Privacy Policy

PlaidInvoices ("PlaidInvoices", "we", "us") provides a web application that helps Tesla owners collect, organize, and receive Supercharger invoices (the "Service"). This Privacy Policy explains how we collect, use, disclose, and protect information when you use the Service.

How Tesla access works

PlaidInvoices uses Tesla's official OAuth flow. You grant access on Tesla's own authorization page, where Tesla shows the requested scopes before approval. The service is built for invoice retrieval and finance workflows. It does not request general vehicle control access.

Information we collect

• Account information: Email address, name (if provided), billing email, and communications you send to us.
• Tesla account data: OAuth tokens and data needed to access your charging invoices, including charging session details (date/time, location, energy, cost, and currency) and invoice documents.
• Payment and subscription data: Subscription status, plan, and billing metadata from our payment provider (LemonSqueezy). We do not store full payment card details.
• Usage and device data: IP address, device and browser information, and log data when you use the Service. Diagnostic reports may include account identifiers such as your internal user ID so we can troubleshoot account-specific issues. We also use essential cookies to keep you signed in.
• Analytics data: By default we use privacy-friendly, cookieless analytics to collect aggregate product usage events such as page views and button clicks, with no cookies, device storage, or user identification. If you accept enhanced analytics, we additionally link events to your account and may record session replays in which every form input and all on-screen text (including your Tesla account email and invoice amounts) are masked. We never capture invoice PDFs, payment card details, Tesla credentials, or password fields. With enhanced analytics we may also keep first-touch attribution such as landing page and referrer so we can understand which journeys lead to subscription.

How we use information

• Provide and operate the Service, including retrieving and delivering invoices.
• Send service emails such as invoices, login links, and account notices.
• Provide customer support and respond to your requests.
• Improve, secure, and troubleshoot the Service.
• Understand consented customer behavior so we can improve onboarding and conversion.
• Comply with legal obligations and enforce our terms.

Legal bases (EEA/UK users)

If you are in the EEA or UK, we process your personal data based on: (a) performance of a contract (providing the Service), (b) our legitimate interests (security, improvement, and privacy-preserving cookieless analytics), (c) your consent (for enhanced analytics and where otherwise required), and (d) legal obligations.

How we share information

• Service providers: We use vendors to host and operate the Service (such as Cloudflare), monitor errors and diagnostics (Sentry), process payments (LemonSqueezy), send email (Resend), and analyze product usage (PostHog and One Dollar Stats). They process data on our behalf.
• Tesla: We access your Tesla charging invoice data using OAuth with your permission. Tesla is an independent third party.
• Legal and safety: We may disclose information if required by law or to protect rights, safety, and security.
• Business transfers: If we are involved in a merger, acquisition, or asset sale, your information may be transferred as part of that transaction.

We do not sell your personal information.

Data retention

We keep your information for as long as your account is active and as needed to provide the Service. You can request deletion at any time. We may retain limited data for compliance, security, or legal reasons.

In practice, this means we keep the account, invoice, and operational records needed to sync invoices, generate exports, deliver email notifications, and support your account. We do not keep payment card details, and we aim to retain only the minimum service data needed for those workflows.

Security

We use reasonable administrative, technical, and organizational measures to protect your information. No method of transmission or storage is 100% secure, so we cannot guarantee absolute security.

This includes protecting Tesla OAuth credentials, limiting stored invoice-related data to what is necessary for the service, and using service providers for infrastructure, email delivery, and payments.

Your choices and rights

You may access, correct, export, or delete your personal data, and object to or restrict certain processing. To exercise these rights, contact us at support@plaidinvoices.com. You can also disconnect your Tesla account from the Service at any time.

We run privacy-friendly, cookieless analytics by default under our legitimate interest in improving the Service — it stores nothing on your device, does not identify you, and includes no session replays. Enhanced analytics (cookies, account-linked events, and masked session replays) stay off unless you accept them. We honor "Do Not Track" and Global Privacy Control browser signals as an opt-out of all analytics, and you can change your choice from the Privacy settings control in the app or contact us to object.

If you want to stop future syncing, you can disconnect your Tesla account in PlaidInvoices and revoke the application's access from Tesla's connected-app controls.

International transfers

Your information may be processed in countries other than where you live. When required, we use appropriate safeguards for cross-border transfers.

Cookies

We use essential cookies and similar technologies to keep you signed in, maintain sessions, remember preferences, preserve safe marketing attribution, and remember your analytics choice. By default, our analytics run cookieless: PostHog and One Dollar Stats measure aggregate usage without analytics cookies, local storage, user identification, DOM capture, or session replays. If you accept enhanced analytics, PostHog may additionally use cookies or local storage to capture clicks and navigation, record masked session replays, and connect events to your account. We process analytics data on EU infrastructure, mask all inputs and on-screen text in replays, honor "Do Not Track" and Global Privacy Control as an opt-out, and never record Tesla credentials, invoice PDFs, payment details, or password fields.

Children's privacy

The Service is not intended for children under 16, and we do not knowingly collect their data.

Changes to this policy

We may update this policy from time to time. We will post the updated version and indicate the effective date above.

Contact us

If you have any questions, contact us at support@plaidinvoices.com.