Privacy policy

1. Who processes your data

MothiOS is a management platform for manufacturers and distributors of light electric vehicles: production, sales, deliveries, aftersales, fleet and invoicing, with portals for customers and workshops.

The platform is provided by [PENDING: full company name], tax ID [PENDING: tax ID (CIF)], registered office at [PENDING: registered office] and registered in [PENDING: commercial registry details].

For any privacy matter you can write to [PENDING: privacy contact email]. [PENDING: whether there is a data protection officer and how to contact them].

2. Controller and processor: the role of each organisation

Several organisations work in MothiOS at the same time: the manufacturer, its distributors, its end customers and the workshops. Each organisation sees only its own data and that of those who depend on it; one distributor does not see another distributor's data, and a workshop only sees the incidents assigned to it.

Much of the data on the platform (customers, contacts, vehicles, incidents, invoices) is entered by each client organisation about its own customers and suppliers.

For that data, each client organisation is the controller: it decides what data it enters, what it uses it for and how long it keeps it. We, as the provider of MothiOS, are the processor: we process it only to provide the service to that organisation and on its instructions, under the data processing agreement (Article 28 GDPR) that forms part of the contract with each organisation. That agreement lists the providers that process data as sub-processors (see section 5).

We are the controller only of our own data: the platform's user accounts, the invoicing of our client organisations and the support we give them.

3. Data we process

We only process the data the platform needs to work. By category:

• User accounts: name, username, email address, role, organisation and, where applicable, the client company the user belongs to; the password is stored only as a hash, never in plain text; sign-up date, last access, preferred language and theme, and the Telegram identifier if the user links their account to the bot.
• Client companies and their contacts: company name, tax identifier, postal address, and the coordinates calculated from that address; for each contact, name, email, phone, job title, language and, if added, their LinkedIn profile. Also the business interactions recorded with them (emails, meetings, calls, notes).
• Vehicles: VIN, model, documentation (certificate of conformity, manuals, insurance) and the owning client company.
• Vehicle technical data (telemetry): battery level, kilometres, battery and motor temperatures, average speed and fault codes. The vehicle's position is not recorded. Today only demonstration data exists: no real vehicles are connected yet.
• Aftersales incidents: the affected vehicle, the customer, the assigned technician, the messages in the incident thread and the attached photos and documents.
• Orders, delivery notes and signatures: order lines, prices and notes; when a customer signs an order or a delivery note from the link they receive, we store the date, the email they sign with, the IP address and the browser they use, as proof of acceptance.
• Invoicing: tax details of the customer and the issuer as they were when the invoice was issued (stored frozen, as the regulations require), amounts, and the customer's IBAN when paying by direct debit.
• Job applications, if the organisation uses the people area: first name, surname, email, phone, language and the attached CV. ID number, address and date of birth are not requested.
• Conversations with the MothiOS agents and with the Telegram bot assistant: what the user writes, what the agent replies and the data the agent looked up to reply (see section 6).
• Security and audit logs: sign-ins and sign-outs, data changes and denied access; and, for privacy operations (exporting or anonymising a person), who did it, when, the IP address and the browser.

We do not intentionally process special categories of data (health, beliefs, etc.) or data about minors. If a user writes them in a free-text field, they are stored like any other text.

4. What we use it for and on what legal basis

We use the data for the following:

• Providing the service each organisation has contracted: managing production, sales, deliveries, incidents, fleet and invoicing, and giving access to its users, customers and workshops. Legal basis: [PENDING: legal basis, depends on the role in section 2].
• Maintaining the account and security: authenticating users, logging access and detecting misuse. Legal basis: [PENDING: legal basis].
• Issuing and keeping invoices in accordance with tax and invoicing regulations (including the Spanish Tax Agency verification QR code on invoices). Legal basis: compliance with a legal obligation.
• Sending the notices generated by the activity itself: invoices, delivery notes, quotes, signature links, changes to incidents and workshop appointments, by email and, if the user has linked it, by Telegram. Legal basis: [PENDING: legal basis].
• Answering the questions users ask the MothiOS agents and carrying out, only when the user confirms, the actions the agent proposes. Legal basis: [PENDING: legal basis].
• Calculating the location of each client company's premises from its address, to place it on the fleet map. Legal basis: [PENDING: legal basis].
• Detecting and fixing technical errors in the platform. Legal basis: [PENDING: legal basis; the code treats it as legitimate interest].

We do not use the data for advertising, we do not build commercial profiles of people and we do not sell data to anyone.

5. Providers and other third parties that receive data

To provide the service we rely on the following providers and third-party services. Each receives only what it needs for its task:

• Railway: hosts the application (the API, the portal and the bot). Every request to the platform passes through its servers.
• Supabase: hosts the database and file storage (vehicle documents, incident photos and attachments, CVs, PDFs of orders, delivery notes and invoices).
• Provider of the agents' language model (Anthropic): receives the business data needed to reply when someone uses an agent. We explain this in detail in section 6.
• Microsoft (Microsoft 365): sends the platform's emails. It receives the recipient and the content of the email, including the attached PDFs (invoices, delivery notes, quotes, order confirmations).
• Telegram: carries the bot's messages and the notices to users who have linked their account. Those messages may include a vehicle's VIN, the number and status of an incident or an order, appointment dates and names of sales opportunities.
• Sentry: receives technical reports when an error occurs. It is configured to keep personal data to a minimum: it does not identify the user, it strips session headers and, on the server, passwords, tokens and tax identifiers; and it does not record browsing. Even so, an error report may incidentally contain some data from the operation that failed.
• OpenStreetMap: to place client companies on the fleet map, the platform sends each client company's address (street, postcode, city and country) to the OpenStreetMap Foundation's Nominatim geocoding service, which returns its coordinates. This is done when calculating the coordinates of companies that do not have them yet or have had them for more than six months. In addition, when the fleet map is opened, the user's browser requests the map images directly from OpenStreetMap's servers, which thereby receive the user's IP address and the map area they are looking at. [PENDING: legal basis and safeguards for this transfer; the OpenStreetMap Foundation does not sign data processing agreements].
• Internal automation system (mothium-ops): a separate application, connected to the platform through its API, which the portal asks to generate and send order quotes, and which records customer interactions (emails, meetings, calls) on the platform from the email inbox. [PENDING: what data it processes, where it is hosted and which providers it uses, including whether it sends data to a language model; to be provided by that project].

In addition, each client organisation decides what its users, its distributors, its customers and the workshops servicing its vehicles can see, within the platform's permissions.

We only disclose data to authorities when a law requires us to.

Today the platform does not send invoices to the Spanish Tax Agency by itself: the planned submission through an invoicing provider is not active yet. [PENDING: update this policy before activating it].

6. The MothiOS agents and the model provider

MothiOS includes four agents (Fleet, Aftersales, Technician and Reports) that answer questions and propose actions. They run on a language model from an external provider, Anthropic.

When a user writes to an agent, the following is sent to the provider: the question, the user's name and role, the screen they are asking from and the history of that conversation. To reply, the agent looks up data on the platform, and those results are also sent to the provider as they are. Depending on the agent, they may include:

• Fleet and Aftersales: VINs, the client company's name, vehicle technical data and fault codes, incidents and their content, available workshops, spare parts catalogue, and the postcode or delivery address of a spare parts order.
• Technician: the knowledge base, the model documentation, a vehicle's record and diagnosis. It is instructed not to give out customer data.
• Reports: aggregated figures on costs, activity and orders, with the period and filters the user asks for.

The Telegram bot assistant, which runs on the same provider, additionally sends the model provider the name, email address and phone number of sales contacts, and the notes of incidents, when the user asks about them.

The agents only see what the user asking them can see: they apply the same organisation and role permissions as the rest of the platform. They never change data on their own: when they propose an action, the user has to confirm it, and every action is logged.

Conversations are stored on the platform so the user can pick them up again, including the data the agent looked up to reply; each one is only visible to its owner. The Telegram bot history is also stored, and the user can delete it with the /cancelar command.

[PENDING: terms agreed with the model provider: whether it keeps the data sent and for how long, whether it may use it to train its models, in which countries it processes it and with what safeguards].

7. Where the data is hosted and transfers outside the European Economic Area

The database and files are hosted in the European Union (Supabase, Ireland region).

The application that processes requests (Railway) currently runs on servers in the United States. [PENDING: exact Railway region, unconfirmed; and whether it will be moved to Europe before launch]. Since every request passes through it, data is transferred to the United States.

The agents' model provider, Microsoft, Sentry, Telegram and the OpenStreetMap Foundation may process data outside the European Economic Area. [PENDING: region of each provider and the safeguard covering each transfer (adequacy decision, standard contractual clauses or other)].

8. How long we keep it

Today the platform does not automatically delete or anonymise any data based on its age.

[PENDING, BLOCKING: retention period, and what happens when it expires (deletion or anonymisation), for each of the following data]:

• Conversations with the MothiOS agents, which include the tool results: the business data the agent looked up to reply.
• Telegram bot assistant history (complete questions and answers).
• Aftersales incidents, with their messages, photos and attachments.
• Uploaded documents and files (vehicle documentation, CVs, PDFs of orders, delivery notes and invoices).
• Vehicle telemetry and fault codes.
• User accounts, client companies, contacts and business interactions.
• Job applications.
• Signatures of orders and delivery notes (with the signer's IP and browser) and security and audit logs.
• Invoices and their tax details, subject to the periods set by tax and commercial law.
• All of an organisation's data when its contract ends.

Some data does have a technical expiry: file download links expire within minutes, agent proposals expire after 30 minutes if not confirmed, and signature links expire after the period set when they are sent.

9. Your rights and how to exercise them

You can request access to your data, its rectification or erasure, restriction of processing and portability, and object to processing, as well as withdraw any consent you have given.

If your data was entered by a MothiOS client organisation (for example, you are a customer's contact or your vehicle is managed by a distributor), you can contact that organisation. You can also write to us at [PENDING: privacy contact email]. [PENDING: who handles each request depends on the role in section 2].

What the platform does today to handle these requests:

• Each organisation's administrators can export a contact's data to a file: their record, related opportunities and product trials, and the latest logged accesses to their data.
• They can also anonymise a contact or an applicant: their name and email are replaced, their phone and job title are cleared, and for an applicant their CV is deleted. The whole record is not deleted so as not to break the orders and business history of the company they belong to. If the contact has operations in progress, the platform does not allow anonymising them until those are closed.
• Every export or anonymisation is logged: who did it, when, why, from which IP address and with what result.
• Rectification is done by editing the data on the platform itself.

These tools currently cover contacts and applicants. Requests about user accounts, conversations with the agents and the rest of the data are handled manually. [PENDING: procedure and response time].

If you believe we have not handled your request properly, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

10. How we protect the data

All communications are encrypted (HTTPS). The session is kept in a cookie that the page's code cannot access, and passwords are stored as hashes.

Each organisation accesses its own data and only the data of other organisations the platform links it to (a distributor, its customers' data; a workshop, the incidents assigned to it). Within an organisation, each user sees what corresponds to their role and work area. Files are not public: they are served through temporary links.

Relevant actions (sign-ins, changes, denied access, privacy operations) are logged.

11. Contact and complaints

For any question about this policy or about your data: [PENDING: privacy contact email and postal address].

If we change this policy in a significant way, we will announce it on the platform before the change takes effect.