Privacy Policy

PetrolPulse ("we", "us", or "our") operates the PetrolPulse mobile application, Telegram Bot (@PetrolPulseBot), and website at petrolpulse.app (collectively, the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

PetrolPulse is designed for global use. We apply internationally recognized privacy principles (lawfulness, transparency, purpose limitation, data minimization, security, and accountability) and comply with applicable local laws where users are located, including frameworks such as GDPR/UK GDPR, DPDPA (India), NDPA (Nigeria), and other equivalent national regulations.

2.1 Information You Provide

• Account Information: Email address (for mobile OTP sign-in) and/or Telegram user ID, username, first name, last name, and language preference.
• Profile Information: Display name, bio, and profile photo.
• User-Generated Content: Fuel status reports, posts, chat messages, comments, and votes.
• Geo-Alert Preferences: Location coordinates and radius settings.

2.2 Information Collected Automatically

• Location Data: With your explicit consent, GPS coordinates to show nearby fuel stations. Core app functionality remains available even if location access is denied.
• Device Information: Device type, OS, browser type, language settings.
• Usage Data: Pages visited, features used, timestamps.
• Log Data: IP address, access times, referring URLs.

2.3 Information from Third Parties

• Telegram: Your Telegram user data as authorized by the platform.
• Map Services: OpenStreetMap / CartoDB tile services for map rendering.

• Service Provision: To operate and improve PetrolPulse features.
• Personalization: Display content in your preferred language and location.
• Communication: Fuel availability alerts and system notifications.
• Safety & Security: Detect and prevent fraud, abuse, spam.
• Chat Safety: Apply anti-flood, anti-duplicate, ad-link restrictions, and read/unread chat state.
• Language Delivery: Provide dynamic language catalog and fallback language behavior.
• Fuel Hero Program: Process submitted promotion proofs (links/files/notes), moderation outcomes, and reward point events.
• Analytics: Understand usage patterns (aggregated, non-identifying).
• Legal Compliance: Comply with applicable laws.

• Consent: Explicit consent for location permissions, account creation, content submission.
• Contractual Necessity: Processing to provide the Service.
• Legitimate Interest: Security, fraud prevention, service improvement.
• Legal Obligation: Where required by law.

Under India's DPDPA 2023 and Sri Lanka's PDPA 2022, we act as a "Data Fiduciary" / "Controller".

We do not sell your personal data. We may share information:

• Public Content: Fuel reports and chat messages are visible to other users.
• Service Providers: Supabase (EU — Stockholm), Vercel, Telegram.
• Legal Requirements: When required by law or court order.
• Safety: To protect rights, safety, and property.
• Dispute & Abuse Handling: Where legally permitted, we may disclose relevant evidence packages (for example: account identifier, post/message content, timestamps, submitted location metadata, and available infrastructure/network logs) to courts, regulators, law enforcement, or injured parties through lawful procedures.

Our servers are in the EU (Stockholm, Sweden). We ensure appropriate safeguards:

• Data processing agreements with all providers
• Encryption in transit (TLS/SSL) and at rest
• Compliance with cross-border transfer requirements

• Account Data: Retained while active. Deleted within 30 days of request.
• Fuel Reports: Auto-expire after 6 hours. Analytics retained up to 12 months.
• Chat Messages: Retained for the lifetime of the chat room.
• Log Data: Retained up to 90 days.
• Legal Hold: We may retain specific records longer if required for fraud prevention, dispute resolution, court defense, lawful requests, or enforcement of our Terms.

Depending on your jurisdiction:

• Right to access, correct, and delete your data
• Right to withdraw consent at any time
• Right to data portability

Where required by local law, you may also have rights to restrict processing, object to specific processing activities, and lodge a complaint with your local supervisory authority.

• HTTPS/TLS encryption for all data transmission
• Row Level Security (RLS) on all database tables
• HMAC-SHA256 verification for Telegram authentication
• Rate limiting to prevent abuse
• Regular security audits

No method of transmission is 100% secure. We cannot guarantee absolute security.

PetrolPulse is not intended for children under 16 (or 18 in India per DPDPA 2023). We do not knowingly collect data from children.

Our website uses minimal, essential cookies. We do not use third-party advertising cookies or cross-site tracking.

We may update this Privacy Policy from time to time. Continued use after changes constitutes acceptance.

• Telegram Bot: @PetrolPulseBot
• Telegram Group: @PetrolPulse
• Website: petrolpulse.app