Privacy policy

1. Controller and contact

The controller for this processing is Beam to Car, Hesse, Germany.

Privacy requests: beam@beamtocar.com

2. Purposes and legal bases

We process data to provide the link transfer you start between your phone and Tesla, keep the service secure, limit abuse, and measure the use of public landing pages in aggregate.

The legal bases are Article 6(1)(b) GDPR to provide the requested service and Article 6(1)(f) GDPR for operation, security, abuse prevention, and privacy-conscious audience measurement. Our legitimate interest is the secure, reliable, and appropriate operation of Beam to Car.

3. Data we process

When you use the service, we process a random session or channel token, timestamps, connection status, and the web or meeting links you send. Links can contain personal information, so only send links that you intend to transfer to the Tesla session connected to the QR code or to your private channel.

Sent links are not part of Vercel Web Analytics or application logs. Audience measurement covers public language landing pages only, never private session or Tesla paths.

QR sessions use end-to-end encryption: the server relays only unreadable ciphertext. This protects data and later logs, but not a browser-code delivery path that has already been compromised.

To limit abuse, we process the IP address in a time-limited counter. Technical hosting logs may also contain an IP address, time, requested URL, and browser data.

4. Retention

QR session data and sent links exist only in volatile process memory and expire 15 minutes after the last activity. For permanent channels, the latest link is held for up to 60 minutes in a technically necessary, automatically expiring transport buffer so that the sender and Tesla display can reliably connect across separate hosting instances. There are no link analytics, application logs, or backups for links. IP-based abuse-prevention counters expire after one hour. The language preference is stored locally in the browser and in a cookie named nlang for up to one year. Hosting-log retention follows the hosting provider's retention periods.

5. Recipients and hosting

Beam to Car is hosted by Vercel. Permanent connections use a managed Redis transport buffer with a short automatic TTL; it contains only the latest sent link and no channel directory or history. The hosting provider processes technical data where required for hosting, delivery, and security.

Depending on the processing location, a transfer to a third country may take place. Where this happens, appropriate safeguards, including Standard Contractual Clauses, are used.

6. Cookies, local storage, and audience measurement

We use technically functional storage for your language preference (nlang and linkbeam.locale). Vercel Web Analytics measures only public language landing pages in aggregate. It does not use cookies; private tokenized session and Tesla paths, API paths, and legal pages are excluded from measurement.

We do not use marketing, profiling, or advertising cookies.

Tesla Referral and Buy Me a Coffee links open external websites only after you click them. Those websites apply their own privacy notices.

7. Your rights

Subject to the GDPR, you have rights of access, rectification, erasure, restriction, portability, and objection to processing based on Article 6(1)(f) GDPR. To exercise them, contact beam@beamtocar.com.

You also have the right to lodge a complaint with a data protection authority. The authority responsible at Beam to Car's location is the Hessian Commissioner for Data Protection and Freedom of Information.

8. Changes

We update this policy when service features, data processing, or legal requirements change.