Privacy notice
Effective 12 October 2026. Applies to livechargemap.com, its map, API and developer portal.
1. Summary
- You can use the map without an account. We do not use advertising or tracking cookies, we do not build profiles, and we do not sell or share personal data for advertising.
- We hold a small amount of personal data, only where a feature needs it. Examples are your email address if you register as a developer or connect an OCPI feed, and IP addresses kept for security and abuse prevention.
- Charging-station information comes from charge point operators and roaming hubs. It describes places and equipment, not people.
- Our servers are in India (Mumbai). You can ask us to access, correct or delete your data. Write to [email protected].
2. Who we are
livechargemap.com is operated by livechargemap.com ("we", "us"). We decide how and why the personal data described here is processed. That makes us the Data Fiduciary under India's Digital Personal Data Protection Act, 2023 ("DPDP Act"), and the controller under the EU and UK General Data Protection Regulation ("GDPR").
Contact for privacy questions, requests and grievances: [email protected] (Grievance Officer, LiveChargeMap).
3. What we collect, why, and our legal basis
3.1 Everyone who visits the site
| Data | Why | Legal basis |
|---|---|---|
| IP address, browser type and request details (URL, time). These are processed when your browser connects. | Delivering pages, protecting the service against abuse and attacks, and rate limiting. | GDPR Art. 6(1)(f) legitimate interests (running a secure service). DPDP: data you voluntarily provide by making the request, used only for that purpose (s. 7(a)). |
| Search text you type into the map search. | Finding places. Our server forwards the text, but not your IP address, to the OpenStreetMap Nominatim geocoder. | Legitimate interests / performing the search you asked for. |
| Your device location, only if you press Near me and your browser allows it. | Centring the map. The coordinates stay in your browser. Our server only receives the map area being shown, to return stations in it, and does not store it. | Your action and browser permission (consent), which you can withdraw in your browser settings. |
| Aggregated, cookie-free page statistics (Cloudflare Web Analytics). | Understanding which pages are useful. No cookies, no cross-site tracking, no individual profiles. | Legitimate interests. |
3.2 If you report a problem with a station
We collect your message, an email address if you choose to give one, and the IP address the report came from. We use them to check and fix the listing, to reply to you if you asked us to, and to prevent spam. Legal basis: legitimate interests (keeping the map accurate). Your email is optional.
3.3 If you connect an OCPI feed (charge point operators and roaming hubs)
We collect:
- your contact email and organisation name;
- the authority statement and licence terms you provide;
- the Locations endpoint URL;
- your access token ("Token C");
- the IP address the submission came from.
We use them to:
- verify your email;
- review and run the feed;
- contact you about it;
- keep an audit trail.
Your access token is encrypted with a public key the moment our website receives it. Only the background service that fetches your data holds the matching private key, so the website itself cannot read the token back, and staff never see it. Legal basis: performing our arrangement with you (GDPR Art. 6(1)(b)) and legitimate interests. DPDP: data you voluntarily provide for this purpose (s. 7(a)).
3.4 If you register as a developer (API)
We collect:
- your email address;
- the IP address you registered from;
- sign-in sessions;
- your API keys, stored only as one-way hashes, so we cannot see them after creation;
- an API request log (time, endpoint, status, IP).
We use them to:
- send sign-in links;
- provide the API and count your quota;
- prevent abuse (for example, multiple free accounts);
- show you your own usage.
Legal basis: performing the contract for API access (GDPR Art. 6(1)(b)) and legitimate interests (abuse prevention).
3.5 Emails we send
We send verification links, sign-in links and messages about your feed or report. We do not send marketing email.
We do not collect:
- names (unless you put one in a message);
- phone numbers;
- payment details;
- government identifiers;
- vehicle data or charging-session data;
- any sensitive or special-category data.
We do not make automated decisions that have legal or similarly significant effects on you.
4. Charging-station data
Station listings come from charge point operators and roaming hubs over the OCPI protocol. They include the location, address, operator, connectors, opening hours and live status, and describe infrastructure rather than individuals.
In rare cases a listing can relate to a person, for example a charger at a private home or a name used as a station title. If you believe a listing reveals personal data about you, write to [email protected]. We will suppress it from the map and the API while we check with the data provider.
5. Cookies and local storage
We use only cookies that are strictly necessary for security or for a feature you asked for. Because of this, we do not show a cookie-consent banner.
| Name | Purpose | Lifetime |
|---|---|---|
lcm_csrf | Protects forms against cross-site request forgery. Contains a random value only. | 24 hours |
lcm_dev | Keeps a developer signed in to the portal. Set only after you sign in. | 30 days |
lcm_admin | Administrator sign-in (staff only). | 12 hours |
| Local storage: last map view | Reopens the map where you left it. It stays on your device and is never sent to us. | Until you clear site data |
Cloudflare may set strictly necessary security cookies (for example __cf_bm) to tell people from bots. See Cloudflare's cookie policy.
6. Service providers and other recipients
We use these providers to run the service. They process data on our instructions or, where noted, receive your connection directly from your browser:
- Cloudflare, Inc.: content delivery, DNS, network security and cookie-free web analytics. All traffic passes through Cloudflare.
- BigRock / Oracle Cloud Infrastructure: our server in Mumbai, India, which holds the database.
- Amazon Web Services (Amazon SES, Mumbai region): delivery of the emails we send.
- OpenStreetMap Foundation (Nominatim): place search. It receives the search text from our server, not your IP address.
- OpenFreeMap (map tiles) and jsDelivr (map and documentation scripts). Your browser downloads these directly, so these providers see your IP address under their own privacy policies.
Station data, which is not personal data, is shown publicly and through our API. We disclose personal data to authorities only when the law requires it. We do not sell personal data, and we do not share it for cross-context behavioural advertising.
7. Where data is stored and international transfers
Our database and email processing are in India (Mumbai). Cloudflare operates a global network, so your connection may be handled at a Cloudflare location near you.
For transfers of personal data from the EU/EEA, UK or Switzerland, we rely on the safeguards offered by our providers, such as the European Commission's Standard Contractual Clauses and Cloudflare's EU-US Data Privacy Framework certification. India does not currently have an EU adequacy decision. Transfers out of India follow the DPDP Act and any restrictions notified under it.
8. How long we keep data
| Data | Retention |
|---|---|
| Rate-limiting counters (IP-based) | Up to 24 hours |
| Sign-in sessions (developer, admin) | Until expiry (30 days / 12 hours), then deleted |
| Email verification and sign-in links | Links valid 15 minutes (developer sign-in) or 24 hours (feed verification); records deleted 30 days after expiry |
| Developer sign-ups that are never verified | Deleted after 30 days |
| API request logs (including IP) | 90 days |
| Copies of emails we sent (delivery log) | 90 days |
| IP addresses in the audit log and in problem reports | Removed after 180 days |
| Developer accounts, operator feed contacts and problem reports | While the account, feed or listing is active, or until you ask us to delete them, unless we must keep a record to meet a legal obligation |
| Database backups | 14 days, then overwritten |
9. Security
We protect data with the following measures:
- encryption in transit (HTTPS, TLS 1.2+);
- sealed-box encryption for operator access tokens;
- one-way hashing of API keys, sessions and sign-in links;
- Argon2id password hashing for staff;
- access controls and audit logging for administrative actions;
- least-privilege containers;
- regular backups.
If a personal data breach occurs, we will notify the affected people and the authorities where the law requires it. This includes the Data Protection Board of India and the relevant EU or UK supervisory authority.
10. Your rights
Wherever you are, you can ask us to:
- confirm whether we hold your personal data and give you a copy or summary;
- correct, complete or update it;
- delete it (unless we must keep it by law);
- stop or restrict a particular use, or object to processing based on legitimate interests;
- give you your data in a portable format (developer and operator account data);
- withdraw consent where we rely on it. This does not affect processing before withdrawal.
Email [email protected] from the address linked to your data, or tell us which data you mean. We may need to verify your identity. We will reply within 30 days, and sooner where the law requires it. Exercising your rights is free, and we will not treat you differently for doing so.
11. India: Digital Personal Data Protection Act, 2023
- Notice and purpose. This notice sets out the personal data we process and why. We process it only for the purposes stated, either on the basis of data you voluntarily provide for a specified purpose (s. 7(a)) or with your consent.
- Your rights (ss. 11–14): access a summary of your data and of the processing, and the identities of those it was shared with; correction, completion, updating and erasure; grievance redressal; and nomination of another person to exercise your rights if you die or become incapacitated.
- Grievances. Contact Grievance Officer, LiveChargeMap at [email protected]. We will acknowledge your grievance promptly and resolve it within the period set by the DPDP Rules, and in any case within 90 days. If you are not satisfied, you may complain to the Data Protection Board of India after using our grievance process.
- Your duties (s. 15): do not give false information or impersonate someone else, and do not file frivolous complaints.
12. EU, EEA and UK: GDPR
- Our legal bases are listed in section 3. Where we rely on legitimate interests, we have balanced them against your rights. You can object at any time (Art. 21).
- You have the rights of access, rectification, erasure, restriction, portability and objection (Arts. 15–21).
- You may complain to the data protection authority where you live or work, or where an alleged infringement took place. In the UK, that is the Information Commissioner's Office. We would appreciate the chance to resolve your concern first.
- We do not carry out automated decision-making or profiling within the meaning of Art. 22.
13. California and other US states
We do not sell personal information. We do not share it for cross-context behavioural advertising, and we do not use or disclose sensitive personal information. In the last 12 months we collected these categories, for the purposes in section 3:
- identifiers (email address, IP address);
- internet activity (requests to our site and API);
- approximate location derived from IP, used only for security.
California residents, and residents of other states with comparable laws, may request to know, delete or correct their personal information. An authorised agent may make the request for you. We will not discriminate against you for using these rights.
14. Other countries
We apply the same protections to everyone. If you are covered by another data protection law, you can exercise the rights in section 10 and any additional rights your local law gives you. Examples are Brazil's LGPD, Canada's PIPEDA, Australia's Privacy Act, Singapore's PDPA and South Africa's POPIA. You may also complain to your local regulator.
15. Children
The service is meant for drivers, businesses and developers. It is not directed at children, and we do not knowingly process children's personal data. We also do not track children or target advertising at them. Developer and operator accounts are for people aged 18 or over. If you believe a child has given us personal data, contact us and we will delete it.
16. Changes and contact
We will post changes here and update the effective date. If a change materially affects how we use personal data you have given us, we will tell you by email where we have it.
Questions, requests or complaints: [email protected].