Privacy Policy and GDPR
Last updated: 3 August 2026
This policy explains what personal data is involved in buying and using ConTess, on what legal basis, and what you can ask us to do about it. It covers the contess.app website and the ConTess macOS application.
The short version: the application has no backend of ours. Your Tesla credentials, your signing key and your vehicle history stay on your Mac. The personal data we hold is essentially your purchase record.
1. Who is responsible
ConTess is developed and sold by its author, an independent developer based in Romania, who is the data controller for the purposes described here. Contact: support@contess.app.
2. What the application stores, and where
All of it stays in your own user library folder on your Mac. None of it is transmitted to us, because there is nowhere for it to be transmitted to:
- Tesla access and refresh tokens, obtained when you sign in on Tesla's own website. We never see your Tesla password.
- A command-signing key created on your Mac. The half that can command your car never leaves the machine. Only the shareable half goes into a verification file at a web address you control.
- Vehicle history: trips, charging sessions, battery snapshots, locations and your settings, in a local file you can export or delete.
Vehicle location data is personal data, and it is precise. It is held locally, and it is used to show your car on a map and to name the start and end of trips. If you delete the application's folder, it is gone.
3. What we hold, why, and on what basis
| Data | Purpose | Lawful basis |
|---|---|---|
| Name, email, billing country, invoice records (from Paddle) | Fulfilling your purchase, issuing licences, tax records | Contract; legal obligation for tax records |
| Licence key and which purchase it belongs to | Reissuing a lost key, handling refunds | Contract |
| Emails you send us | Answering your support request | Contract, and our legitimate interest in supporting customers |
| Server request data for the website, including IP address | Serving pages, defending against abuse | Legitimate interest in a working, secure site |
| Email address you give us for the waiting list | Telling you when ConTess goes on sale and sending the launch discount | Consent, which you can withdraw at any time by asking us to delete it |
We do not sell personal data, we do not profile you, and no decision about you is made by automated means.
4. This website
This site loads the Meta pixel on every page so we can measure and target our ads on Facebook and Instagram. It sets a cookie and tells Meta which pages you looked at. It is on by default, but a banner lets you turn it down: decline once and we switch it off and keep it off on this device. Page views are also counted with Cloudflare Web Analytics, which sets no cookie, does not fingerprint you and cannot follow you to any other site.
When the pixel is active, Meta Platforms Ireland Limited is a joint controller with us for what it collects: your IP address, the pages you viewed on this site and the pixel's own identifiers. Meta's data policy governs what it then does with them. You can withdraw at any time by declining the banner, which stops the pixel and keeps it off on this device.
This site also loads Microsoft Clarity on every page to record heatmaps and session recordings showing how visitors use it. It sets a cookie and is on by default, controlled by the same banner as the Meta pixel: decline once and both stop, and stay off on this device. Microsoft's privacy statement governs what it then does with the data it collects.
Our host, Cloudflare, processes request data including IP addresses on our behalf in order to serve the site and protect it. On the checkout page, and only there, the payment provider's script loads as soon as the page opens. It shows prices in your own currency and, when ConTess is on sale, presents Paddle's own payment form on that page. Either way Paddle sees your IP address in order to work out which country you are in. No other page on this site loads it.
5. Who else is involved
- Paddle.com Market Ltd, merchant of record. Collects billing details, calculates tax, issues invoices, sends your licence key. Acts as an independent controller for the payment.
- Cloudflare, website hosting, DNS and page-view analytics, acting as our processor.
- Meta Platforms Ireland Limited, which runs the advertising pixel described above, as joint controller for what the pixel collects.
- Microsoft Ireland Operations Limited, which runs Microsoft Clarity, described above, to record how visitors use this site.
- Our email provider, which processes support correspondence.
- Tesla, Inc. The application talks to Tesla's API using your own developer credentials, under your own Tesla account. Tesla's privacy policy governs what Tesla does with that.
- Your chosen host for the verification file. It contains a public key and nothing personal.
The application also fetches currency exchange rates and, when you use the map, turns coordinates into place names. Those requests are made from your Mac to third-party public services and are not routed through us.
6. International transfers
Some of the providers above may process data outside the EEA. Where they do, transfers rely on the European Commission's Standard Contractual Clauses or on an adequacy decision for the country concerned.
7. How long we keep things
- Purchase and invoice records: for as long as tax and accounting law requires them to be kept.
- Licence records: for as long as the licence is valid, so we can reissue it.
- Support email: no longer than we need it to help you, and then it is deleted.
Anything the application stores on your Mac is kept until you delete it. We have no way of reaching it.
8. Your rights
Under the GDPR you can ask us to give you a copy of your data, correct it, delete it, restrict or object to our use of it, or provide it in a portable form. Where we rely on legitimate interests, you can object. Where we rely on consent, you can withdraw it at any time.
Email support@contess.app and we will respond within one month. There is no charge.
If you are unhappy with how we have handled your data you can complain to your local supervisory authority. In Romania that is the National Supervisory Authority for Personal Data Processing (ANSPDCP), dataprotection.ro.
9. Children
ConTess is sold to adults who own or drive a vehicle. It is not directed at children and we do not knowingly collect their data.
10. Changes
If this policy changes materially we will update the date above and, where the change affects you and we hold your email, tell you.
Terms · Privacy & GDPR · Refunds · Licence