Privacy Policy

ChargeHive EV ("ChargeHive EV", "ChargeHive", "we", "us", "our") is an electric-vehicle technology ecosystem operated by Lotus Scientific Solutions (also operating under the LotusFlowAI brand).

This Privacy Policy is issued in compliance with the Digital Personal Data Protection Act, 2023 ("DPDP Act"); the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules"); the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 ("IT Rules 2021"); the Consumer Protection Act, 2019 and the Consumer Protection (E-Commerce) Rules, 2020; and applicable Indian tax law. It also serves as the privacy notice required under Section 5 of the DPDP Act.

For the purposes of the DPDP Act, Lotus Scientific Solutions is the Data Fiduciary that determines the purpose and means of processing your personal data.

ONE POLICY FOR THE WHOLE ECOSYSTEM. This is the same document in every ChargeHive app — the ChargeHive EV app, the ChargeHive EV Social Club, and ChargeHive Fit — and on chargehiveev.com. They share one operator, one Data Fiduciary and one consent trail, so you should never have to read two versions to find out what happens to your data.

1. Scope of This Privacy Policy

This Policy applies to every ChargeHive EV product and service, including:

• The ChargeHive EV mobile and web app — peer-to-peer charging, Emergency Roadside Assistance ("ERA"), subscriptions, the social-club gateway, and dealership plan activation
• The invite-only ChargeHive EV Social Platform, delivered as the ChargeHive EV Social Club web and mobile apps
• ChargeHive Fit — the fitness, training and wellness app included with paid ChargeHive plans, also referred to as ChargeHive Fitness inside the ChargeHive EV app
• The ChargeHive EV Dealership Suite and partner dealership enrollment (including details collected at a showroom)
• The ChargeHive EV Sales Representative and Distributor apps
• The ChargeHive EV administrative consoles (God Admin, Super Admin, Admin)
• The ChargeHive EV website(s), notifications, and support channels

By accessing or using ChargeHive EV, you agree to the collection and use of information in accordance with this Policy. Where the law requires consent, we ask for it separately and explicitly.

2. Definitions

• Personal Data — any data about an individual who is identifiable by or in relation to such data
• Data Principal — the individual the data relates to (you). For a child (under 18), it includes the parent or lawful guardian
• Data Fiduciary — the person who determines the purpose and means of processing (us)
• Data Processor — a person who processes data on our behalf, such as our cloud and payment providers
• SPDI — Sensitive Personal Data or Information, including passwords and financial information such as payment-instrument details
• ERA Vendor / Technician — an independent third-party roadside-assistance provider and its assigned technician
• Health and Fitness Data — the data ChargeHive Fit records about your body and training: height, weight and target weight, body measurements, workout history and session feedback, food and water logs, health and injury preferences, and — only if you switch the feature on — menstrual cycle entries

3. Nature of Our Platform (Important)

ChargeHive EV is:

• A host-to-guest discovery and connection platform for EV charging
• A facilitator that routes Emergency Roadside Assistance requests to independent third-party vendors
• An invite-only social platform that acts as an intermediary hosting member content
• A subscription-based service (for access to platform features)
• A marketplace that lists goods and services offered by independent sellers, and — only for listings shown as ChargeHive Direct — the seller of those goods itself
• The publisher of ChargeHive Fit, a fitness and wellness app included with paid plans
• Not an EV charging service provider, and not an electricity supplier
• Not a payment processor for host-guest charging sessions
• Not the seller of goods or services listed by an independent seller, and not the courier, rider or delivery partner who brings them to you
• Not the provider of the physical roadside service
• Not a healthcare provider. ChargeHive Fit is a fitness and wellness tool, not a medical device: it does not diagnose, treat, cure, or prevent any condition, and nothing in it is medical advice. See Section 24

IMPORTANT: All charging transactions, pricing, payments, and agreements occur directly between hosts and guests. ChargeHive EV does not process, verify, or guarantee these payments.

The same separation applies in the marketplace and in roadside assistance. Independent sellers and roadside vendors set their own prices, raise their own invoices and collect their own money. ChargeHive charges you only for a paid plan and, on the free plan, a convenience fee for chargeable services — a fee you avoid entirely by holding a plan. What we charge a seller is a platform fee, billed to the seller and never added to your order.

4. How Our Services Work (Data-Flow Context)

4.1 Peer-to-peer charging

Hosts list private or home charging points; Guests discover, book, and use them; Master users do both. We provide discovery, listings, booking coordination, messaging, ratings, and safety tooling.

4.2 Emergency Roadside Assistance (ERA)

When you request roadside help, we capture your precise location, contact details, and a description of the issue, and route the request to an independent third-party roadside vendor and its assigned technician, who perform the physical service. Pricing (base fee, GST, service charge, optional tip) is shown before you confirm.

4.3 Invite-only Social Platform

Access requires an approved invitation or eligibility (an active ChargeHive Service Pass, an active ChargeHive Dealership Partner Pass, or an invited influencer or business account), and remains subject to internal review in every case. Members share posts and short video, message each other, discover nearby members (including via Bluetooth, NFC, and location), apply to jobs, run or apply to sponsored content and ads, and purchase verified badges.

4.4 Dealerships

Partner dealerships enroll EV buyers, record contact, address and vehicle details, issue a GST invoice, and publish a limited activation directory record. You later redeem the plan in the app using the email you gave at purchase.

4.5 ChargeHive Fit

ChargeHive Fit is a separate app on a separate infrastructure project, included with paid ChargeHive plans. It has no public sign-up: an account can be created there only after you enrol from inside the ChargeHive EV app, which writes an enrolment record containing the email address you confirm and the plan behind it.

Once you are in the app, the data flow is deliberately one-directional and mostly local. ChargeHive Fit READS your pass from your ChargeHive EV account so it can show you what you hold; it never writes to that account. Your training, body, nutrition and cycle data is stored ON YOUR DEVICE and is not uploaded. Signing in creates an account record — your email, display name, the policy versions you accepted, and the linked ChargeHive EV account id — and nothing from your logs travels with it.

4.6 Sales, distribution and administration

Our sales representatives, distributors, and administrators operate the ecosystem under a strict role hierarchy (super admin, admin, sales rep / distributor, customer). Each staff account can access data only to the extent its role permits.

Staff and partners are Data Principals too. If you use the ChargeHive EV Sales Representative app, the Distributor app, or the Dealership Suite, we process your work account and role, the customers, leads, orders and stock assigned to you, the visits and calls you log, the payments you collect, and your location while you are working — to run the operation, route work, and keep an auditable record of who did what. These accounts are created for you by an administrator; there is no public sign-up. Your rights under Section 15 apply to that data in the same way, subject to the records we are required to keep for tax and audit.

4.7 Marketplace

The marketplace lists goods and services from independent sellers, alongside a ChargeHive Direct catalogue that we sell ourselves. When you place an order we record what you ordered and the price, your delivery address and contact number, and we pass what the seller needs in order to fulfil it. Orders are Cash on Delivery: no card or bank details are taken by us at checkout.

An order is written to the marketplace infrastructure project, which is where the seller and their staff read it, and a copy is mirrored to your own account so your order history reads with your sign-in. Delivery may be performed by the seller, by an assigned distributor or sales representative, or by a rider or courier platform. Who fulfils your order, and how, is shown on the order itself.

5. Personal Data We Collect and Why We Collect It

For each category below: what we collect, why we use it, and the legal basis under the DPDP Act — either your consent, or a legitimate use permitted by Section 7 such as the specified purpose for which you voluntarily provided data, performing our contract with you, responding to an emergency, or complying with law.

5.1 Account, identity and authentication

• Name — create and identify your account; show booking and roadside participants who they are dealing with. Basis: consent / contract
• Email address — authenticate you; send service and transactional notices; handle support, privacy and grievance requests; invite-only social gating. Basis: consent / contract / legal
• Mobile phone numbers, including an optional secondary number — verify identity; enable host-guest and technician-customer coordination; safety follow-up. Basis: consent / contract
• Password — secure sign-in. Stored only in hashed or encrypted form by our authentication provider, never visible to us in plain text. Basis: contract / legal
• Third-party sign-in identifiers (Google Sign-In, Meta/Facebook Login) — let you sign in with those providers; we receive basic profile data per your provider settings. Basis: consent
• User role and tier (Guest, Host, Master, dealership member, staff) — provision the correct features and permissions. Basis: contract
• Consent records — the checkboxes you accepted, policy versions, timestamp, device, country, and auth provider, to prove and honour your consent. Basis: legal / consent

5.2 Profile, vehicle and host/charger information

• Profile photo (optional) — help users recognise each other. Basis: consent
• City, district and State — localise discovery, roadside routing, and content. Basis: consent / contract
• Vehicle information (type, make, model, year, connector type, battery size) — match compatible chargers; personalise ERA; dealership records. Basis: consent / contract
• Vehicle registration number (optional) — help a host or technician identify your arriving or stranded vehicle when you choose to provide it. Basis: consent
• Charger listing data (map location, availability, power rating, connector type, pricing, photos, pause/active status) — publish and operate your host listing. Basis: consent / contract
• Home or charger address — show location for discovery, booking, and navigation after the host consents to share it. Basis: consent
• Optional host payment handle (UPI ID) — shown to a guest only if you choose to share it, so they can pay you directly. We do not initiate or verify the payment. Basis: consent

5.3 Location data

• Approximate (city-level) location — show nearby chargers and relevant content. Basis: consent
• Precise GPS location (latitude/longitude and a reverse-geocoded address), captured when you request roadside assistance or pin your vehicle on the map — locate your stranded vehicle and route the vendor to you accurately. Basis: consent, feature-triggered
• Nearby-discovery signals on the Social Platform (location and, where enabled, Bluetooth/NFC proximity) — discover members you choose to be discoverable to. Basis: consent, opt-in

Location is requested only when a feature needs it, with an on-screen explanation, and you can revoke the permission at any time in your device settings.

5.4 Bookings, sessions, marketplace orders, roadside orders and reviews

• Charging bookings and sessions — operate the booking lifecycle and your history. Basis: contract
• ERA orders — service selected, vendor, precise location and address, contact name and phone numbers, issue notes, optional tip, assigned technician name and phone, ETA, order status, and cancellation or completion notes, to place, track, fulfil, invoice, and support your request. Basis: consent / contract / legal (tax)
• Marketplace orders — the items or services ordered, quantity and price, the delivery address and contact number you give at checkout, the seller and any assigned distributor or sales representative, the delivery mode and any rider or courier reference, order status, the tax invoice (including GST and HSN details), and — where an order is cancelled — who cancelled it, in what role, and why. Used to place, fulfil, track, invoice and support your order. Basis: contract / legal (tax)
• Ratings and reviews — maintain trust, charger quality signals, and community accountability. Basis: consent / legitimate use
• Reported issues and feedback — investigate problems, safety, and abuse. Basis: legitimate use / legal

5.5 Social Platform data

• Profile and handle — operate your profile and the invite-only gate. Basis: consent / contract
• Posts and media (images, videos, short text posts, captions, voice-overs) — publish and display the content you create. Basis: consent
• Interactions (likes, comments, views, follows, friend requests) — operate the social graph. Basis: consent / contract
• Direct messages — deliver private messaging between members. Basis: consent / contract
• Discovery records — power nearby discovery you opt into. Basis: consent
• Jobs and applications, including uploaded résumés — operate the jobs feature. Basis: consent
• Ads and sponsored content — operate advertising and measure delivery. Basis: consent / contract
• Badge subscriptions — provide and display verification badges. Basis: contract
• Reports and moderation data — keep the community safe and comply with IT Rules 2021 intermediary due-diligence obligations. Basis: legal / legitimate use

5.6 Payments, subscriptions and tax data

• Subscription details (plan, billing cycle, start/expiry, status) — provide and manage paid access and renewals. Basis: contract
• Payment confirmation data from Stripe, Razorpay, Google Play Billing, or the Apple App Store — confirm payments, activate plans, prevent fraud, support refunds. Basis: contract / legal
• Dealership plan and invoice data — activate and evidence a dealership-purchased plan. Basis: contract / legal (tax)
• ERA pricing and GST (base price, GST, service charge, service GST, tip, total payable) — charge, invoice, and account for roadside orders under GST law. Basis: contract / legal (tax)
• Convenience-fee ledger — on the free plan, chargeable use of a service (a charging booking, a roadside booking, a marketplace order, a host booking) accrues a convenience fee plus GST. We record the fee, the service it relates to, and whether it has been settled, waived or reversed, so the balance shown to you is auditable. Basis: contract / legitimate use
• Payment references — the order and payment identifiers our payment gateway returns when a payment succeeds, so we can match a payment to what it paid for and support refunds. We never receive or store the card number, CVV, UPI PIN or bank credentials behind them. Basis: contract / legal
• Financial information (SPDI) such as a shared UPI ID and payment metadata — enable payment, with heightened safeguards. Basis: consent / contract

IMPORTANT CLARIFICATION: We do not store your full card numbers, CVV, or bank credentials. Card and bank data are collected and processed directly by our PCI-DSS-compliant / RBI-authorised payment processors (Stripe, Razorpay) or by the app stores. Direct host-guest charging payments (cash or UPI) are settled between users and are not processed by us.

5.7 Device, technical, usage and diagnostic data

• Device information (model, OS and version, app version) — deliver a compatible experience, protect accounts, diagnose issues. Basis: legitimate use
• Log and usage data (IP address, access date and time, screens visited, features used, referral codes) — security, fraud prevention, analytics, and product improvement. Basis: legitimate use / consent
• Crash and error diagnostics (Firebase Crashlytics) — detect and fix crashes. Basis: legitimate use
• Analytics events (Firebase / Google Analytics), where enabled — understand usage and improve the Services. Basis: consent where required
• Cookies and local storage — keep you signed in, remember preferences, secure sessions; optional analytics and marketing. Basis: consent / legitimate use
• Public one-look share links, including links opened by people without an account — use an essential HttpOnly cookie, a random browser-storage visitor identifier, IP address, browser user-agent and language headers, and a coarse device signature built from screen dimensions and colour depth, time zone, platform, processor-core count, language, and touch capability. For the viewer lock we store separate salted hashes rather than the raw cookie identifier, visitor identifier, device signature, or IP address. These signals are used to enforce the promised per-recipient view limit, prevent clearing browser storage from resetting a spent view, bind protected media to its brief playback window, and prevent abuse. A viewer slot can be recognised by the cookie or visitor identifier, or by the device signature and IP address together; neither the device signature nor IP address is used alone to decide that a person has already viewed the link. Basis: legitimate use / security

5.8 ChargeHive Fit — fitness, body and health data

This is the most sensitive category we handle, so each row below also says WHERE THE DATA ACTUALLY IS — the part of a disclosure most notices leave out. "On your device" means it never leaves the phone. "Account record" means it is stored against your ChargeHive Fit account. "Read from ChargeHive EV" means it is read from your EV account and never written back. Everything here is entered by you, by hand — ChargeHive Fit reads no sensors, wearables, or third-party health platforms.

• Fitness goals and preferences — your goal, fitness level, available equipment, training days, session length and difficulty, which are what generate and re-generate your plan. Copied to your account once you sign in, so a new phone can rebuild your plan. Account record. Basis: consent / contract
• Height, weight and target weight — calculate calorie and macro targets (Mifflin-St Jeor) and chart progress against your goal. On your device. Basis: consent
• Body measurements and body-fat percentage — waist, hip, chest, neck, arm and thigh entries you choose to log, shown back to you as progress over time. Never used for anything else. On your device. Basis: consent
• Workout history and session feedback — completed sessions, exercises, sets, and how hard each felt. This is what makes the next plan harder or easier. On your device. Basis: consent
• Food, water and nutrition logs — what you log to eat and drink, measured against the targets calculated for your goal. On your device. Basis: consent
• Menstrual cycle entries — period dates, predictions, flow, symptoms, mood, pain and energy, recorded ONLY IF YOU TURN CYCLE TRACKING ON. It defaults on for someone who answered "female" during onboarding and off for everyone else, and the Profile toggle overrides that default in either direction at any time. Never shared, never aggregated, never used for advertising or profiling. On your device. Basis: explicit consent, opt-in
• Health and injury preferences — body areas to train around and exercises you have excluded. Recorded as a preference, never as a diagnosis. On your device. Basis: consent
• Date of birth and gender — age drives the calorie calculation; gender sets the default demonstration videos and the cycle-tracking default. Both are skippable. Copied to your account once you sign in. Account record. Basis: consent
• Account record — if you link a ChargeHive account: your email, display name, the policy versions you accepted, and the linked ChargeHive EV account id. Nothing from the rows above is uploaded with it. Account record. Basis: contract / legal
• Consent records — the consents you accepted, the policy versions and the timestamp, kept as immutable evidence so your choices can be proved and honoured under the DPDP Act. Account record. Basis: legal / consent
• ChargeHive pass — read from your ChargeHive EV account so the app can show the pass you hold: plan, term, expiry and the invoice for it. Read-only; ChargeHive Fit never writes to your EV account. Read from ChargeHive EV. Basis: contract

WHAT THIS MEANS IN PRACTICE: Nothing marked "on your device" is uploaded, shared, sold, or used for advertising — including your cycle entries — and signing in does not change that. Because there is no server copy, deleting that data in the app deletes it outright: there is nothing left to outlive the deletion, and nothing for us to restore if you change your mind.

6. Information We Do NOT Collect

Unless you explicitly and separately consent, or the law later requires it, we do not collect:

• Full credit or debit card numbers, or CVV
• Net-banking credentials
• Biometric data
• Health data from device sensors, wearables, or third-party health platforms such as Apple Health or Google Fit — ChargeHive Fit records only what you enter by hand
• Caste, religion, or political opinions
• Government identity numbers such as Aadhaar or PAN — except where a specific verification, KYC, tax, or legal requirement applies and is disclosed to you at the point of collection

7. How We Use Your Information

We use your information to:

• Create, secure, operate, and support your account and profile
• Provide the core Services — charger discovery and booking, host listings, ERA, the social platform, ChargeHive Fit, subscriptions, and dealership activation
• Route emergency roadside requests to vendors and technicians and enable their fulfilment
• Enable communication between users, hosts, guests, technicians, dealerships, and support
• Process subscriptions, payments, invoices, and GST, and prevent fraud, abuse, and security incidents
• Operate the invite-only social platform, including content display, discovery, jobs, ads, badges, moderation, and grievance handling under the IT Rules 2021
• Generate and adapt your ChargeHive Fit training plan and calculate your calorie and macro targets, on your device, from the details you enter
• Personalise content, discovery, and recommendations, and — only with your consent — show relevant advertising and partner or dealership offers
• Maintain trust and safety through ratings, reporting, moderation, and abuse prevention
• Analyse and improve performance, reliability, and features, using anonymised or aggregated data where possible
• Comply with law, tax, regulatory, and court or government requirements, and enforce our Terms
• Send you service notices, and — only if you opt in — marketing communications

We do not sell your personal data, and we will not use it for a new, incompatible purpose without informing you and, where required, obtaining fresh consent.

8. Legal Bases for Processing (DPDP Act)

• Consent (Section 6) — for most processing of the data you provide, given by a clear affirmative action such as the consent checkboxes at sign-up, at dealership activation, or in the Privacy Center. Consent is specific, informed, unconditional, and unambiguous, and limited to the data necessary for the stated purpose
• Certain legitimate uses (Section 7) — including the specified purpose for which you voluntarily provided data and did not object; performance of our contract with you; responding to an emergency threatening life or safety (relevant to ERA); and compliance with law and court orders

Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing before withdrawal, and some processing may continue where another legal basis applies, such as completing a transaction, tax records, or fraud prevention.

9. Sensitive Personal Data (SPDI Rules)

Financial information such as a shared UPI ID and payment metadata is treated as Sensitive Personal Data or Information. We collect SPDI only with your consent for a lawful, connected purpose, apply reasonable security practices, and share it only as described in this Policy. You may withdraw consent, in which case we may be unable to provide the related feature.

HEALTH AND FITNESS DATA IS TREATED AS OUR MOST SENSITIVE CATEGORY, and menstrual cycle entries as the most sensitive within it. We apply the following commitments to all of it:

• It is collected only on separate, explicit consent, and cycle tracking additionally requires you to switch the feature on
• It is stored on your device and is not uploaded to us, so it is not shared with any user, vendor, dealership, advertiser, or sub-processor
• It is never used for advertising, personalisation, profiling, or any automated decision about you
• It is never sold, and it is not aggregated into any dataset we hold
• You can delete all of it, or any single category of it, from inside the app at any time, and that deletion is final because there is no server copy

10. Children

ChargeHive EV is intended for users aged 18 and above. We do not knowingly create accounts for, or knowingly process the personal data of, children under 18. Consistent with the DPDP Act, we will not process a child's personal data in a manner likely to cause detriment, and we will not undertake tracking, behavioural monitoring, or targeted advertising directed at children. If we learn we have collected a child's data without verifiable consent of a parent or lawful guardian, we will delete it promptly.

11. Data Sharing and Disclosure

We do not sell your personal data. We share it only in the following cases:

11.1 With other users

• Host and Guest — profile name, ratings and reviews, charger listing details, pricing and availability, and any contact or payment handle the host chooses to share, only as needed to coordinate a booking
• Social Platform — your profile and content are visible to other members per the platform's visibility model; direct messages are visible to conversation participants; discovery data is shared with members you choose to be discoverable to

Nothing from ChargeHive Fit is shared with another user. There is no social layer, no leaderboard and no sharing feature in that app.

11.2 With ERA vendors and technicians

To fulfil a roadside request we share your name, phone numbers, precise location and address, vehicle details, and issue notes with the assigned third-party roadside vendor and technician. They use this data as independent service providers to reach and assist you.

11.3 With partner dealerships

Where you are a dealership-enrolled customer, relevant enrollment, plan, activation, and (if you request it) social-access data may be shared between ChargeHive and the enrolling dealership to service your plan and honour benefits. Your Health and Fitness Data is never shared with a dealership — the only thing a dealership plan affects is whether you are eligible for ChargeHive Fit at all.

11.4 With our staff, sales reps and distributors

Authorised personnel access personal data strictly on a need-to-know basis under a role-based access model, to operate, support, and administer the Services.

11.5 With marketplace sellers, delivery partners and couriers

To fulfil a marketplace order we share your name, contact number, delivery address and what you ordered with the seller, and with the distributor or sales representative assigned to deliver it. Where the seller books a rider or courier, the address and contact number needed for the drop are shared with that platform, which handles them under its own privacy policy as an independent provider. Sellers receive what they need to deliver and support the order — not your charging history, your roadside history, your social profile or anything from ChargeHive Fit.

Where you choose to share your live location to help a delivery reach you, that share is time-limited and expires on its own.

11.6 Legal, safety and business transfers

• We may disclose personal data where required by Indian law, a valid legal or regulatory request, a court order, or a government or law-enforcement authority; to enforce our Terms; to prevent fraud, security incidents, or harm; or to protect the rights, property, or safety of users, the public, or the Company
• If we are involved in a merger, acquisition, financing, reorganisation, or sale of assets, personal data may be transferred as part of that transaction, subject to this Policy and applicable law

12. Third-Party Services and Sub-Processors

The Services are built on the following platforms, which may process personal data as our Data Processors or, for their own purposes, as independent Data Fiduciaries under their own privacy policies:

• Google Firebase (Authentication, Cloud Firestore, Cloud Storage, Analytics, Crashlytics, Cloud Messaging, Hosting) — core cloud backend, auth, database, file storage, analytics, crash reporting, push notifications
• Google Sign-In, Google Maps and Geocoding — social sign-in; maps, location display, and reverse-geocoding
• Meta (Facebook) Login SDK — optional social sign-in
• Stripe — subscription and payment processing
• Razorpay — payment processing for the Social Platform and applicable Indian payments
• Google Play Billing / Apple App Store — in-app subscription purchases
• Supabase — backend for the Sales Rep and Distributor apps
• Rider and courier platforms (such as Rapido, Ola and Porter) and courier services — last-mile delivery of marketplace orders, where the seller books one
• Expo / EAS — mobile app build and push-notification delivery
• Vercel and equivalent web hosts — web hosting and delivery

We may add or change sub-processors as the Services evolve and will keep this Policy updated. We require sub-processors to protect personal data to standards consistent with this Policy and Indian law.

Your Health and Fitness Data does not reach any sub-processor, because it is not uploaded.

13. Cross-Border Data Transfers

Our providers may store or process personal data on servers located outside India. Where personal data is transferred outside India, we do so in accordance with the DPDP Act, including any restrictions the Central Government may notify on transfers to specified countries, and we require appropriate contractual and security safeguards.

14. Consent and How to Withdraw It

• Giving consent — through clear affirmative actions: accepting the consent checkboxes at sign-up, at dealership activation, or in the Privacy Center; enabling a permission; or opting in to marketing
• Granularity — required consents (privacy policy, terms, core data processing) are separate from optional consents (marketing updates, partner and dealership offers, personalised ads). You can decline the optional ones and still use the core Services
• Withdrawing consent — at any time from the in-app Privacy Center, by changing device permissions or marketing preferences, or by emailing the Grievance Officer. Withdrawal is as easy as giving consent
• Consent Managers — where a registered Consent Manager mechanism becomes available under the DPDP Act, you will be able to give, manage, and withdraw consent through it

Each app carries its own Privacy Center, and consent given in one is recorded against that app. Accepting this Policy in the ChargeHive EV app does not assert consent on your behalf in ChargeHive Fit, and ChargeHive Fit never asserts EV consent on your behalf either.

15. Your Rights as a Data Principal

Subject to the DPDP Act and applicable law, you have the right to:

• Access — obtain a summary of the personal data we process about you and the processing activities
• Correction and updating — correct inaccurate or misleading data and complete incomplete data
• Erasure — request deletion where the data is no longer necessary or where you withdraw consent, subject to legal retention
• Grievance redressal — raise grievances with us
• Nominate — nominate another individual to exercise your rights in the event of your death or incapacity
• Withdraw consent — at any time
• Opt out of marketing — without affecting the core Services

The in-app Privacy Center lets you view your data, export a copy of your account data, update marketing preferences, submit access, correction, deletion, and withdrawal requests, and permanently delete your account after password re-authentication and final confirmation. You may also exercise any right by contacting the Grievance Officer. We respond to verified requests within the timeframes required by law, and may need to verify your identity first.

In ChargeHive Fit, access and export are immediate and do not involve us at all: the app builds a JSON copy of everything it holds and hands it to your device's share sheet, and deletion — whole or scoped to one category — takes effect on the device at once.

16. App Permissions

Permissions are requested inside the feature that needs them, with an explanation shown first:

• Location — find nearby chargers, improve booking accuracy, and locate your vehicle for emergency roadside support
• Camera (optional) — charger photos, profile pictures, and issue reports
• Photos / Media Library (optional) — pick existing images for listings, profile pictures, and issue reports
• Notifications (optional) — booking updates, roadside status, and important alerts

In ChargeHive Fit, the permissions are narrower:

• Notifications (optional) — workout and hydration reminders you schedule yourself. Off until you turn one on
• Background audio playback (optional) — keeps audio cues and rest timers running while the screen is off during a workout
• Local storage (required) — holds your profile, plan, and every log. This is where your fitness data lives

ChargeHive Fit does not request location, camera, microphone, contacts, or health-platform access. You can control or revoke permissions at any time through your device settings.

17. Cookies and Local Storage

We use essential storage (authentication state, security tokens, theme, consent status, app reliability), analytics and diagnostics where enabled, and — only if you opt in — marketing and personalisation storage. You can clear cookies or app storage, reset advertising identifiers, revoke permissions, or withdraw consent at any time. Disabling essential storage may stop parts of the Services from working.

On public one-look share links, the chv_v cookie is HttpOnly, Secure, limited to the /s path, and expires after 30 days. The chv.viewer identifier is kept in browser storage until you clear it. Clearing either or both does not necessarily reset a spent view, because the separately salted device-signature and IP-address hashes may still recognise the same viewer slot when they match together. The public share page links to this Policy before you choose to open the content.

18. Data Retention

• Active account, profile and service data — retained while your account is active and needed to provide the Services
• Deleted-account data — queued for purge after deletion, except records retained for legal, tax, fraud-prevention, dispute, or audit purposes
• Consent and deletion audit logs — retained as immutable compliance evidence for the period required by law or legitimate audit need
• Transaction, invoice and GST records — retained for the period required under Indian tax and financial law, which for GST and income-tax records runs to eight years from the end of the relevant financial year. This is why deleting your account does not erase an invoice you appear on, and why deletion in the Dealership Suite and the marketplace is raised as a request an administrator actions rather than an immediate erase
• Crash, security and operational logs — retained only as long as needed for reliability, fraud prevention, and security
• Marketing preferences — retained until you change them, withdraw consent, or delete your account
• Social Platform content — retained while published; removed content and moderation records retained as needed for safety and legal compliance
• One-look share-link viewer records — used for the link's 30-day active lifetime, then retained only as long as needed for security, fraud prevention, disputes, or deletion operations; raw viewer identifiers are not stored in these records
• ChargeHive Fit fitness, body, nutrition and cycle data — kept on your device until you delete it. Removed immediately and completely when you use Delete in the app, or uninstall it. Nothing is retained on a server, so nothing survives that deletion
• ChargeHive Fit account record (email, display name, linked ChargeHive EV account) — retained while the ChargeHive Fit account exists, then queued for purge on deletion, except where a record must be kept for legal, fraud-prevention, or audit reasons

When retention ends, we delete or irreversibly anonymise the data.

19. Data Storage and Security

We implement reasonable security practices and procedures proportionate to the sensitivity of the data, consistent with the SPDI Rules and the DPDP Act, including:

• Encryption in transit, and at rest where supported by our providers
• Passwords stored only in hashed or encrypted form via our authentication provider
• Role-based access control and least-privilege access for staff, sales reps, distributors, and administrators, enforced by a server-side role directory and security rules
• Server-side security rules restricting which data each account can read or write
• Restricting card and bank data to PCI-DSS-compliant / RBI-authorised payment processors
• Keeping Health and Fitness Data on the device, which removes an entire class of risk rather than mitigating it
• Monitoring, logging, and regular security updates

SECURITY DISCLAIMER: No method of transmission or storage is 100% secure. While we work hard to protect your data, we cannot guarantee absolute security, and you use the Services acknowledging this residual risk. Keep your credentials confidential and notify us immediately of any suspected unauthorised access. Data held only on your device is protected by your device: keep it locked and up to date.

20. Personal Data Breach

In the event of a personal data breach, we will take remedial action and notify the Data Protection Board of India and affected Data Principals in the manner and within the timelines required by the DPDP Act and applicable rules.

21. Advertising, Personalisation and Automated Processing

• Marketing and partner offers are optional and sent only if you opt in; change this anytime in Profile, Settings, or Privacy Center
• We may use your activity and preferences to personalise content, discovery, and ads. This automated processing supports features such as nearby discovery, charger matching, and relevant offers; it does not produce legal or similarly significant decisions about you without a lawful basis
• We do not carry out behavioural tracking or targeted advertising directed at children
• HEALTH AND FITNESS DATA IS EXCLUDED FROM ALL OF THIS. Your training, body, nutrition and menstrual cycle data is never used to personalise content, select an advertisement, build a profile, or reach any automated decision about you — inside ChargeHive Fit or anywhere else in the ecosystem. There are no advertisements in ChargeHive Fit

22. Third-Party Links and Services

The Services may link to or integrate with third-party websites, apps, or services, including payment providers, maps, dealerships, and advertisers. We are not responsible for their privacy practices. Please review their policies before providing data to them.

23. Platform Role Disclaimer

ChargeHive EV:

• Does not own or operate chargers
• Does not provide EV charging services or supply electricity
• Does not guarantee availability, safety, or performance
• Does not process host-guest charging payments
• Facilitates ERA requests routed to independent vendors, who provide the physical service
• Acts as an intermediary hosting user content on the Social Platform
• Is not a healthcare provider, and ChargeHive Fit is not a medical device — see Section 24

These disclaimers do not diminish our commitment to handling your personal data responsibly under this Policy.

24. ChargeHive Fit — Health and Safety

ChargeHive Fit is a fitness and wellness tool. IT IS NOT A MEDICAL DEVICE, IT DOES NOT DIAGNOSE, TREAT, CURE, OR PREVENT ANY CONDITION, AND NOTHING IN IT IS MEDICAL ADVICE. Consult a qualified professional before starting a new exercise programme, particularly if you are pregnant, recovering from an injury or illness, or managing an existing condition.

• Body areas and exclusions are preferences, not diagnoses. Telling the app to train around a body area records a training preference; it is not a clinical assessment and must not be treated as one
• Calorie and macro targets are a calculation, not a prescription. They come from the standard Mifflin-St Jeor equation applied to the details you enter, and are a starting point for a healthy adult
• Cycle predictions are calendar estimates. The app calculates them from the periods you have logged, states whose numbers it is using, and draws a predicted day differently from a recorded one. A prediction is routinely several days out
• The fertile window is not contraception. It is an estimate counted back from an estimated next period and must not be relied on to prevent or achieve pregnancy, nor read as an indication of fertility or of any condition
• Nothing in the app is monitored by us. Your logs stay on your device, so no one at ChargeHive reviews them, and entering a symptom or a measurement does not alert anybody. If something concerns you, contact a healthcare professional

25. Limited-Time Complimentary Features

During a promotional period, eligible members may be able to activate a verification badge or publish eligible advertising campaigns on the Social Platform without payment. We store the activation, expiry, campaign, and offer-eligibility records needed to operate those features, and we do not collect payment details for them. We may change or end a promotion prospectively after clear notice; an already activated badge or campaign remains available for its stated period unless it is removed for a policy violation.

26. Content Moderation and Intermediary Obligations (IT Rules 2021)

• We publish our content rules through this Privacy Policy, the Terms and Conditions, and the Community Guidelines
• Every post, comment, and message on the Social Platform can be reported. Reports and community thresholds may trigger automatic takedown, and moderators may remove or restore content
• On receipt of a valid grievance, or a court or government order, we act within the timelines required by the IT Rules 2021, including expedited removal of certain unlawful content
• We retain moderation and takedown records for the period required by law
• Grievances about content are handled by the Grievance Officer named in Section 29

27. Account Deletion

You can permanently delete your account from the in-app Privacy Center after re-authentication and a final confirmation, or by request at chargehiveev.com/legal/delete-account. Deletion removes your sign-in immediately, and the associated personal data is purged — except records we are required to keep, such as consent evidence, fraud-prevention, moderation, dispute, tax, and invoice records.

Deleting a ChargeHive EV account does not by itself erase data held on your device by ChargeHive Fit, because we cannot reach it. Use "Delete everything" in that app's Privacy Center, or uninstall it, and the on-device data is gone.

28. Changes to This Privacy Policy

• We may update this Privacy Policy to reflect changes in the Services, technology, or law
• We will post the updated Policy with a new "Last Updated" date
• For material changes we provide additional notice and, where required, seek fresh consent — material changes re-trigger the in-app consent gate so you see and accept the current version before continuing

29. Grievance Officer and Contact Information

For any question, request, or complaint about your personal data or this Policy, contact our Grievance Officer. This also serves as the grievance mechanism required under the DPDP Act and, for the Social Platform, under the IT Rules 2021. The Grievance Officer handles data access, correction, erasure, and withdrawal requests; privacy complaints; content grievances; and nomination requests.

We acknowledge grievances promptly and resolve them within the timelines required by applicable law. If you are not satisfied, you may escalate to the Data Protection Board of India under the DPDP Act.

ChargeHive EV A product of Lotus Scientific Solutions

Grievance Officer — privacy, data rights and content grievances: grievance-officer@lotusscientificsolutions.com Privacy: privacy@lotusscientificsolutions.com Support: support@chargehiveev.com or support@lotusscientificsolutions.com Address: 1-8-128, Hyderabad, Telangana – 500010, India

This Privacy Policy should be read together with the ChargeHive EV Terms and Conditions, Cancellation and Refund Policy, and Shipping and Delivery Policy.