Privacy policy
Version of 28 September 2026. This is a translation: the French version prevails.
Runsten keeps the trips and positions of your car: this is personal data, which tells where you go. This page says what we do with it, and above all what we do not.
Controller
Akitek SRL, Rue Mercelis 63, 1050 Ixelles, Belgium, BE 0644.503.830 (see the legal notice). For any question about your data: support@runsten.app.
The data
| Data | Where it comes from |
|---|---|
| Account: email address, name, sign-in identifier | you, through the sign-in service |
| Volvo authorisation: access tokens, encrypted | Volvo ID, when you connect your account |
| Car: serial number (VIN), model, and its readings: position, charge, range, odometer, charging state, diagnostics | Volvo's API |
| What Runsten works out: trips, charges, energies, statistics, battery estimate | calculated from the readings |
| What you enter: places, tariffs, costs, settings | you |
| Subscription: plan, state, dates, country. Never your card number, which only Stripe knows | Stripe |
| Records of acceptance: which document, which version, when | you, at sign-up and checkout |
| Support: your emails and our answers | you |
| Technical logs: dates, errors, IP address to limit sign-in attempts. No position, VIN or token | the service |
Why, and on what basis
| Purpose | Legal basis (GDPR, art. 6) |
|---|---|
| Providing the service: reading the car, keeping and calculating your data, showing it to you | performance of the contract |
| Managing the subscription and the accounts | performance of the contract, legal obligation |
| Protecting the service: security, sign-in limits, logs | legitimate interest |
| Answering support, telling you of a change to the service or to these documents | performance of the contract, legitimate interest |
| Keeping proof of your acceptance | legal obligation, legitimate interest |
What we do not do: no selling or renting of your data, no advertising, no profiling, no audience measurement, nothing passed to third parties beyond the providers below. We do not look at an account's data, except at your request or to handle an incident, and every such access is recorded.
For how long
| Data | Period |
|---|---|
| Account, cars, readings, trips, charges | as long as the account exists |
| Account with no sign-in for 24 months | deleted, after an email 30 days before |
| After the account is deleted | erased at once, then from backups within 30 days |
| Volvo authorisation | deleted when you disconnect the Volvo ID, or with the account |
| Technical logs | 30 days |
| Subscriptions and records of acceptance | 10 years after the end of the contract: the limitation period under Belgian law |
| Accounting records | 10 years: the period of Belgian accounting law |
| Support emails | 3 years after the last exchange |
With whom
Our providers process your data on our behalf, under contract, and only for this service:
| Provider | Role | Where |
|---|---|---|
| Scaleway SAS | hosting of the service and its backups | France (Paris) |
| CAOS AG (Zitadel) | sign-in and accounts | Germany (Frankfurt) |
| OVHcloud | support emails | France |
| Stripe (Link) | payment, as seller of record | European Union, and United States |
- Stripe, through Link, sells the subscription in its own name and processes the payment as controller of its own data: its privacy policy applies to the checkout page.
- Volvo Cars is the source of the readings. Runsten calls its API on your behalf, and sends it nothing but those calls. Volvo processes your data under its own policy.
- Transfers outside the European Union: CAOS AG is established in Switzerland, which the European Commission recognises as offering adequate protection; the sign-in data stays in Germany. Stripe and Zitadel's parent company are in the United States: any transfer rests on the EU–US Data Privacy Framework or on the European Commission's standard contractual clauses.
Your rights
At any time, you can:
- access your data and take it with you: the full export, in the settings, on every plan;
- erase it: “Delete my account”, in the settings;
- correct it: your account details, from your account page; the car's readings are not corrected, but are deleted with it;
- restrict a processing or object to it, when it rests on our legitimate interest;
- withdraw the Volvo authorisation: Runsten then stops reading the car.
For anything else, write to support@runsten.app. We answer within one month, and may ask you to prove that the account is yours.
You can also lodge a complaint with the Belgian Data Protection Authority (Rue de la Presse 35, 1000 Brussels, dataprotectionauthority.be), or with the authority of your country.
Cookies
Runsten sets only a session cookie, needed to stay signed in. Your browser also keeps your preferences (language, appearance, keyboard shortcuts), which never leave your device. There is no audience measurement, no advertising and no third-party script: no banner is needed.
The runsten.app site sets no cookie: your browser only keeps the appearance chosen there, light or dark. Stripe's checkout page and the sign-in page set their own cookies, on their domain, under their policies.
No map is loaded: positions are coordinates, with a link to OpenStreetMap that only you decide to follow.
Security
Each account's data is isolated in the database. Volvo tokens are encrypted. Connections are encrypted (https). Logs contain no position, VIN or token. In case of a data breach, we notify the Data Protection Authority within 72 hours, and you too if the risk is high.
Age
Runsten is for people aged 18 or over.
Changes
If this policy changes substantially, we tell you by email 30 days before.