Privacy Policy

This Privacy Policy explains how Arcon collects, uses, shares, and protects personal data when you use the Arcon mobile applications, web checkout, operator platform, and websites (together, the "Service"). It applies to EV drivers, Charge Point Operators, and visitors to our sites.

We are committed to processing personal data in accordance with the Data Privacy Act of 2012 (RA 10173), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission (NPC).

Arcon ("Arcon", "Arcon Mobility", "we", "us", or "our"), operated by Arcon Inc., with its principal office at Lady of Fatima Building, 1849 Pililia St., Santiago Village, Valenzuela, City of Makati, Fourth District, National Capital Region, 1208, Philippines, is the personal information controller for the personal data described in this Policy, except where we act as a processor on behalf of an Operator (see Section 5).

You can reach our Data Protection Officer (DPO) about this Policy or your privacy rights:

Data Protection Officer: Aldous Johan Abad
Email: dpo@arcon.mobi

You also have the right to lodge a complaint with the National Privacy Commission (NPC). See Section 14.

This Policy covers personal data we process through the Service. It does not cover third-party services, websites, or charging stations we do not control, which have their own privacy practices. Operators are responsible for their own handling of personal data except where they process it on our behalf.

Account and profile information. Your email address, phone number, and name, and account settings you provide when you register and use the Service.

Sign-in data from Google and Apple. If you choose "Sign in with Google" or "Sign in with Apple", we receive basic profile information from those providers (such as your name, email address, and a unique identifier) to create and authenticate your account. We request only the information needed to sign you in.

Charging and session data. Records of your charging sessions, including the station and connector used, start and stop times, energy delivered, duration, session status, and cost.

Approximate location (driver app). With your permission, the driver app uses your device's approximate location to help you find nearby charging stations. You can enable or disable location access in your device settings; disabling it may limit station-discovery features.

Payment data (handled by PayMongo). Payments are processed by our payment provider, PayMongo. Card and payment-instrument details are collected and processed by PayMongo under its own privacy terms; Arcon does not store full card numbers. We receive limited transaction information such as payment status, amount, and a reference identifier.

Device, usage, and log data. Technical information such as device type and identifiers, operating system, app version, IP address, language, crash reports, and interactions with the Service, used for security, troubleshooting, and improvement.

Cookies and analytics. On our websites we use cookies and similar technologies, and a third-party website-analytics tracker served from the script host cdn.visitors.now, which helps us understand site traffic and usage. See Section 9.

Ampere assistant data (Operators). For operator users of the Ampere assistant, we collect the messages they send to it, the conversation history of each thread, and the workspace data retrieved to answer them. See Section 7.

Operator information. For Operators, we also collect business registration and identity details, tax information, station details, and settlement/bank details for KYB, payouts, and compliance.

We use personal data to:

Create and manage your account and authenticate sign-in.
Provide the Service: help you find stations, start and stop charging sessions, and process payments.
Display accurate pricing and issue session records and receipts.
Facilitate settlement and payouts to Operators.
Provide customer support and handle refunds, disputes, and chargebacks.
Provide the Ampere assistant and the nightly anomaly watch to Operators, as described in Section 7.
Secure the Service, prevent fraud and abuse, and debug and improve our products.
Send you service and transactional communications (for example, sign-in codes, receipts, and important notices).
Comply with legal, tax, accounting, and regulatory obligations.
Send marketing communications where permitted and with your consent, which you can withdraw at any time.

We process personal data on one or more of the following bases:

Contract: to provide the Service you request under our Terms of Service or Operator Agreement.
Consent: for example, for approximate location access, certain cookies and analytics, and marketing. You may withdraw consent at any time.
Legitimate interests: for security, fraud prevention, service improvement, and network administration, balanced against your rights.
Legal obligation: to comply with tax, accounting, consumer-protection, and other legal requirements.

The Ampere assistant and the nightly anomaly watch are provided to Operators under contract (they are part of the operator platform) and our legitimate interest in helping Operators run their fleets safely and accurately.

Where personal data relating to charging is processed on behalf of an Operator, Arcon may act as a personal information processor and the Operator as controller (or as joint controllers), as determined between the parties.

We share personal data only as needed to run the Service and as described below:

Operators: the Charge Point Operator whose station you use receives session data (such as station, time, energy, duration, and cost) needed to deliver charging, support you, and meet tax/receipting obligations.
PayMongo: our payment provider processes your payments and related transaction data.
Google and Apple: when you use their sign-in services, to authenticate you.
Resend: our email delivery provider sends transactional emails such as sign-in codes and receipts.
Cloudflare and Cloudinary: our storage provider hosts files and assets associated with the Service.
Anthropic: our AI provider generates responses in the Ampere assistant and writes the nightly anomaly summary for Operators. See Section 7.
OCPI roaming partners: where you use a roaming-enabled station, session data may be exchanged with the relevant roaming partner to authorize and settle the session.
visitors.now: analytics tracker for site traffic measurement.
Legal and authorities: regulators, courts, or law enforcement where required by law, to comply with legal process, or to protect rights, safety, and the integrity of the Service.
Corporate transactions: a successor or acquirer in connection with a merger, acquisition, or asset sale, subject to this Policy.

We do not sell your personal data.

Google user data. Arcon's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data only to provide and improve the sign-in and account features you request, do not transfer it except as necessary to provide those features or as required by law, and do not use it for advertising.

Ampere is a suite of AI tools built into the Arcon operator platform. Only Operators use it. Drivers do not interact with Ampere: it is not part of the driver app or the web checkout.

What Ampere processes.

What an Operator types: the questions and instructions an operator user sends to Ampere Assistant, and the history of that conversation thread.
Data from that Operator's own workspace: to answer a question, Ampere runs read queries over that Operator's stations, connectors, charging sessions, faults, uptime, utilization, revenue, and pricing rules. The results are sent to our AI provider as the context for that answer.
Nightly anomaly watch: once a day we run automated checks over an Operator's own charging data. The findings themselves are computed by fixed rules; the AI provider is used only to write those findings into readable text.

Driver identity is kept out of it. The session records made available to Ampere describe the station, connector, timing, energy, cost, and status of a session — not a driver's name, email address, phone number, or account identifier. The audience tool used to plan win-back campaigns returns aggregate counts only, never recipient contact details.

Who processes it. Prompts, conversation history, and the query results described above are sent to Anthropic, our AI provider, which processes them outside the Philippines in order to generate a response. =

What Ampere may do. Ampere can propose a small set of station actions: changing a station's availability, stopping a charging session remotely, resetting a station, clearing a station's cache, and unlocking a connector. It never carries out an action on its own. Every proposal must be confirmed by an operator user, and each action is limited to what that signed-in user is already permitted to do in the platform. No decision producing legal effects on a driver is made solely by automated means.

Storage, access, and deletion. Conversations are stored against the operator user who created them and are visible only to that user within their Operator's workspace. An Operator can delete a conversation from the assistant. Retention is described in Section 10.

Some of our service providers (such as email, storage, analytics, payment infrastructure, and the AI provider behind the Ampere assistant) may process personal data outside the Philippines. Where we transfer personal data across borders, we take steps required by the Data Privacy Act to ensure a comparable level of protection, including contractual safeguards with our providers.

On our websites we use:

Essential cookies needed for the site and sign-in to function.
Analytics via visitors.now to understand traffic and usage and improve our sites.

You can control cookies through your browser settings, and where required we ask for your consent before setting non-essential cookies. Blocking some cookies may affect site functionality.

We keep personal data only as long as necessary for the purposes described in this Policy, including to provide the Service, meet legal, tax, and accounting requirements, resolve disputes, and enforce our agreements. Retention periods vary by data type.

Ampere conversations are kept until the operator user deletes the thread or the account is closed, whichever is earlier.

When personal data is no longer needed, we securely delete, anonymize, or block it in accordance with the Data Privacy Act.

We implement reasonable and appropriate organizational, physical, and technical measures to protect personal data against unauthorized access, alteration, disclosure, loss, or destruction. These include access controls, encryption in transit, and use of reputable infrastructure providers. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. In the event of a personal data breach that meets the notification criteria, we will notify the NPC and affected individuals as required by law.

Subject to the conditions and exceptions in the law, you have the right to:

Be informed about how your personal data is processed.
Access the personal data we hold about you.
Correct (rectify) inaccurate or outdated personal data.
Erasure or blocking of your personal data in the circumstances allowed by law.
Object to processing, including for direct marketing.
Data portability: obtain and reuse certain personal data in a structured, commonly used, electronic format.
Damages: be indemnified for damages sustained due to unlawful processing.
File a complaint with the National Privacy Commission.

To exercise your rights, contact our DPO at dpo.arcon.mobi. We may need to verify your identity, and we will respond within the period required by law.

The Service is not directed to individuals under 18, and we do not knowingly collect personal data from children. If you believe a child has provided us personal data, contact our DPO so we can address it. [COUNSEL: confirm age threshold and any parental-consent handling.]

Data Protection Officer: Aldous Johan Abad (dpo@arcon.mobi)
Registered address: Lady of Fatima Building, 1849 Pililia St., Santiago Village, Valenzuela, City of Makati, Fourth District, National Capital Region, 1208, Philippines
General support: support@arcon.mobi

You may also contact the National Privacy Commission.

We may update this Policy from time to time. When we do:

The current version and its effective date are always shown at the top of this document.
Material changes will be notified to you by email and, where the change affects your agreement with us, will require your re-acceptance before you continue using the Service.
Prior versions remain available at their dated URLs for your reference.

Your continued use of the Service after changes take effect means you accept the updated Policy.