Privacy Policy

Jinx Charge Inc. (CBCA Corporation No. 1836563-6, incorporated November 6, 2026) Registered office: 8 Red Pine Cres, Tiverton, Ontario N0G 2T0, Canada Privacy Officer: [email protected]

Version 1.0 · Effective November 11, 2026

This is the public-facing Privacy Policy of Jinx Charge Inc. ("Jinx", "we", "us", "our"). It governs how we collect, use, disclose, safeguard, and retain personal information when you visit our website, create an account, and connect your residential electric vehicle (EV) or charging station to our platform. It operates alongside — and is strictly consistent with — the separate Data-Ownership & Express Consent Agreement you accept when you enroll your vehicle or charger.

Jinx aggregates residential EV charging telemetry to create and verify compliance credits under Section 102 of the federal Clean Fuel Regulations (SOR/2022-140). We collect, use, disclose, and retain your personal information solely to administer your account and to measure, report, and verify carbon-credit eligibility under Canadian environmental law.

• We never use your personal information for targeted advertising.
• We never sell, rent, or trade your personal information to any third party.
• Because federal law mandates a strict ten-year audit trail for compliance-credit records (Clean Fuel Regulations s.166(1)), historical charging telemetry and supporting records must be retained for 10 years and cannot be deleted early — even if you withdraw consent or close your account.

1. Accountability

Jinx Charge Inc. is responsible for all personal information in our custody or control. We have designated a Privacy Officer (who also serves as the Person in charge of the protection of personal information for Quebec residents) as the individual accountable for our compliance with applicable privacy laws, including the federal Personal Information Protection and Electronic Documents Act ("PIPEDA") and Quebec's Act respecting the protection of personal information in the private sector (as modernized by Law 25).

Contact: [email protected], or by mail at Jinx Charge Inc., Attn: Privacy Officer, 8 Red Pine Cres, Tiverton, Ontario N0G 2T0, Canada.

When we engage contracted service providers (such as cloud hosts or database processors), Jinx remains fully accountable for that personal information. We use binding written data-processing agreements requiring safeguards comparable to ours, prohibiting any secondary use or sale of your data, and restricting access to authorized personnel on a need-to-know basis.

2. Identifying purposes and the data we collect

We identify our purposes at or before the time we collect personal information, and our purposes are limited to what a reasonable person would consider appropriate.

2.1 What we collect

We collect only eight (8) core charging-telemetry and eligibility data types and four (4) account-administration data types:

2.2 Two strict technical exclusions

1. We never see or store your Tesla (or other manufacturer) password. You authenticate directly on the manufacturer's own login screen using OAuth, which issues only a revocable token to us.
2. We never track your vehicle while driving. We collect charger GPS coordinates (to 5 decimal places) only during active charging sessions, to verify the stationary residential location — never while your vehicle is in motion.

3. Consent

3.1 Express, informed, unbundled consent

We obtain your express, informed, and unbundled consent via our separate Data-Ownership & Express Consent Agreement before collecting any personal information or connecting to your vehicle or charger. Because residential charger GPS coordinates and vehicle telemetry may be sensitive, we rely strictly on express opt-in consent presented in plain, unbundled language.

3.2 Mandatory condition of service

Consenting to the collection, use, disclosure, and 10-year retention of these data types is a mandatory condition of using Jinx's carbon-credit aggregation service — the service cannot exist without collecting, verifying, reporting, and retaining these specific elements. We do not require you to consent to any collection beyond what is required to fulfill these explicit, legitimate regulatory purposes.

3.3 Withdrawing consent

You may withdraw consent at any time by disconnecting your integration, revoking Jinx's OAuth access in your manufacturer's account settings, or emailing [email protected]. Withdrawal immediately stops all future collection. However, historical telemetry already recorded cannot be deleted until its 10-year statutory retention period expires (see Section 4.3).

4. Limiting collection, use, disclosure, and retention

4.1 Limiting collection

We collect only the 12 data types listed in Section 2.1 — nothing more.

4.2 Limiting use and disclosure (no sale, no advertising)

We use your personal information solely to administer your account and to quantify, report, and verify compliance credits. We never use it for marketing, profiling, or targeted advertising, and we never sell, lease, rent, or trade it to data brokers, automakers, insurers, or any other third party. We disclose personal information only to three strictly defined categories of recipients, and only to the extent necessary:

1. Environment and Climate Change Canada (ECCC) — mandatory regulatory reports and records.
2. Accredited ISO 14064-3 verification bodies — credit-creation reports, monitoring plans, and underlying telemetry required for the mandatory independent audit.
3. Contracted service processors — encrypted hosting/processing on our behalf, under contracts guaranteeing comparable protection and prohibiting secondary use.

Buyers of our credits (e.g., fuel suppliers) receive only aggregated credit units — never your personal information, VIN, GPS coordinates, or session logs.

4.3 The mandatory 10-year retention rule

Under the Clean Fuel Regulations (s.165 and s.166), we must record compliance information within 30 days and retain all records, reports, plans, and supporting documents for 10 years. This is a legal obligation, not our choice — we cannot delete your charging history even at your request, because it underpins the compliance credits and must remain auditable for the full 10-year window. After that period, it is permanently and securely destroyed or irreversibly anonymized.

Active OAuth tokens, by contrast, are retained only while your integration is connected and are revoked and purged immediately upon withdrawal or disconnection.

5. Accuracy and safeguards

5.1 Accuracy

We ingest charging telemetry directly from your charger or vehicle via authenticated OAuth connections and record it within 30 days of availability. You may update your account information at any time through your account settings or by contacting [email protected].

5.2 Safeguards

We implement four core safeguards:

• Append-only hash-chained ledger — once telemetry is ingested and validated, it is written to a tamper-evident, cryptographically hash-chained archive, preventing retroactive alteration or deletion during the 10-year window.
• Encryption in transit and at rest — across networks, databases, and archives.
• Credential segregation and password hashing — passwords stored strictly as hashes; vehicle/ charger connections use revocable OAuth tokens.
• Role-based access controls — access restricted on a need-to-know basis with audit logging and staff confidentiality training.

5.3 Breach notification

If a breach of security safeguards creates a real risk of significant harm, we will notify affected individuals and the Privacy Commissioner of Canada (and the Commission d'accès à l'information du Québec where applicable) as soon as feasible, and maintain a record of every such breach.

6. Openness

This Privacy Policy is published openly and in plain language. Whenever we make material amendments, we publish the updated version with a new version number and effective date and notify registered users.

7. Individual access and correction

You have the right to request confirmation of whether we hold personal information about you, to receive a copy, to be informed of how it has been used and disclosed, and to request corrections. We respond in writing within 30 days. Contact [email protected].

• Account-administration data (name, email, credentials): corrected directly upon verification.
• Raw charging telemetry (committed to the immutable audit archive): cannot be overwritten or deleted retroactively without breaking the cryptographic chain and the audit-trail integrity the law requires. Instead, we fulfill corrections by appending a linked, timestamped corrective amendment record.

8. Challenging compliance

You may challenge our compliance at any time by contacting our Privacy Officer at [email protected]. We investigate every complaint and take corrective measures where justified. If you are not satisfied, you may file a complaint with the Office of the Privacy Commissioner of Canada (www.priv.gc.ca) or your applicable provincial privacy commissioner.

9. Additional provisions for residents of Quebec (Law 25)

For Quebec residents, the collection, use, communication, protection, and retention of personal information are also governed by Quebec's Act respecting the protection of personal information in the private sector (as modernized by Law 25).

• Person in charge: our Privacy Officer exercises this function and can be reached at [email protected].
• Separate, express consent and location notice: we publish this policy in clear and simple language and obtain your separate, manifest, free, and enlightened consent before activating any technology that identifies or locates your charger. Location capture is inactive by default.
• Communication outside Quebec: because our operations are in Ontario and our reports go to federal regulators, your information may be communicated outside Quebec. Before doing so, we conduct a Privacy Impact Assessment and use binding written agreements ensuring adequate protection.
• Retention: consistent with Section 23, we retain historical telemetry for the 10-year federal preservation period before destroying or anonymizing it.
• Your rights: access, portability in a structured format, and rectification, with recourse to the Commission d'accès à l'information du Québec (CAI).
• French version: a complete French version (Politique de confidentialité) is available on our website and upon request.

10. Corporate entity

• Legal name: Jinx Charge Inc.
• Incorporated: November 6, 2026, under the Canada Business Corporations Act (No. 1836563-6)
• Registered office: 8 Red Pine Cres, Tiverton, Ontario N0G 2T0, Canada
• Privacy Officer: [email protected]
• Version: 1.0 · Effective November 11, 2026