee availability, safety, or performance
• Does not process host-guest charging payments
• Facilitates ERA requests routed to independent vendors, who provide the physical service
• Acts as an intermediary hosting user content on the Social Platform

These disclaimers do not diminish our commitment to handling your personal data responsibly under this Policy.

24. Changes to This Privacy Policy

• We may update this Privacy Policy to reflect changes in the Services, technology, or law.
• We will post the updated Policy with a new "Last Updated" date.
• For material changes we provide additional notice and, where required, seek fresh consent — material changes re-trigger the in-app consent gate so you see and accept the current version before continuing.

25. Grievance Officer & Contact Information

For any question, request, or complaint about your personal data or this Policy, contact our Grievance Officer. This also serves as the grievance mechanism required under the DPDP Act and, for the Social Platform, under the IT Rules 2021. The Grievance Officer handles data access, correction, erasure, and withdrawal requests; privacy complaints; content grievances; and nomination requests.

We acknowledge grievances promptly and resolve them within the timelines required by applicable law. If you are not satisfied, you may escalate to the Data Protection Board of India under the DPDP Act.

This Privacy Policy should be read together with the ChargeHive EV Terms and Conditions, Cancellation and Refund Policy, and Shipping and Delivery Policy.