Privacy and POPIA Notice

The responsible party is Cyntech Engineers & Managers (RF) (Pty) Ltd., Cape Town, Western Cape, South Africa.

Information Officer: Ashley Verhulp, Information Officer — ashley@cyntech.io. The Information Officer is registered with the Information Regulator as required by POPIA and its regulations.

Account and profile details: email address, password (stored only as a secure hash), display name, first and last name, mobile number, city or town, home province, optional biography, private profile portrait, and the roles attached to your account.

Vehicle and driving profile: make, model, usable battery capacity, charging limits and your fitted consumption coefficients.

Trips, planning and navigation: origins, destinations, planned routes and stops, recent and favourite places, scheduled departure, active route revision, coarse route progress, and throttled current-position snapshots while navigation is active.

Charging sessions: start and end times, state of charge in and out, energy delivered, peak and average power, adjacent-bay occupancy, cost and notes.

Photographs: your optional profile portrait, stored privately for your account, plus charger-screen evidence you upload, the text extracted from it by automated analysis, and the GPS position captured at the time so the reading can be matched to a charger.

Telemetry from a paired phone: location, speed, estimated state of charge and power, at the sampling interval you enable. Navigation positions remain private and are used to locate you on the route, detect missed turns and protect the planned reserve.

Community content: forum posts, replies, likes, charger reports and tariff submissions.

Connected AI clients: when you approve Claude or another MCP client, we record the verified client identifier, the last Ampere tool used, and first and latest use times. We do not store its OAuth token in this activity record.

Product analytics: when you permit behaviour collection, we record limited interactions such as opening or searching the Cars catalogue, applying a make filter, requesting an upgrade, or saving a catalogue car. These records support aggregated service reporting and do not include location data.

Technical data: IP address, device and browser information, and security and error logs.

To provide the service you asked for — planning trips, logging sessions, showing your history: necessary for the performance of our agreement with you (section 11(1)(b) of POPIA).

To build measured charger reliability, the Honesty Index and regional tariff views: our legitimate interest in an accurate public record of charger performance (section 11(1)(f)), using de-identified aggregates only.

To operate the in-app assistant, which analyses your own trips and remembers your preferences so its advice improves: your consent, given at signup and withdrawable at any time.

To understand feature use and improve the service through limited product analytics: your consent through the behaviour-data permission, which you can switch off at any time.

To let an AI client you approve request your Ampere data securely and to show connection status: necessary to perform that request and our legitimate interest in access security and auditability.

To send service emails such as confirmation, password reset and trip alerts: necessary for the agreement and for security.

To send optional product news: your separate, opt-in consent, in line with section 45 of ECTA and section 69 of POPIA on direct marketing. Every such message carries an unsubscribe link.

To keep the platform secure and to comply with law: our legal obligations and legitimate interests.

At signup you tick separate boxes for the Terms, this Privacy and POPIA Notice, and optional marketing. Each tick is stored against your account with the document version, timestamp, IP address and device string as proof of consent.

You may withdraw consent at any time in your account settings or by emailing us. Withdrawal does not affect processing that already lawfully happened, and some processing necessary to run your account will continue while the account exists.

Ampere uses automated analysis in three places: reading text from charger photographs, fitting your consumption curve, and the in-app assistant that reviews your trips and may propose plan changes.

Automated processing is used to inform you, never to make a decision with legal or similarly significant effect on you without human involvement (section 71 of POPIA). Proposals that change a live plan, a logged measurement or a public report always wait for your tap.

Photographs and trip content sent to our AI providers are processed under contract as operators on our behalf and are not used to train third-party public models. A separately connected AI client receives only the Ampere data you ask it to request, while acting under your verified account permissions.

Operators (processors) acting on our written instruction: our cloud hosting and database provider, our email delivery provider, our mapping provider and our AI model providers. Each is bound to POPIA-equivalent security obligations under section 21.

The public: only de-identified aggregates — measured kW, percentage of claimed power, success rates, session counts, median tariffs — plus any forum post or charger report you choose to publish, which shows your display name.

Authorities: where we are legally compelled, for example under the Criminal Procedure Act or the Cybercrimes Act 19 of 2020.

We never sell your personal information.

Some of our processors host or process data outside South Africa. We transfer personal information across borders only where section 72 of POPIA permits it: the recipient is subject to a law or binding agreement providing comparable protection, the transfer is necessary to perform our contract with you, or you have consented.

Traffic is encrypted in transit. Passwords are hashed and never visible to us. Database access is enforced row by row so your profile, trips, telemetry and photographs are readable only by your account. Profile portraits and evidence photographs live in private stores reachable only through short-lived signed links. Paired-device tokens are stored hashed, expire and can be revoked.

We keep audit trails of consent, agent runs and administrative access. If a security compromise affects your personal information we will notify you and the Information Regulator as required by section 22 of POPIA.

Account, profile, portrait, trip, session and evidence data: while your account is open, and for 12 months after closure for dispute and audit purposes, unless you ask for earlier deletion. Using the in-app deletion control removes your private portrait with your account.

Consent records: 5 years after the consent ends, as evidence of lawful processing.

De-identified charging measurements that no longer identify you: kept indefinitely as part of the public measurement record, as permitted by section 14(1) of POPIA.

Security, MCP connection activity and access logs: 12 months.

You may ask what we hold about you and receive a copy; correct or delete information that is inaccurate, irrelevant, excessive or out of date; object to processing based on legitimate interest; withdraw consent; opt out of direct marketing; and complain.

Send requests to ashley@cyntech.io. Formal access requests follow our PAIA Manual and Form 2 of the PAIA regulations. We respond within 30 days where practicable.

You may complain directly to the Information Regulator (South Africa), JD House, 27 Stiemens Street, Braamfontein, Johannesburg — enquiries@inforegulator.org.za / complaints.IR@inforegulator.org.za.