Privacy Policy
Version 2.4 · Last updated: May 12, 2026
This Privacy Policy explains how SOHpro ("we" or "our") collects, uses, shares, and protects personal data when you use our website, mobile app, and services (the "Service"). We comply with Costa Rica Law 8968 (Personal Data Protection Law) and Regulation 37554-JP, Brazil's General Data Protection Law (LGPD, Law 13.709/2018), the California Consumer Privacy Act (CCPA/CPRA), and applicable data-protection laws in Latin America.
1. Data We Collect
We collect the following categories of data: (a) Account data — name, email, password hash, preferred language, country. (b) Vehicle data — vehicle identification number (VIN), make, model, year, odometer. (c) Diagnostic data — battery state of health, cell voltages, temperatures, energy counters, and the original files you upload (photos, PDFs, CSVs). (d) Payment data — processed by third-party providers; we only receive a transaction identifier and do not store full card numbers. (e) Technical data — IP address, device type, browser, operating system, approximate IP-derived location, and usage analytics.
2. How We Use Your Data
We use your data to: (a) Operate the Service, generate your SOHpro Score, and deliver reports. (b) Authenticate your account and prevent fraud. (c) Provide customer support. (d) Send transactional communications (receipts, report-ready notifications). (e) Improve the Service and our SOHpro AI extraction models (using only data you have explicitly consented to share for research — see Section 6). (f) Comply with legal obligations. (g) Generate a per-view watermark on public report pages — a hashed code derived from the report share token and the viewing time — used solely to detect abuse of public links; the watermark contains no personal data and is not used for advertising, tracking, or profiling.
3. Legal Basis for Processing
For users resident in Costa Rica, under Law 8968 and Regulation 37554-JP, processing is principally based on: (a) Your express informed consent given when creating your account and accepting this Policy, and the specific opt-ins described (Section 18). (b) Performance of the service contract you have accepted, as necessary to deliver the Service to you (account, report generation, support). (c) Compliance with legal obligations applicable to SOHpro. Functions that rely on legitimate interest in other jurisdictions are supported in Costa Rica by (i) contractual consent upon accepting the Terms of Service, or (ii) processing of non-personal data through irreversible anonymization (Section 6), which falls outside the scope of Law 8968. For users resident in Brazil, under LGPD (Art. 7), we rely on (a) your consent for optional processing such as research aggregation and marketing; (b) contract performance for the account and report delivery; (c) compliance with legal obligations; and (d) our legitimate interests in protecting and improving the Service, balanced against your rights. For California users, under CCPA, we process personal information for the business purposes disclosed in this Policy. For commercial use of pseudonymized data (Section 18), the legal basis is exclusively your explicit consent under Law 8968 Art. 5 (CR) / LGPD Art. 7 I (BR) / GDPR Art. 6.1.a / LFPDPPP Art. 8 (MX) / Law 1581 Art. 9 (CO), revocable at any time.
4. Sharing and Disclosure
We do not sell your personal data. With your explicit opt-in consent given in Account Settings (Section 18), we may share pseudonymized battery and vehicle data with commercial partners under a data-use agreement, including insurers, reinsurers, banks, and manufacturer strategy teams. The active commercial-partner list is maintained in Section 18 and notice is given before a new partner receives data. Beyond that opt-in, we share data only with: (a) Service providers (cloud hosting, email delivery, analytics, payment processing, AI-extraction infrastructure) under confidentiality and data-processing agreements that prohibit the use of your data for their own purposes, including training of AI models on customer content. (b) Authorities when required by law or valid legal process. (c) In connection with mergers, acquisitions, or asset sales, subject to equivalent privacy commitments. (d) Certified Partners (associated dealers and workshops) — Partners capture battery scans of your vehicle during the maintenance service you have contracted with them at their workshop, and transmit that data to us to build your EV passport. Under our Master Services Agreement, Partners are obligated to operate under the direct commercial relationship they maintain with you as their customer; to have sufficient legal basis under their own privacy policy to transmit your data to us; not to use your data for purposes other than the maintenance service you have contracted with them; and not to access your SOHpro account, payment data, or data from other vehicles you own. When you open a Service Link sent by your Partner from their own channels (workshop email, WhatsApp, SMS), you establish a direct contractual relationship with SOHpro governed by this Policy. Before that moment, data about your vehicle is processed under the legal basis described in §3, principally contract performance with the Partner and the consent basis you have given to the Partner as their customer.
5. SOHpro AI Processing and Dual Pseudonymization Regime
5.1 Processing by SOHpro AI The diagnostic files you upload are processed with SOHpro AI, our extraction pipeline powered by the Anthropic Claude API (United States), under Anthropic's Data Processing Addendum, which prohibits the use of customer content to train their models. Uploaded files are transmitted over encrypted connections, processed to extract structured metrics, and stored in our secure database. We do not use your diagnostic files to train any AI model. 5.2 Dual VIN pseudonymization regime When we apply pseudonymization or anonymization techniques to your VIN to protect you, we use two distinct schemes depending on purpose: (a) HMAC-SHA-256 Pseudonymized VIN — used for unique vehicle identifiers in contexts where we need longitudinal consistency (same vehicle over time) without exposing the real VIN. The VIN is transformed by HMAC-SHA-256(normalized_VIN, pepper) where the "pepper" is a cryptographic secret stored in an encrypted vault (Supabase Vault). Only SOHpro has access to the pepper. Commercial partners cannot reverse the token. This scheme is used for: commercial per-VIN pseudonymized exports (Section 18), model calibration log and internal quality metrics, and VIN-decoding cache. Important: HMAC pseudonymization preserves the Personal Data nature of the record, because SOHpro retains the technical ability to re-identify. Therefore this scheme remains within the scope of Law 8968 (CR) and equivalent laws, subject to your data-subject rights. (b) WMI+VDS Truncated VIN — used for aggregate cohort statistics and public benchmarks, where we do not need to identify the individual vehicle but the category (manufacturer + model + year + plant). The VIN is truncated to its first 11 characters, corresponding to the World Manufacturer Identifier (WMI) and Vehicle Descriptor Section (VDS) per ISO 3779, discarding the 6 individual serial digits. This scheme is used for aggregate consumption observations, public benchmarks of degradation by make/model/year, and published cohort statistics (Section 6). Important: WMI+VDS truncation is irreversible and produces k-anonymity over thousands of vehicles with the same prefix. Therefore data identified solely by WMI+VDS Truncated VIN falls outside the scope of Law 8968 as irreversible anonymization. 5.3 Scan Integrity Hash For each Scan file you upload, SOHpro computes and retains a SHA-256 hash (raw_scan_sha256) of the raw file at the time of upload. This hash is a guarantee of integrity and evidentiary immutability of the Scan, is retained indefinitely as evidence, is available for regulatory audit, insurance disputes, or due-diligence processes, and is not a personal identifier and does not permit re-identification.
6. Anonymized Aggregate Research and Public Benchmarks
SOHpro produces public aggregate statistics on EV battery degradation by make, model, year, country, and mileage range — for benchmarks, methodology validation, blog posts, and academic publications. 6.1 Anonymization mechanism In this regime, vehicles are identified exclusively via WMI+VDS Truncated VIN (first 11 characters, see §5.2), not by full VIN or HMAC Pseudonymized VIN. Truncation is irreversible and produces k-anonymity over thousands of vehicles. Additionally, aggregates are computed only when at least 5 vehicles share a cohort (additional k-anonymity, k ≥ 5 at cohort level), and only the aggregate (mean, percentiles, sample count) is published — no row-level data is exposed. The published aggregates are irreversibly anonymized because (i) the VIN is truncated to a prefix common to thousands of vehicles, and (ii) only the aggregate, not individual records, is published. 6.2 Function for the Service This use is an integral part of the Service — it is how we calibrate the scoring, validate manufacturer-warranty thresholds, and build the benchmarks that make your report meaningful. Acceptance of this use is part of the Terms of Service accepted upon creating the account and does not constitute a separate opt-in. 6.3 Legal basis For Costa Rica users: your contractual consent given upon accepting the Terms of Service and, once irreversible anonymization via WMI+VDS Truncated VIN + cohort k≥5 is applied, processing of non-personal data falling outside the scope of Law 8968. For Brazil and other jurisdictions: legitimate interest (LGPD Art. 7, IX / GDPR Art. 6.1.f) balanced against your rights, and — after aggregation — processing of non-personal data falling outside the scope of LGPD under Art. 12. 6.4 Other data removed before aggregation Before any row contributes to a published aggregate, we remove your account identifier, email, and precise location; aggregate location to country level; aggregate time to monthly level; and aggregate mileage in 10,000-kilometer ranges. 6.5 Right to object You retain the right to object to processing of your personal data — including objecting to future aggregation of new uploads — at any time from your account settings or by writing to [email protected]. Exercising the right to object does not retract already-published aggregates, because they no longer contain data that can be linked to you. If you object to all aggregation, you may close your account at any time; in that case we will delete your personal data per Section 8, retaining the already-published aggregate statistics, which no longer constitute personal data. The aggregate statistics of this Section 6 are distinct from the per-VIN commercial pseudonymized regime of Section 18, which requires your explicit opt-in consent.
7. Your Rights
Subject to applicable law, you have the right to: (a) Access the personal data we hold about you. (b) Correct inaccurate data. (c) Request deletion of your data. (d) Export your data in a portable format. (e) Object to or restrict certain processing. (f) Withdraw your consent at any time without affecting the legality of prior processing. (g) File a complaint with your data-protection authority. Data-protection authorities by jurisdiction: Costa Rica → Agencia de Protección de los Datos de los Habitantes (Prodhab), prodhab.go.cr, under Law 8968. Brazil → Autoridade Nacional de Proteção de Dados (ANPD). Mexico → INAI. Colombia → Superintendencia de Industria y Comercio (SIC). Uruguay → URCDP. California (USA) → under CCPA, including the right to know, delete, correct, and opt out of selling or sharing personal information; by default we do not sell or share personal information. You may opt in to commercially share pseudonymized data in Account Settings (see Section 18), and you may withdraw consent at any time. Exercising withdrawal stops the inclusion of new data in future commercial exports and triggers deletion or contractual unlinking by buyers as described in Section 18. To exercise any right, contact us at [email protected]. We will respond within applicable legal deadlines, including 5 business days for Costa Rica users under Art. 8 of Regulation 37554-JP.
8. Data Retention
Active account. We retain your account data while it is active. Voluntary closure. Upon closing your account, we delete your personal data within 90 days, except information we are legally obligated to retain to comply with tax obligations (up to 5 years) or resolve pending disputes. Inactive account without closure. Accounts without login activity for 36 consecutive months may be treated as closed for retention purposes, with prior notice to the registered email 30 days in advance. If you do not respond within that period, the deletion timelines of this Section apply. Source files. Uploaded source files (photos, PDFs) are retained for 24 months after the date of the last associated report and then permanently deleted. Scan Integrity Hash. The raw_scan_sha256 (§5.3) is retained indefinitely as evidentiary proof, even after source files are deleted. It is not personal data. Technical logs. Access, error, and security logs are retained for 12 months. Aggregate datasets. Aggregate anonymized datasets with WMI+VDS Truncated VIN (Section 6) are retained indefinitely, as they do not constitute personal data. Costa Rica legal ceiling. Under Regulation 37554-JP, the legal maximum retention of identifiable personal data is 10 years post-relationship. The timelines in this Policy are shorter and therefore more protective.
9. Data Security and Breach Notification
9.1 Technical and organizational measures We implement technical and organizational measures to protect your data, including: encryption in transit (TLS 1.2+) and at rest (AES-256); role-based access controls (RBAC); multifactor authentication for administrative access; log auditing and access traceability; agreements with providers requiring equivalent safeguards; custody of the HMAC cryptographic pepper (§5.2) in an encrypted vault (Supabase Vault) with restricted access; and the Scan Integrity Hash (raw_scan_sha256, §5.3) that detects any alteration of the raw file. No system is perfectly secure; we cannot guarantee absolute security. 9.2 Breach notification In the event of a personal-data breach that may pose a risk to your rights, we will notify the competent data-protection authority and affected users within 72 hours of becoming aware of the breach, per: Costa Rica → Prodhab, Art. 26 Law 8968. Brazil → ANPD, Art. 48 LGPD. Mexico → INAI, Art. 20 LFPDPPP. And equivalent authorities in other applicable jurisdictions.
10. International Transfers
Your data may be processed on servers located outside your country of residence, including the United States. Where necessary, we rely on appropriate safeguards such as standard contractual clauses, adequacy decisions, or your explicit consent. For Costa Rica users, this international transfer is supported by your consent upon accepting this Policy, under Art. 14 of Law 8968. See per-subprocessor detail in §15.
11. Minors
The Service is not directed to minors under 18 (or the age of majority in your jurisdiction). We do not knowingly collect personal data from minors. If you believe a minor has provided personal data to us, contact us at [email protected] and we will delete it. If you need to register a Vehicle whose registered title-holder is a minor, consent must be given by their legal representative, per Art. 5 of Law 8968 (CR) and equivalent norms in other jurisdictions.
12. Cookies and Analytics
We use the following cookies and similar technologies: (a) Authentication cookies — essential, necessary to keep you logged in, expire at session end or upon logout. (b) Language preference — essential, stores your language (en/es/pt) for up to 12 months. (c) Privacy-respecting analytics — optional, aggregate usage metrics without cross-site tracking, which you can disable at any time from your browser settings. We do not use advertising or cross-site tracking cookies.
13. Changes to This Policy
We may update this Privacy Policy periodically. Material changes will be communicated by updating the "Last updated" date above and, where appropriate, by in-app notice or email.
14. Contact — Data Protection
For any privacy-related question, request, or complaint, or to exercise any of your rights, contact our Data Protection Officer at [email protected]. We will respond within the deadlines required by applicable law (5 business days in Costa Rica).
15. Sub-processors
We use the following subprocessors to operate SOHpro. Each processes personal data solely under our instructions and under a data-processing agreement: Supabase Inc. (United States) — authentication, database hosting, file storage, custody of the cryptographic pepper for HMAC pseudonymization in an encrypted vault (Supabase Vault). Anthropic PBC (United States) — AI-based extraction of battery metrics from uploaded diagnostics (Claude API), presented to the user as SOHpro AI. Vercel Inc. (United States) — web app hosting and edge delivery. Resend Inc. (United States) — transactional email delivery (notification digests, transfer links, partner-application acknowledgments). Payment processor (to be announced at launch) — checkout, billing, and pass issuance. Commercial data partners (when applicable, only with your explicit opt-in) — listed in Section 18; they act as independent controllers under data-use agreements, not as subprocessors. None active as of this version of the Policy. Note on international transfer to the United States. All listed subprocessors process data in the United States. For Costa Rica users, this international transfer is supported by your consent upon accepting this Policy, under Art. 14 of Law 8968. The United States has not been recognized by Prodhab as a country of adequate protection level; the transfer is conducted under DPAs (Data Processing Agreements) in force with each subprocessor, which include contractual standards equivalent to those required by Costa Rican legislation, including encryption, confidentiality, prohibition of use for own purposes, and breach-notification obligations. We will update this list before adding or replacing any subprocessor. You may request the current list at any time at [email protected].
16. Automated Decisions — SOHpro Score
The SOHpro Score is generated automatically by an algorithm that weights six technical factors: battery state of health from the BMS, cell-voltage stability, historical degradation trend, energy efficiency, OCV-SOC consistency, and thermal uniformity. Nature of the Score. The Score is a technical algorithmic indicator of battery state and does not constitute a commercial valuation of the vehicle, a professional inspection, a technical diagnostic or official certification, certified technical opinion under Vehicle Technical Review (RTV/MOPT in Costa Rica) regulations or equivalents in other LATAM jurisdictions, or expert opinion automatically admissible as evidence. Your rights over automated decisions. You have the right to request a detailed explanation of the calculation of your Score, request human review of the result by SOHpro's technical team, and request rectification if you believe the Score reflects inaccurate data. To exercise these rights, contact us at [email protected].
17. Data Protection Officer
SOHpro's Data Protection Officer is Yendri Víquez, reachable at [email protected]. The Officer is responsible for supervising our data-protection practices, responding to data-subject requests within applicable legal deadlines, and serving as liaison with data-protection authorities, including Prodhab (Costa Rica, per Law 8968), ANPD (Brazil, per Art. 41 of LGPD), INAI (Mexico), SIC (Colombia), URCDP (Uruguay), and equivalent authorities in other applicable jurisdictions.
18. Commercial Use of Pseudonymized Data (opt-in)
SOHpro maintains a separate consent for commercial use of your battery data. This consent is off by default, revocable at any time, and independent of the Terms of Service and Privacy Policy required to use the Service. 18.1 What it covers With your explicit opt-in, we may include data from your scans in datasets shared with commercial partners — insurers, reinsurers, banks, and manufacturer strategy teams — under data-use agreements. Two product types, each with a distinct anonymization mechanism: (a) Cohort statistics with WMI+VDS Truncated VIN — published only when at least 30 vehicles share the same cohort (N ≥ 30). In this format the vehicle is identified only by the WMI+VDS prefix (first 11 characters of the VIN), which is irreversible. This data falls outside the scope of Law 8968 as irreversible anonymization. The reason we still require your opt-in to include your scans in these products is transparency and respect for your preference, even though it is not legally required. (b) Per-vehicle records with HMAC-SHA-256 Pseudonymized VIN — where your VIN is replaced by a token derived by HMAC-SHA-256 with a secret key (pepper) stored in an encrypted Supabase Vault. SOHpro can re-link a token with a VIN using the key; buyers cannot. This format preserves the Personal Data nature because re-identification is technically possible by SOHpro. Therefore this use requires your explicit consent under Law 8968 Art. 5 and equivalent laws. Buyers are contractually prohibited from attempting to re-identify, cross-referencing the data with other sources to identify drivers, advertising to identified persons, or using the data for any purpose outside the data-use agreement. 18.2 What is removed before export In both formats (a) and (b), before export we remove your name, email, internal account identifier, and payment data; your IP address and precise location; and any internal identifier that could link the record to your account. The original scan files (your photos and PDFs) are not included in either case. 18.3 What is included Structured measurements (state of health, cell voltages, temperature, energy counters, projection data, score components, score-version and band stamps), provenance metadata (scanner model, partner workshop, date), and the vehicle's anonymized/pseudonymized identity (WMI+VDS Truncated VIN or HMAC Pseudonymized VIN depending on product, make, model, year, chemistry, climate zone). Partner workshop and scan date are included as quality signals; buyers are contractually prohibited from cross-referencing these data with other sources to re-identify individual customers. 18.4 Active commercial partners (controllers) None as of this version of the Policy. This list will be updated and you will receive notice (in-app or by email) before your data is delivered to a new partner. You may withdraw your consent before delivery. 18.5 Revocation You may withdraw your consent at any time in Account Settings → Privacy. Revocation immediately stops the inclusion of new scans in future commercial datasets. For data already delivered to a buyer, our data-use agreements require the buyer to delete or unlink the affected records within 30 days of revocation, unless the buyer has an independent legal obligation to retain the record (such as actuarial reserves under Solvency II Art. 19 / SR 11-7 or local retention rules from insurance supervisors), in which case the buyer must isolate the record from active analytical use and retain it only for the legally required purpose. Revocation does not affect your use of SOHpro. 18.6 Jurisdictions Costa Rica: Costa Rica residents may fully participate in commercial use via explicit opt-in, per Arts. 5 and 14 of Law 8968. Where destination commercial partners are domiciled outside Costa Rica, the international transfer is supported by your explicit consent given in this Section and by the DPAs signed with each commercial partner. Colombia and Brazil: Pending legal review of compliance with Law 1581 (CO) Art. 8(e) and LGPD Art. 18 V, residents of Colombia and Brazil are excluded by default from commercial-export flows; the opt-in is shown but data is not delivered to any buyer. This exclusion is operational, not contractual, and will be lifted when legal counsel confirms that the buyer-DPA path satisfies local deletion requirements. Other LATAM jurisdictions: case-by-case evaluation based on the user's and buyer's country of residence. 18.7 Legal basis Your explicit consent under Law 8968 Art. 5 (CR) / LGPD Art. 7 I (BR) / GDPR Art. 6.1.a / LFPDPPP Art. 8 (MX) / Law 1581 Art. 9 (CO). Withdrawing consent does not affect the legality of processing carried out before revocation. 18.8 Contact Questions or requests about commercial use of your data: [email protected].