1. Controller and scope
QuantumDrive, Sociedad Limitada (NIF B-75303388), Urb. Veneziola s/n, Edif. 4, Bajo 4, 30380 San Javier (Murcia), España, is the data controller. Contact: privacy@quantumdriveev.com; general contact: info@quantumdriveev.com.
This policy covers the website, the web app, the mobile app, QPilot (including when you use it from Claude, ChatGPT or WhatsApp) and the CAE services (Spanish energy savings certificates). The features available vary by platform and version. The data come from what you enter, from your account and device, from the features you use and, where applicable, from CAE partners or from the company that contracts fleet services.
2. Account, planning and requested services
We process account identifiers (including the Firebase UID), email, name and photo if provided through social sign-in, authentication, vehicle, battery, settings, routes, trips, favourites and locations that you enter or allow us to access. Map services receive the searches, coordinates and technical metadata they need. Charging and payment data are processed when you use those features; you do not need to enable advertising to use route planning.
The legal basis for the data needed to create the account and provide a requested feature is the performance of a contract or pre-contractual measures (Art. 6(1)(b) GDPR). Optional access to location or the microphone requires the device permission; that permission does not authorise analytics or advertising. You can enter a location manually and use QPilot by text. Logs that are strictly necessary for security and abuse prevention are assessed under legitimate interest (Art. 6(1)(f)), with data minimisation and the possibility to object; this basis does not automatically cover product analytics.
3. QPilot and artificial intelligence
QPilot uses your messages, replies, conversation context, selected vehicle, settings, location provided, and relevant routes and trips to answer and carry out the features you request. It may include the name or email available in the context sent to the model. Tool results and conversation titles may also contain personal data. Do not include passwords, health data or information about third parties that is not necessary.
The current version integrated in the web app uses Gemini through Google Cloud Vertex AI for conversation, titles, image interpretation, transcription and speech generation. Some place searches use Google Maps information through grounding. Earlier QPilot services in the backend include an alternative with OpenAI; the current QPilot does not use it.
We process what is necessary to answer you and to keep your history as part of the service you request (Art. 6(1)(b) GDPR). We do not use your conversations for advertising or to train artificial intelligence models; Google does not use the data we send to Vertex AI to train its models. Google retains place queries made with Google Maps for 30 days and may log the use of Vertex AI to prevent abuse, in accordance with its terms. QPilot is an artificial intelligence assistant and may make mistakes: review its suggestions before acting on them. QPilot does not make automated decisions that produce legal or similarly significant effects concerning you.
4. QPilot in Claude, ChatGPT and WhatsApp
You can use QPilot from third-party assistants, such as Claude (Anthropic) or ChatGPT (OpenAI), by adding its connector. The conversation is managed by that assistant under its own terms: QPilot only receives the queries made to its tools (for example, origin, destination, car and battery) and returns the results. We do not receive the rest of your conversation with that assistant.
Without an account, queries are calculated without identifying you and are not stored. If you connect your QuantumDrive account on the Connect page, we securely store a session credential for your account so that QPilot can use your car, your settings and your trips and save what you ask it to, as in the app, together with the list of connected assistants. You can disconnect them all in Privacy and your data → Connected assistants; changing your password or deleting your account also disconnects them.
When QPilot is available on WhatsApp, your messages will be transmitted by Meta (WhatsApp Business Platform), which processes them under its own terms, and voice notes will be transcribed with Gemini on Vertex AI. We store your number only as an irreversible code (hash) to recognise your chat and, if you connect it, to link it to your account. Write "desconectar" (disconnect) to unlink it or "borrar" (delete) to start from scratch.
When a result can be viewed on the map, we give you an "Open in QuantumDrive" link, which stores the scene (the trip, the chargers or the range, without your account data) for 30 days.
5. Conversations, synchronisation and QPilot memory
The interface stores threads, titles, replies and result cards in the browser's IndexedDB. With an authenticated account, threads are synchronised per user to Google Cloud Storage; when you sign in, guest threads present in that browser may be added to your account. Signing out deletes the local copy through the QPilot control, but keeps the account history.
QPilot's memory is the context of the current conversation (forgotten after six hours of inactivity) and the car settings and preferences saved in your account, the same ones as in the app. Deleting a conversation does not delete those settings: they are changed in Settings.
From each conversation's menu you can delete it, including from your account (if you are offline, the deletion is completed as soon as the connection returns and the conversation does not reappear on other devices), or download it in Markdown. In My car → Privacy and your data you can download all your QPilot data in JSON format or delete it all at once.
6. Voice, transcription, images and community
When you enable voice, the browser requests access to the microphone. The audio is sent to the QPilot service and to Gemini on Vertex AI to be transcribed. Dictation lets you review the text; voice notes and conversation mode use the transcript to answer. Voice notes may be stored as audio in the device's IndexedDB: the file is not part of thread synchronisation, although it is transmitted for transcription and the transcript may remain in the synchronised history.
To read a reply aloud, its text is sent to Vertex AI to generate the audio; if this fails, the browser's or system's voice is used. You can stop the voice and revoke microphone permission in the browser. We do not store the audio of voice notes on our servers: it is sent for transcription and the transcript is saved in the conversation.
If you send photos or community contributions, we process the image and the data extracted from it to prepare the requested contribution. Gemini is involved in interpretation and moderation. Reviews, photos or data that you confirm for publication may be visible to other users, depending on the feature and the name you choose to display. Avoid including faces, number plates or other unnecessary data about third parties.
7. Analytics, advertising and consent
With your consent we use PostHog (hosted in the EU) to measure the use of screens and features, campaigns, device data and errors, linked to your account identifier. An identifier or a hashed email is still pseudonymised personal data. We do not record sessions with PostHog.
Analytics and advertising measurement are only activated if you give your consent (Art. 6(1)(a) GDPR and Art. 22(2) LSSI, the Spanish Information Society Services Act). On the website, the web app and the CAE form we ask you when you arrive, with the Accept, Reject and Configure options at the same level; in the app, the first time you open it. Until you make a choice, PostHog, the Meta pixel and Microsoft Clarity are not loaded. Your choice expires after 12 months and we ask you again.
With advertising consent, the web app and the download page use the Meta pixel, and the app sends usage events to the Meta SDK to measure our campaigns; events from users who have accepted are also sent to Meta from PostHog. On iOS, the advertising identifier (IDFA) also requires Apple's tracking permission (ATT); on Android, the advertising identifier is disabled. The app automatically sends Meta the install and first-open events, without an advertising identifier, to attribute downloads to our campaigns.
With your analytics consent, the CAE form uses Microsoft Clarity (heatmaps and session replay) with the content of the fields masked. Provider information: https://privacy.microsoft.com/privacystatement. The main website uses Google Analytics 4 with Google's consent mode.
You can change or withdraw your consent at any time, as easily as you gave it: in the web app under My car → Privacy and your data, in the app under Account → Analytics and advertising, and on the website and the CAE form from the cookies link. Withdrawing it does not affect processing carried out beforehand; if you want data already received to be deleted, write to us at privacy@quantumdriveev.com.
8. CAE, communications, payments and fleets
For CAE files we process identification, contact details, documentation of the vehicle and of the measure, invoices, signature, IBAN and supporting documentation where applicable. We use the data necessary to process the file and pay the remuneration (Art. 6(1)(b)), to comply with applicable obligations (Art. 6(1)(c)) and to handle claims or prevent fraud where justified (Art. 6(1)(f)). Document reading may use OpenAI and Google Vertex AI, in addition to the storage and management of the file.
Support enquiries are handled in order to manage your request; optional newsletters and commercial communications require their own legal basis and choice, normally consent. You can unsubscribe using the link provided in the message or by requesting it from the privacy contact. Communications necessary for your account or file are independent of advertising.
Charging and payments may involve Cariqa, Stripe and, depending on the method, Apple or Google. Fleet and telemetry services are described in their specific information when contracted: QuantumDrive may act as processor for the client company; the contract with the company does not in itself constitute a legal basis for any processing of its drivers' data.
9. Providers and recipients
Depending on the feature, the following are involved: Google Cloud/Firebase (authentication, infrastructure, storage and QPilot/Vertex AI), Neon (databases), Vercel (website), PostHog, Google Analytics and Meta (measurement, with your consent), Mapbox (maps, directions and traffic), Google Maps (places), Open-Meteo (weather, with coordinates), OpenAI (reading of CAE documents and earlier QPilot services), Resend (email), Meta (WhatsApp, if you use QPilot on WhatsApp) and the payment or charging providers mentioned. Queries to location services may reveal the area or journey queried.
We also use Google Workspace, DocuSign, Atlassian and HubSpot for email, signature, documentation and communications where applicable. Anthropic (Claude) and OpenAI (ChatGPT) are independent controllers of the conversations you hold in their assistants. Meta and the payment or platform providers may act as controllers of their own processing. We disclose data to authorities when required by law and to professionals involved in managing or defending claims.
On CAE, ipapi.co receives the IP address to suggest a region, and Cloudflare (cdnjs) and Google Fonts serve resources for the document viewer and fonts; these requests disclose the IP address and technical data to those providers.
10. International transfers
Some providers may process data outside the European Economic Area, for example in the United States. In such cases the transfer is based on the EU-U.S. Data Privacy Framework where the provider is certified, or on the standard contractual clauses approved by the European Commission included in their data processing agreements. We host our services in the EU whenever the provider allows it (Google Cloud in Belgium, PostHog in the EU).
You can request information about, or a copy of, the applicable safeguards at privacy@quantumdriveev.com.
11. Retention and deletion
Your account and its data (cars, settings, trips, saved and shared routes, favourites, charging cards, QPilot conversations, connected assistants and community contributions) are kept for as long as you have the account. When you delete it, they are all deleted. We only keep a minimal record of the account closure (identifier, date and, if you provide it, the reason) and the data the law requires us to keep, such as invoices (six years), with restricted access. What is deleted disappears from our backup copies within a maximum of 7 days.
The QPilot conversations in your account are kept until you delete them; those with 24 months of inactivity are deleted automatically. In the browser they remain until you delete them or clear the site data. Conversations from Claude, ChatGPT or WhatsApp are not stored: QPilot only keeps the context in memory for six hours of inactivity. "Open in QuantumDrive" links expire after 30 days.
The credentials of connected assistants are kept until you disconnect them (the access tokens we issue expire after one hour and are renewed for a maximum of 90 days without use). Connection requests and one-time codes expire within minutes. CAE files are kept during processing and thereafter for the period required by the rules of each aid scheme and the applicable legislation. Analytics events are kept in pseudonymised form and are deleted if you ask us to.
12. Rights and available controls
You can request access, rectification, erasure, restriction, objection and portability where applicable, as well as withdraw your consent, by writing to privacy@quantumdriveev.com. We respond without undue delay and within one month of receipt; where necessary given the complexity or number of requests, this may be extended by up to two further months, in which case we will inform you within the first month and explain the reason.
We will only request additional identity information where there are reasonable doubts and in a proportionate manner; you do not need to send a full national ID document (DNI) as a matter of routine. You can lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, https://www.aepd.es/) or with the competent authority of your habitual residence or place of work.
In the web app, My car → Privacy and your data brings together your controls: cookies and analytics, downloading or deleting your QPilot data, connected assistants and deleting the account. Account deletion is confirmed by email and deletes all your data (see Retention); giving a reason is optional. For any other right, or for a full copy of all your data, write to us at privacy@quantumdriveev.com. You do not need to accept advertising, answer a survey or explain why you are exercising a right.
13. Security, minors and changes
We apply access controls, authentication, and encryption in transit and at rest at our providers, and we store assistants' access credentials only as an encrypted fingerprint (hash). We review the measures according to risk. QuantumDrive is not directed at children under 14; services that require the user to be of legal age maintain their requirements. If we detect data of a minor processed without a valid legal basis, we will delete it.
We will publish relevant changes with their date and additional information where appropriate. A policy change does not grant retroactive consent or automatically enable new purposes. This version must be read together with the cookie information and the specific notices that appear when using each feature.