Privacy policy

Last updated: 10 September 2026

1. Controller

The controller for data processing on this website (akku-brief.de) and in the Akkubrief service is:

Georg Wächter (sole trader)
Prinzessinnenstr. 29, 12307 Berlin, Germany
Email: info@akku-brief.de

No data protection officer has been appointed, as the statutory conditions for this are not met.

2. The essentials at a glance

• We use no advertising or tracking cookies and embed no third-party trackers. Our audience measurement works without cookies.
• We receive vehicle data read-only through the manufacturer’s official interface, after you have actively connected your vehicle. We can neither control nor wake your vehicle.
• We store the vehicle identification number (VIN) and access tokens encrypted (AES-256-GCM). On the public certificate the VIN appears only masked and as a checksum.
• Our database (Supabase) runs in Frankfurt am Main (EU).
• Signing in is passwordless — we store no password of yours.
• Where the reference value for your battery is not unambiguous, we request your vehicle’s certificate of conformity from the Kraftfahrt-Bundesamt. All we pass on for that is the vehicle identification number; the details and how to object are in section 9b.
• Connected vehicles count anonymously towards our fleet analyses — this is part of the free offering and the reason it is free. Only group values with a minimum group size are reported; details and how to object are in section 14a.

3. Hosting and server log files

Our website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA (“Vercel”). When you access the website, Vercel processes, as technically necessary, your IP address as well as the date and time of access, the URL requested, the referrer URL, the browser type and version and the operating system used (server log files).

• Purpose: delivering the website, stability, detecting misuse and attacks.
• Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in secure and performant operation).
• Retention: log files are kept only briefly and then deleted automatically; we do not analyse them on a personal basis.
• A data processing agreement is in place with Vercel (Art. 28 GDPR). On transfers to the USA see section 15.

4. Cookieless audience measurement (Vercel Web Analytics)

We use Vercel Web Analytics, a cookieless audience measurement. No cookies are set and no cross-device profiles are built; visitors are distinguished only by a short-lived hash derived from technical characteristics, which does not allow recognition across days. We see only aggregated statistics (page views, referring pages, countries, device types) and individual anonymous functional events (for example “waiting list entry submitted”).

• Purpose: understanding how our offering is used, improving the website.
• Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in data-minimising audience measurement without tracking).

5. Cookies and similar technologies

We use exclusively technically necessary, functional first-party cookies. A consent banner is therefore not required (§ 25 (2) no. 2 TDDDG); no tracking takes place.

All cookies are first-party cookies on our domain; no data is passed to advertising networks.

6. Waiting list (early access)

If you join the waiting list, we process your email address, your language choice, optionally your interest (buying / selling / your own vehicle) and vehicle model, and — if you found us through a campaign — the source of your visit. The entry only takes effect once you click the confirmation link in our email (double opt-in); we log the time of that confirmation as evidence of your consent.

• Purpose: information about the product launch and early access.
• Legal basis: Art. 6 (1) (a) GDPR (consent). You can withdraw your consent at any time with effect for the future — informally by email to info@akku-brief.de; we then delete your entry.
• Retention: until you withdraw your consent, or until we close and delete the waiting list after the product launch.

6a. Press distribution list

In the press area you can add your email address to our press distribution list. You may optionally state your publication or editorial team.

Process: after you sign up we send a confirmation email. Only when you click the link in it do we add you to the list (double opt-in). Without confirmation you receive nothing from us.

Content: we use the list exclusively for press releases, never for advertising.

Legal basis: Art. 6 (1) (a) GDPR (consent). You can unsubscribe at any time; every email contains a link for this that works without any follow-up questions. After you unsubscribe we keep your address only in order to exclude it from future mailings.

Recipients: as with our other emails, Resend handles delivery (see section 8); the addresses themselves are held at Supabase (see section 15).

6b. Contact form

On the contact page you can send us a message. We process the details you enter there: your subject, name, email address, your message, plus the language of the page and the time.

• Purpose: reading and answering your message. We do not use what you enter in the form for advertising and do not add you to any distribution list with it.
• Legal basis: Art. 6 (1) (b) GDPR where the matter concerns a contract with us, otherwise Art. 6 (1) (f) GDPR — our legitimate interest in answering enquiries.
• Process: the message is stored at Supabase (see section 15) and additionally delivered to us by email via Resend (see section 8). We do not send an automatic reply.
• Retention: until your matter is settled and no statutory retention obligations stand in the way; we delete the message after twelve months at the latest.

Protection against misuse: the form contains a field invisible to you and checks how quickly it was submitted; we also limit the number of messages per address. This keeps automated submissions away. For this we store no IP address and use no third-party captcha.

7. Account and sign-in

Signing in to Akkubrief is passwordless. You have two options:

a) Sign in by email (sign-in link or numeric code). We send you an email with a single-use sign-in link and a numeric code. We process your email address, your account’s language choice and session-related technical data.

b) Sign in with Google. Alternatively you can sign in with your Google account. You are then forwarded to Google; after you confirm there, we receive your email address and basic profile data (name, profile picture URL) from Google. Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. You are only forwarded to Google if you actively choose this — simply visiting the website transfers no data to Google. Google is the controller for processing within your Google account: policies.google.com/privacy

Account data held by us: email address, preferred language, times of sign-ins, and the vehicles, orders and certificates linked to your account.

• Purpose: providing your account, linking vehicles, orders and certificates to it.
• Legal basis: Art. 6 (1) (b) GDPR (contract or pre-contractual measures).
• Retention: for as long as your account exists; on deletion see section 17.

8. Transactional emails (Resend)

We use the service Resend (Resend, Inc., USA) to send functional emails. This covers: the waiting list confirmation, sign-in emails (link/code), the notification once your battery history is sufficient for a certificate, purchase and certificate confirmations, and emails in the withdrawal process. Your email address, the subject and the message content (for example your sign-in code) are transferred. The certificate confirmation carries your certificate as a PDF attachment, so its content (vehicle data and measured values, see section 10) also passes through Resend.

• Legal basis: Art. 6 (1) (b) GDPR (contractual communication) or (a) (waiting list confirmation).
• A data processing agreement is in place with Resend; on transfers to the USA see section 15. We do not send advertising newsletters.

9. Vehicle connection and vehicle data

The core of our service is assessing the battery health of your electric vehicle from how it has actually been used.

a) Connection. You connect your vehicle yourself by signing in directly with the manufacturer (currently: Tesla, through the official Tesla Fleet API). Your Tesla credentials are entered exclusively with Tesla — we never receive them. From Tesla we receive only access tokens with pure read permissions (vehicle data). We cannot unlock, control or wake your vehicle. You can revoke access at any time in your Tesla account, or disconnect the vehicle in your Akkubrief account.

b) What we store.

• Vehicle identification number (VIN) — encrypted (AES-256-GCM); plus a checksum (SHA-256) for recognition without decryption,
• vehicle model, display name, nominal battery capacity,
• the access tokens — encrypted,
• regular data points: state of charge (%), energy remaining (kWh), odometer reading, displayed range, charging state (charging/not charging) with a timestamp.

c) How often. Our system queries connected vehicles roughly every six hours — and only when the vehicle is awake anyway; it is never woken. No location data is retrieved and no movement profiles are created.

• Purpose: building the battery history, calculating the state of health, issuing the certificate; notifying you once the data quality is sufficient for a certificate.
• Legal basis: Art. 6 (1) (b) GDPR (providing the service you requested, “battery history and certificate”).
• Retention: until 30 days after you disconnect the vehicle — immediately on request. On disconnection we stop the data transfer at the manufacturer, delete the access credentials for your vehicle account and end the recording; the vehicle record including the encrypted VIN, and the associated data points, then remain for another 30 days and are deleted automatically after that. The reason for this period: an accidental disconnection would otherwise be irreversible, and a battery history grown over months cannot be rebuilt. Reconnect within the 30 days and your existing history is available again; the time you were disconnected stays visible as a gap. In the disconnect dialogue you can choose immediate and complete deletion instead (Art. 17 GDPR). During the period the vehicle is no longer available to you or to us, and no new data is collected. Certificates already issued remain (section 10).

d) Country of registration. When you connect, we derive from your IP address the country the connection is made from and store it as a two-letter code (for example “DE”) on the vehicle record — the IP address itself is not stored for this. You can view and correct this in your account at any time; your own entry then takes precedence and is no longer overwritten automatically.

• Purpose: assigning the vehicle to country-based comparison and analysis groups (for instance: vehicles from the same country and climate are compared with one another, not across countries).
• Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in correctly delimited comparison groups and in a methodology that is honest about measuring conditions).
• Retention: as for the vehicle record — on disconnection both are deleted after 30 days, or immediately on request.

e) How you use the vehicle (optional). After you connect, we ask two short questions: who the vehicle is registered to (you privately, or your company or your employer) and whether it is bought or financed, leased, on a car subscription or rented — or that you do not know. Both answers are optional, and skipping the questions changes nothing about the service. If you do answer, we store the answer and the time it last came from you on the vehicle record. They stay your own statements: we do not check them and we ask for no proof.

• Purpose: working out where on the path from connection to certificate which groups of users drop out, and judging who the service works for.
• Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in evaluating and developing our own offering).
• No disclosure: the answer is not passed on to third parties. It appears in no certificate and affects neither the price nor access to the service.
• Changing and deleting: in your account the answer can be changed at any time or reset to “no answer”, which deletes it.
• Retention: as for the vehicle record — on disconnection both are deleted after 30 days, or immediately on request.

Tesla is the controller for data processing within the Tesla account and in the vehicle systems themselves: tesla.com/legal/privacy

9a. Statistics about our data base

Purpose: from the vehicle data we process for your certificate anyway, we form aggregated key figures about our entire data base — the number of connected vehicles, the sum of the vehicle kilometres we have observed, the number of measurement runs analysed (charges and drives) and the number of data points recorded. We publish these figures, for instance in the press area, in press releases and in the presentation of our methodology.

Scope: only sums and counts go into these figures. We publish nothing about individual vehicles or people. The values are rounded and are only published above a minimum number of contributing vehicles, so that individual vehicles cannot be worked back out.

Legal basis: Art. 6 (1) (f) GDPR. Our legitimate interest is to demonstrate the size, and hence the robustness, of our data base in a way others can follow. The processing serves statistical purposes (Art. 89 GDPR) with the safeguards described above.

Retention: if you disconnect your vehicle or delete your account, all that remains of these figures is an anonymous number — kilometres, the number of measurement runs, charging sessions and data points, vehicle model and period, with no link to you, your account or your vehicle identification number. There is then no longer any personal reference; we can no longer attribute these values to you either.

Objection: you can object to your vehicle being included in these figures at any time (Art. 21 GDPR). An informal message to info@akku-brief.de is enough; we then take your vehicle out of the analysis.

9b. Requesting the certificate of conformity from the Kraftfahrt-Bundesamt

Purpose: your battery health figure is a ratio, so it needs a reference value to be calculated against — the amount of energy your pack held when it left the factory. For some vehicles that value is not unambiguous, because two different battery packs shipped under the same model name. Which one is fitted follows from the certificate of conformity that the Kraftfahrt-Bundesamt, the German federal motor transport authority, holds for vehicles registered in Germany. In those cases we request that document ourselves. Without the request, the vehicles concerned either get no certificate at all or one with a wider uncertainty band.

What we pass on: the vehicle identification number (VIN) and nothing else. No name, address, contact details or measurements are passed on. The request is made by hand through the public enquiry service of the Kraftfahrt-Bundesamt, which is itself the controller for the processing on its side.

What we take from the document: the type identifier from field D.2 of the vehicle documents, the battery pack identifier derived from it, the number of driven axles, and the WLTP consumption and range figures, which serve us as a plausibility ceiling. We take no information about people from the document. We keep the original file in non-public storage, because it is the evidence for a reference value we have issued.

Legal basis: Art. 6 (1) (f) GDPR. Our legitimate interest is a documented rather than an estimated reference value, which decides whether a certificate can be issued at all and how precise it is. The balancing takes into account that the request uses only a figure your vehicle reports to us anyway, that it contains nothing about you as a person, that the document retrieved is a technical data sheet for the vehicle, and that the request serves the same purpose as the processing under section 9: your certificate. We previously obtained your consent for this; we changed that on 31 August 2026, because a question that could realistically only be answered “yes” delayed the matter without adding to anyone’s control over their data.

Retention: as for the vehicle record. If you disconnect the vehicle or delete your account, the document and the case are deleted with it — on disconnection after the 30-day period set out in section 9, or immediately on request. Certificates already issued remain and stay verifiable (section 10); they carry their figures signed within them and do not need the document for that.

Objection: you can object to this request at any time (Art. 21 GDPR). An informal message to info@akku-brief.de is enough. We then request nothing; if something has already been requested, we delete the document and its evaluation and stop using the reference value derived from it. Your vehicle is then calculated against the general figure for its model line, as before.

10. Battery certificate and public certificate page

When you buy a certificate, we create a cryptographically signed certificate from your battery history. The point of a certificate is to be shared — in a vehicle listing, say, or with prospective buyers. Every certificate therefore has a publicly accessible verification page (link, short code and QR code) that anyone who knows the link can open.

Visible on the public verification page: vehicle model and year of manufacture, masked VIN (first three and last four characters only), a shortened VIN checksum, odometer reading, health value (SoH/SoCE), usable energy, estimated range, rating class, date of issue and methodology version. Not included: your name, your email address, the full VIN or raw measurement data.

• Legal basis: Art. 6 (1) (b) GDPR — publishing the verification page is the core of the service owed under the contract; the page only comes into being if you have a certificate issued.
• Retention: certificates remain stored so they stay verifiable for as long as the service exists. On a withdrawal the certificate is revoked and marked as invalid.

11. Purchase and payment (Stripe)

We handle payment through Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin, Ireland; parent: Stripe, Inc., USA). When you buy, you are forwarded to Stripe’s payment page. Your payment details (for example your card number) are entered directly with Stripe and never reach us.

We transfer to Stripe: your email address, your language choice and internal references (order/consent ID, partner code where applicable). We store: order data (product, amount, currency, status, Stripe references, times) and a record of your checkout declarations (agreement to the terms and to immediate performance with the resulting loss of the right of withdrawal, § 356 (5) BGB — logged with the wording, its version and the time).

• Legal bases: Art. 6 (1) (b) GDPR (handling the purchase); Art. 6 (1) (c) GDPR (retention under commercial and tax law); Art. 6 (1) (f) GDPR or (c) in conjunction with Art. 7 (1) GDPR (evidence of the checkout declarations).
• Retention: accounting and order data for 10 years (§ 147 AO, § 257 HGB); records of consent and of the withdrawal instructions until possible claims have lapsed.
• Stripe privacy notice: stripe.com/privacy

12. Withdrawal from a purchase

If you exercise your right of withdrawal, we process your email address and the order reference in order to check and handle the withdrawal (confirmation link by email, refund through Stripe, revocation of the certificate). Withdrawal procedures are logged.

• Legal basis: Art. 6 (1) (b) and (c) GDPR.
• Retention: as for order data (section 11).

13. Partner referrals

If you come to us through a partner’s referral link, we store the partner code for 30 days in a functional first-party cookie (ab_ref) and attach it to the order if you buy, so that the partner can be paid. No usage profiles are built and no data is passed to the partner — the partner only learns the number of purchases attributed to them, not who you are.

• Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in settling referrals).

13a. Where your first visit came from (campaign attribution)

We remember how you found us. Not in order to recognise you, but in order to know which route leads people to us. When you first open our site we create a functional first-party cookie for this (ab_attr, 90 days) and store in it:

• the campaign details from the link address, if you arrive through a campaign link (utm parameters, click identifiers such as “gclid”),
• the domain of the page you came to us from (for example “tff-forum.de”), provided your browser transmits it — the domain only, never the full address and therefore never search terms or post titles,
• the page you entered on, and the date of your first visit.

This is written on your first visit only and not changed afterwards. If you sign in, we attach it to your account once; if you buy, to the order as well. No third-party script is loaded for this, no usage profiles are built and, at present, no data is passed to advertising networks. Should we in future report completed purchases back to an advertising provider (Google Ads, say), we will update this notice beforehand.

• Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in knowing by which route prospective customers reach us).
• Retention: the cookie for 90 days; the entry attached to an account for as long as the account exists and deleted with it (section 11); entries attached to an order as for order data.

14. Taking part in the field study

If you apply for or take part in our field study on battery assessment, we additionally process the data listed below. Participation is voluntary; you suffer no disadvantage if you do not apply or take part.

• When applying: email address, vehicle model, year of manufacture, variant, battery type, mileage as a range, charging behaviour, the first two digits of your postcode, your own assessment of the battery condition and what you write in the free-text field. We deliberately do not collect a full postcode.
• When taking part: the vehicle data from section 9 — state of charge, energy remaining, odometer reading, charging sessions, battery temperature, timestamps and the technical origin of the readings — plus your consent with a checksum of its wording, its version and the time.
• Purpose: scientific analysis and publication of the study, and issuing your certificate.
• Legal basis: your consent under Art. 6 (1) (a) GDPR. You can withdraw it at any time with effect for the future; the lawfulness of processing up to that point remains unaffected.

Publication. We publish results exclusively in pseudonymous and aggregated form — without names, without vehicle identification numbers and without locations. During the study we keep a public vehicle identifier of the form “S-017” with model, year of manufacture and mileage range. This serves verifiability: it is the only way to check that every participating vehicle was included in the final analysis. This list contains no personal details.

Withdrawal and its limits. After a withdrawal we delete your personal study data and remove you from future analyses. We cannot take back aggregated results that have already been published. A certificate already issued is unaffected and remains valid.

Retention. We delete raw vehicle data from the study 24 months after the study ends. The pseudonymous analysis dataset remains permanently as the basis of the publication. Application data from people who do not take part is deleted no later than three months after the study ends.

Recipients. For operation and storage we use the same processors as for the rest of the service (section 15). Study data is not passed to third parties. Should an independent comparison measurement by a third party be added in a later phase of the study, we will obtain separate consent for it beforehand.

Your rights under section 18 apply unchanged. You can download your own vehicle data as a file yourself at any time during the study.

14a. Anonymous fleet analyses (part of the free offering)

Purpose and the open deal. The free battery check is not funded by advertising or by selling data, but by counting: every connected vehicle counts anonymously towards our fleet analyses — aggregated comparison values, analyses and publications about the vehicle fleet we observe. For this we use the technical data of your connected vehicles (charging, battery and odometer data) in anonymised, aggregated form; this also applies to data stored before 28 August 2026. Since 28 August 2026 we no longer ask for separate consent for this — consent given earlier is kept as evidence for the analyses carried out up to that point.

• Anonymity: only group values with a minimum group size are reported (at least 30 vehicles per reported group); VIN, name and location never go in (we do not collect your location), and we publish nothing about individual vehicles. Individual data is neither passed on nor licensed to third parties; we would obtain separate consent beforehand for that.
• Legal basis: Art. 6 (1) (f) GDPR. Our legitimate interest is to provide robust anonymous fleet analyses — they are the core of the free offering and what funds it. The processing serves statistical purposes (Art. 89 GDPR) with the safeguards described above. Storage of the vehicle data itself continues to follow section 9 (contract).
• Ending it and objecting: if you disconnect your vehicle, the contribution ends straight away — the vehicle data is deleted after the period set out in section 9. You can also object to inclusion in fleet analyses at any time (Art. 21 GDPR); an informal message to info@akku-brief.de is enough, and your vehicle will no longer count in future analyses. Before each publication we recalculate from the state at that time; aggregated results already published cannot be taken back.

14b. Cold-climate panel (an agreement with consideration)

For vehicles registered in Nordic countries we offer a limited number of places in our cold-climate panel. Taking part is an agreement: we use the technical data of the enrolled vehicle (charging, battery and odometer data) in anonymised, aggregated form for analyses, in particular to test a temperature correction; in return the vehicle receives a battery certificate free of charge, once. The text of the agreement is shown in full when you enrol; as evidence we store the time, the wording (checksum and version number), the place number and the link to your account and vehicle.

• Scope: the agreement also covers data stored for this vehicle before you joined — this is stated expressly in the text. The same anonymity rules apply as in section 14a (group values with a minimum group size only, no disclosure of individual data).
• Legal basis: Art. 6 (1) (b) GDPR (performance of the panel agreement); for panel participation the use of data is part of the agreed exchange — with the free certificate as an additional consideration, standing on its own alongside the general fleet contribution under section 14a.
• Ending it: you can leave the panel at any time with effect for the future (the “Cold-climate panel” section in your account) or disconnect the vehicle. A certificate already issued remains; a claim not yet redeemed ends — both are stated verbatim in the agreement.
• Redemption window: you can claim the free certificate for two years from the day you join. After that the claim to it ends; your place in the panel carries on until you end it. This too is stated verbatim in the agreement.

15. Recipients and transfers to third countries

We use the following processors and recipients:

Where personal data is transferred to the USA or other third countries in this context, we rely on the adequacy decision for the EU-U.S. Data Privacy Framework (DPF), under which Google LLC, Stripe, Inc. and Vercel Inc. among others are certified, and otherwise on EU standard contractual clauses (Art. 46 (2) (c) GDPR).

No transfer to other third parties takes place unless we are legally obliged to do so (for example towards tax or law enforcement authorities).

16. Data security

• All connections are TLS-encrypted.
• The VIN and manufacturer tokens are stored encrypted with AES-256-GCM; the key is held separately from the database.
• The private signing key for certificates is held in a protected key store (vault) and never leaves it.
• Database access is restricted by row-level security to the respective account holder.
• The principle of data minimisation applies: no location data, no movement profiles, no raw VIN in the certificate.

17. Retention and deletion

Unless stated otherwise above, the following applies:

You can request deletion of your account informally by email to info@akku-brief.de. We then delete your account and all associated data, unless statutory retention obligations stand in the way (such data is blocked from further processing).

18. Your rights

You have the following rights against us regarding your personal data:

• access (Art. 15 GDPR),
• rectification (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• withdrawal of consent given (Art. 7 (3) GDPR) — with effect for the future, without affecting the lawfulness of processing up to that point.

Right to object (Art. 21 GDPR): where we process data on the basis of legitimate interests (Art. 6 (1) (f) GDPR), you can object at any time on grounds relating to your particular situation. We will then stop processing the data unless there are compelling legitimate grounds.

An informal email to info@akku-brief.de is enough to exercise these rights.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR) — in particular in the Member State of your residence, your place of work or the place of the alleged infringement.

19. No automated decision-making

There is no automated decision-making with legal effect for you and no profiling within the meaning of Art. 22 GDPR. The battery health value is a technical assessment of the vehicle, not of you as a person.

20. Whether providing data is required

Providing your email address is required for the account, the waiting list and a purchase; without it we cannot deliver the respective service. Connecting a vehicle is a precondition for the battery history and the certificate. All other details are voluntary.

21. Changes to this privacy policy

We update this privacy policy when our service or the legal situation changes. The version published here at the time applies; the date of the last change is at the top of this document.

← Back to the homepage