Legal

Privacy Policy

Last updated 4 October 2026

1. Who we are

BattGrade is a brand administered and managed by TOPFED WEB S.R.L., a limited liability company registered in the Republic of Moldova under IDNO 1026023125543, with its registered office in Chișinău, Republic of Moldova.

TOPFED WEB S.R.L. is responsible for the personal data described in this policy, except where we say that we act for an inspector's company (section 3). You can reach us by email at [email protected], by phone at +373 60 616 128, or by post at our registered office. We have not appointed a data protection officer; write to [email protected] about anything concerning your data.

2. The laws we follow

We are established in the Republic of Moldova and follow the Law of the Republic of Moldova No. 195/2024 on personal data protection, in force since 23 August 2026. Because we offer BattGrade to businesses in the European Union, the EU General Data Protection Regulation (GDPR) also applies to the personal data of people in the EU.

3. When we decide, and when we act for an inspector

We are the controller for: inspector accounts and company profiles; the public record of each certificate (what its verification page and public PDF show), its signature and the test data behind it; technical reports from the app; messages and requests sent through our website; newsletter subscriptions; and our server logs.

We are a processor for the customer data that an inspector's company enters about its own customers: the customer's name, email address and language, the private name given to a vehicle, and the record of emails sent to the customer. The inspector's company is the controller of that data and decides why it is collected. We process it on the company's behalf under our Data Processing Terms.

If you are an inspector's customer, contact the inspector first. If you contact us, we will pass your request on to the inspector's company and help it answer.

Data Processing Terms

4. What we collect, why, and for how long

The legal bases are those of Article 6(1) GDPR and the corresponding provisions of Law No. 195/2024: the contract with you or the steps you ask for before one (contract), our legitimate interests or those of others, which we have weighed against your rights (legitimate interests), and your consent.

Inspector account

What it includes: Name, email address, password (held by Google Firebase as a hash, never by us), role in the company, interface language, sign-up and last activity dates.
Why we use it: To create and secure the account, sign you in and let you issue certificates.
Legal basis: Contract.
How long we keep it: Until the account is deleted.

Company profile

What it includes: Company name, country, licence number, logo and default language.
Why we use it: To print the issuer's details on certificates and send emails in the right language.
Legal basis: Contract.
How long we keep it: Until the account is deleted. The details printed on certificates already issued stay on them (see the public certificate record).

Test data

What it includes: Raw data exchanged with the vehicle, readings, result, VIN, odometer, vehicle make, model and year, adapter, app version, phone platform, operating system and model, test date and duration.
Why we use it: To recompute the result on our server, issue the certificate, and show later that it was issued from that data.
Legal basis: Contract with the inspector's company; for the public record, our legitimate interests (next row).
How long we keep it: As long as the certificate it belongs to.

Public certificate record

What it includes: Certificate ID and dates, vehicle make, model, variant and year, odometer, VIN with part of it hidden, result, readings and checks, test details, the issuing company's name, country, licence number and logo, the inspector's name, signature and status.
Why we use it: To let anyone who has the certificate ID or QR code check that the certificate is genuine and unchanged, and whether it is still valid or was revoked.
Legal basis: Our legitimate interests, and those of buyers and other people who rely on certificates, in being able to verify them.
How long we keep it: There is currently no fixed end date. Certificates stay verifiable after they expire and after the issuing account is deleted, because buyers may check them at any time.

Customer data (we act for the inspector's company)

What it includes: Customer name, email address and language, private vehicle name, and the record of emails sent to the customer.
Why we use it: To deliver the certificate by email and to show the inspector's company its history.
Legal basis: Decided by the inspector's company, which is the controller.
How long we keep it: Until the inspector's company deletes its account or asks us to delete it.

Technical reports from the app

What it includes: The communication between the app and the vehicle, raw data, readings, VIN, vehicle make, model and year, the adapter, the names and signal strength of Bluetooth devices the app recognised as possible OBD2 adapters, app version, phone model and operating system, the error, and any note the inspector writes.
Why we use it: To diagnose and fix problems with adapters, vehicles and the app. During the testing period, the app also sends these reports after successful tests, to help us improve the readings.
Legal basis: Our legitimate interests in a reliable service.
How long we keep it: Up to 12 months, then deleted. When an account is deleted, its reports lose the link to it.

Website forms

What it includes: What you enter in the contact, demo, test request or early access form: name, email address, company, country, role, phone type, adapter, makes you inspect, expected volume, subject and message.
Why we use it: To answer you, arrange a demo or early access, and keep a record of our correspondence.
Legal basis: Steps you ask for before a contract, and our legitimate interests in answering business enquiries.
How long we keep it: In our mailbox, for as long as we need it to deal with your request and any follow-up. Form messages are not stored in our database.

“Notify me” requests

What it includes: Email address, the model, whether you own one, and, when sent from the app, your account.
Why we use it: To count the inspectors waiting for a model and to email you when it becomes supported.
Legal basis: Your consent, which you can withdraw at any time.
How long we keep it: Until you ask us to remove it, or your account is deleted.

What it includes: Email address, where you signed up and when.
Why we use it: To send you news about BattGrade.
Legal basis: Your consent, which you can withdraw at any time.
How long we keep it: Until you unsubscribe or ask us to delete it.

Server and security logs

What it includes: IP address, date and time, the page or API route requested, browser or app information, and error details.
Why we use it: To deliver the website and the API, protect them against abuse (including request limits), and fix errors.
Legal basis: Our legitimate interests in a secure, working service.
How long we keep it: For a short period, as needed for security and troubleshooting. Request limit counters are kept only in memory.

Website statistics

What it includes: Page views, referring sites, browser, operating system, device type and country, counted in aggregate by Plausible Analytics. The IP address and browser are used only to compute a daily changing identifier and are not stored.
Why we use it: To know which pages are read.
Legal basis: Our legitimate interests.
How long we keep it: Aggregate statistics only, which do not identify you.

You need to give us an email address and a password to create an account. Other details are optional, but without them some functions do not work: without a customer's email address, for example, we cannot send them the certificate.

The State of Health score and the grade rate a vehicle's battery, not a person. We make no decisions based solely on automated processing that produce legal or similarly significant effects for you.

5. What a certificate shows publicly

Anyone who has a certificate's ID or QR code can open its verification page at battgrade.com/verify and download its public PDF. They show:

the vehicle's make, model, variant and year, and the odometer reading;
the VIN with part of it hidden: on a 17 character VIN, the first 11 and the last 4 characters are visible, and the 2 characters between them are replaced by asterisks;
the result, the method, the uncertainty band, the readings and the checks;
the test date, its duration and the adapter used;
the issuing company's name, country, licence number and logo, and the name of the inspector who ran the test;
the certificate's dates, status and signature.

Customer data never appears there. The full VIN appears only in the PDF attached to the email sent to the customer and in the PDF the issuing company downloads from its account.

The inspector's name is public. Each certificate shows the name of the inspector who ran the test, as set in their profile in the app, so that anyone relying on the certificate knows who carried out the test. Inspectors are told this in our Terms of Service. The name stays on the certificate after the inspector's account is deleted.

Verification pages and PDFs are marked so that search engines do not index them. If you are named on a certificate, or it concerns your vehicle, and you object to its publication, write to us (section 9). We will weigh your request against the interests of the people who rely on the certificate.

6. Who receives data

We do not sell personal data and do not use it for advertising. Data is shared only with:

the service providers that process data for us (sub-processors), listed with their role, location and the data they receive on our Sub-processors page;
the inspector's customer, who receives the certificate and its PDF by email;
Apple and Google, which distribute the app through their stores as independent controllers under their own terms;
authorities, courts or other parties, when the law requires us to, or when it is needed to establish or defend legal claims;
a company that takes over the BattGrade business, which will continue to apply this policy.

Sub-processors

7. International transfers

We are established in the Republic of Moldova, for which the European Commission has not adopted an adequacy decision. When you use BattGrade from the European Union, your data reaches us in Moldova. Our database is hosted in Germany.

Some of our providers are established in the United States: Cloudflare, Google (for sign-in and for our mailbox) and Expo. Where they transfer personal data from the EU to the United States, they rely on the safeguards described in their own data processing terms, such as the EU-U.S. Data Privacy Framework or the European Commission's standard contractual clauses. Transfers of personal data from Moldova follow Law No. 195/2024.

You can ask us for more information about these safeguards at [email protected].

8. Security

Connections to our website, our servers and the app are encrypted with HTTPS. Access to data is restricted: every request from the app is authenticated and each company sees only its own certificates, and our administration pages are protected by a secret access token. Passwords are handled by Google Firebase Authentication and never reach our servers. Customer data is kept out of the public record and out of the signed data.

No system is completely secure. If a breach is likely to put your rights at risk, we will inform you and the competent authorities as the law requires.

9. Your rights

Under the GDPR and Law No. 195/2024 you have the right to:

access the personal data we hold about you and receive a copy;
have inaccurate data corrected;
have your data deleted, where there is no reason for us to keep it;
have the use of your data restricted, for example while we check a complaint;
receive the data you gave us in a common machine-readable format, and have it passed to someone else, where the processing is based on a contract or consent;
withdraw your consent at any time (newsletter, “notify me” requests), without affecting what we did before.

Your right to object. Where we rely on legitimate interests, you can object at any time, on grounds relating to your particular situation, including to the publication of a certificate's public record. We will then stop, unless we have compelling legitimate grounds that override your interests, or need the data for legal claims. You can object to direct marketing at any time, without giving a reason.

To use your rights, write to [email protected]. We may ask you to confirm your identity. We reply within one month. For complex or numerous requests we can extend this by two further months, and we will tell you why within the first month. Using your rights is free.

If your request concerns customer data we hold for an inspector's company, we forward it to that company, which decides on it, and we help it carry out its decision. Inspectors can correct their name and company details in the app (Profile). Certificates already issued keep the details they were issued with.

10. Complaints

If you think we have not handled your data correctly, you can complain to a supervisory authority:

in the Republic of Moldova: the National Center for Personal Data Protection (Centrul Național pentru Protecția Datelor cu Caracter Personal), datepersonale.md;
in another country: the data protection authority of the country where you live or work, or where you think the infringement took place. For the European Union and the European Economic Area, the European Data Protection Board lists them at edpb.europa.eu.

We would appreciate the chance to deal with your concern first, at [email protected].

11. Deleting your account

In the BattGrade app, open Profile, tap Delete account, type your email address to confirm, and confirm. If you are the owner of a company that has other team members, remove them first. If you cannot use the app, write to [email protected] from your account's email address and we will delete the account for you.

What we delete straight away: your sign-in account at Google Firebase, your member record and your “notify me” requests. If you are the owner, we also delete the company profile, its logo, the customer data on the company's certificates and the record of emails sent to customers.

What we keep: issued certificates stay verifiable, with the company details and inspector name they were issued with, the vehicle data, the result and the raw data of the test, but without customer data and without a link to the deleted account. Technical reports are kept until they are 12 months old, without the link to your account. If a team member deletes their account, the certificates they issued stay with the company, including their customer data, because the company remains their controller. Copies of emails already sent stay with their recipients, and we keep records that the law requires us to keep, such as accounting records for paid plans.

12. The mobile app

Bluetooth: used only to find and connect to your OBD2 adapter. On Android, the app declares that it does not use Bluetooth to determine your location.
Photos: used only when you choose a company logo. The app reads the image you pick and uploads it to us.
The app shows no advertising, does not use an advertising identifier and contains no analytics or tracking software.
On your phone, the app stores your sign-in session (so that you stay signed in), your language and energy unit, and technical reports waiting to be sent when you are offline. They stay in the app's own storage until you sign out, the report is sent, or you uninstall the app.
Updates: when it starts, the app asks the update service of Expo (650 Industries, Inc., United States) whether a newer version of its code is available. Expo receives your IP address, the platform, the app's runtime version and update channel, and a random identifier generated for the installation.

13. Cookies

Our website sets no cookies. The Cookie Policy explains how we count visits without them.

Cookie Policy

14. Children

BattGrade is a professional service for people aged 18 and over. We do not knowingly collect data about children.

15. Changes to this policy

We update this policy when our processing changes. The date at the top shows the current version. If we make a significant change, we will also tell account owners by email.