EXPanda privacy policy

Who we are

EXPanda is an independent project that adds features to the Geely EX2 head unit and has a phone app that talks to it. It does not belong to Geely or to any carmaker. The data controller is the project maintainer, in Porto Alegre (RS), Brazil.

What we keep

• From your Google account, only what you authorize when signing in (the basic scopes: identity, e-mail and profile): the account identifier, the e-mail and whether it is verified, the full name, the first and last name, the photo address, the language and, for a business account, the domain. We do not receive your password and do not ask for access to anything else (no contacts, no calendar, no e-mails).
• The devices you sign in on: a code generated by the app itself on your phone, the device name and system; and, when you link a car, the head unit's serial number and the chassis number it reports.
• The record of what happens in the account: when it was created, when you signed in, linked or removed a device, and whether it was blocked or unblocked.
• Downloads and updates: every time a device downloads an EXPanda app or update, we keep the account, the car (the head unit's serial number and the chassis number), the IP address, the app, the version and the time; when the head unit finishes an update or detects an integrity violation, it reports with the same data. Every app delivered carries an encrypted mark, readable only by the project, with the account and the car it was delivered to.
• Your car history: your trips (from where to where, on which day and at what time, and the route), your charging sessions (where and how much), the costs you note down, the periods the car stayed parked, the places you save (such as Home and Work) and the values you set (tariff, fuel price, income). They are tied to your account on our server; only you, signed in to your account, and the project team, when you ask for support, can see them.

Outside that log, the IP address of whoever calls the service is used only at that moment, to limit abuse, and is not stored.

What we use it for

• To identify your account and unlock the app and the updates for its devices.
• To link your car to the account, so that only it receives what belongs to it.
• To apply the account's access level and to block misuse (a stolen device, a copy sold without authorization).
• To help you when you ask for support.
• To control the distribution of the apps: know who downloaded and who updated each version, and trace the source of a copy distributed without authorization.
• Show the same history, costs and places on more than one device and on the website, so you do not lose them when you change phones.

The legal basis (LGPD, Brazil's General Data Protection Law, art. 7) is the performance of the service you request when you create the account, the legitimate interest in keeping it secure and, for the download log, the regular exercise of the project's rights against unauthorized distribution. We do not use your data for advertising.

Who we share it with

No one, except the measurement tools you accept (see “Cookies and audience measurement”). We do not sell or hand over data. Google only confirms who you are when you sign in. The team's internal notices go through Telegram and carry only the account and car codes, never the chassis number, the serial number or the IP. The data stays on the project's own server, in Brazil, with a backup in the same place, and only the project team, with restricted access, sees it.

For how long

While the account exists. When you delete the account, your personal data, devices and cars are erased right away; the account's event log is left with no details, tied to a code that points to no one. The download and update log is the exception: it is kept with no time limit, also after the account is deleted, only for the team, to control the distribution of the apps and defend the project's rights. Old backups rotate on their own and disappear over time. Your car history is kept with no time limit, until you delete a record or delete the account; when you delete the account it is erased immediately, and backups carry it for up to 14 days.

The fleet and remote support (only with your switches)

In the EXPanda settings on the head unit there are four switches, all turned off from the factory. Nothing below happens unless you turn on the matching switch on the car's screen, and turning it off stops it at once:

• "Connect this car to the EXPanda fleet": the head unit keeps a connection with the project's server and reports that it is online, its version, the kind of network (Wi-Fi, Personal Hotspot or mobile network) and how the other switches are set. We keep only the latest state, not a history.
• "Show the car's position in the fleet": the head unit sends the last position it already knows (it does not turn on the GPS for this). We keep the track, with no time limit, only for the team with top-level access, who can see it and delete it; turning the switch off stops sending and removes the car from the map, and the track already kept stays until the team deletes it or the account is deleted.
• "Allow remote support": the team can request the head unit's status, its black box and its logbook, which are its operating log (versions, connections and errors), and a photo of the screen (the screen shows a notice for each photo, and the head unit refuses it during a call). The last 50 uploads of each car are kept, and only the last 10 photos.
• "Allow technical access (ADB)": the team can open a technical session of up to 2 hours on the head unit, only with an order signed by a key that is kept off the server. The head unit shows on screen when the session opens and when it closes.

The phone app has the first two switches, also turned off from the factory, on the account screen: "Connect this phone to the EXPanda fleet" (it reports that the phone is online, the app version and the kind of network; on Android, while the switch is on, with a persistent notification; on iPhone, only while the app is open) and "Show this phone's position in the fleet" (only with the phone connected to the head unit, in the car: it sends the last position the app has already measured for trips, without turning on the GPS; the server keeps the track under the same conditions as the car's). The phone has no remote support or technical access: the team can only ask for its status.

Every request from the team is recorded in your account. When you delete the account, the connection drops, and the status, position, track and uploads of the car and of the phone are erased.

Cookies and audience measurement

The site uses necessary cookies (your session, the language, the theme, the notice you accepted or declined, and the partner link or invitation you arrived with). They keep the site working and do not ask for consent. Your browser also keeps, in its local storage, the language you chose and the language notice you dismissed: it is only your preference and never leaves your browser. Everything else is optional and stays off until you choose, in the notice shown on your first visit. Choosing is equally easy both ways: Accept all, Reject all or Customize; and you can change your mind at any time under Privacy preferences, in the footer. Revoking deletes the measurement cookies at once. Your choice lasts 12 months and is kept in a cookie of this site; if this policy changes, we ask again.

The site may use the tools below; each one runs only if the project has turned it on and, when it asks for your consent, only after it. They run only on public pages (the home page, the guides, the terms and this policy), never after you sign in to your account or in the panel.

• EXPanda's own measurement (no third parties, on the project's server): counts page views and clicks on the main buttons (download, talk on WhatsApp, create the account), the type of device (phone or computer), the language and the site or campaign you came from (only the address of the referring site and the campaign tags, such as utm_source). It does not keep your IP or your full browser identification: an anonymous identifier for the day, computed with a key that is changed and deleted every 24 hours, counts the day's unique visitors without identifying anyone. No cookie. Anonymous records are kept for 400 days. With your acceptance of Measurement, a cookie of this site (expanda_toque, 90 days) remembers which campaign you came from (only the utm_source, utm_medium and utm_campaign marks of the link) until you create the account; without that acceptance the cookie does not exist and the account is created with no origin recorded. Legal basis: legitimate interest in anonymous measurement; your consent for what uses cookies.
• Cloudflare Web Analytics (Cloudflare, Inc.): measures visits and page loading time. According to Cloudflare, it uses no cookies and does not keep your IP. It runs without asking for consent; legal basis: legitimate interest in the site's performance. If you do not want it, use a content blocker in your browser or contact us (see Your rights).
• WhatsApp button (WhatsApp, from Meta): when the button shows in the footer, tapping it opens a chat on WhatsApp with a ready-made message that ends with a short origin code (for example, the name of the network or site you came from) so we know how you arrived; you can delete it before sending, and you are the one who sends the message. Nothing from WhatsApp is loaded until you tap the button. The tap is counted like any other button on the site (without your number and without an account). The chat then follows WhatsApp's own policy.
• Google Analytics 4 (Google): only with your acceptance of Measurement. Counts visits and page views and shows where people came from. It stores Google cookies (_ga and _ga_…, for up to 2 years, a period set by Google) and receives what your browser sends to any site (the IP, which Google uses to estimate country and city, and the browser). We do not send Google your name, email, phone, account code, chassis number or serial number. Rejecting or revoking deletes the cookies, and the tool stops loading.
• Meta Pixel and Conversions API (Meta): only with your acceptance of Marketing. They measure the results of EXPanda's campaigns on Instagram and WhatsApp (for example, whether someone who clicked an ad created the account). They store Meta cookies (_fbp and _fbc, for up to 90 days) and receive what the browser sends to any site (IP and browser), plus the page, the event (such as "account created") and the ad click code. We do not send Meta your name, email, phone, account code, chassis number or serial number. Rejecting or revoking deletes the cookies, and the tool stops loading.

When you sign in, create the account, activate the head unit or download an app, the project's server records that step in your account log, which only the team sees (as described above); if you accepted Measurement, it also records where you came from on your first visit. None of this is sent to Google, Meta or Cloudflare. The basis is the same as for the service: carrying out what you asked for and keeping it secure.

Your rights

• See what we keep: in the app, under "EXPanda account".
• Correct your name, photo or e-mail: in your Google account; we update it on your next sign-in.
• Delete everything: in the app, under "EXPanda account" → "Delete my account".
• Remove EXPanda's access to your Google account: at myaccount.google.com, under Security → Third-party apps.
• Download and delete your history: on the website, on the car history page, you can see it, download a copy as JSON or as a spreadsheet, and delete any record.

Questions or requests about your data: through the app itself, under "EXPanda account".