Privacy Policy

1. What is collected

Registration asks for the following. Every value is typed in by you; nothing is read automatically from a vehicle or a device.

• Email address — to confirm registration, report your seat, and send the closed-beta invitation
• Vehicle model and trim — to understand the shape of the cohort. Self-reported and not verified
• Region — for density figures. A province-level choice, not a coordinate
• Monthly distance band — to check the reward model against a real distribution. A band, not a measurement
• Consent flags and the time they were given — the record that consent was obtained

2. What is not collected

None of the following is requested at registration. If a later stage genuinely needs one, it will be disclosed and consented to separately at that time.

• Location of any kind — coordinates, routes, driving history
• Vehicle identification number — vehicle binding happens later, and only through Tesla's official authorisation
• Phone number, postal address, date of birth, national identification number
• Payment details — registration involves no transaction of any kind
• Your IP address — used momentarily to throttle abusive requests, never stored

3. How it is used

Only for the purposes below. There is no advertising profile, and nothing is sold to anyone.

• Assigning a Genesis 500 seat and telling you the result
• Sending the closed-beta invitation
• Counting registrations by region — published only in a form that identifies nobody
• Sending product news, but only if you separately opted in to receive it

4. What appears publicly

The figures on the front page are aggregates. A seat number, region and vehicle model may appear anonymously in a recent-registrations list, but email addresses and any combination that would identify a person never leave through a public route.

5. Retention and deletion

• Deleted six months after the closed-beta invitation if you never respond
• Deleted without delay if you ask to withdraw
• If the service is abandoned, everything is deleted within thirty days of that being announced
• Deletion is performed so that recovery is not possible

6. Processors

The following providers process data on our behalf, each limited to what their service requires.

• Cloudflare, Inc. — storage and transport of registration records
• Vercel Inc. — website hosting
• Google LLC — confirmation and notification email, via Google Workspace

7. Disclosure to third parties

Personal information is not shared with third parties. A lawful request from a criminal investigation authority, made through proper process, may be answered — and even then, nothing beyond the scope of the request is handed over.

8. Sensitive and pseudonymised data

No sensitive category is collected — beliefs, union membership, political opinion, health, sexual life, genetic data, criminal record. There is therefore nothing that could be disclosed and no opt-out for you to make. No pseudonymised data is generated or processed. Should either become necessary, this policy is amended first and consent is asked for separately.

9. Automatic collection

No analytics of any kind, no advertising identifier, no visitor-tracking script, and no local storage. This is verified in code: a test fails the build if a tracking tool is ever added.

• Browsing sets no cookie at all.
• Signing in to the board sets exactly one (tsl_session). It keeps you signed in and does nothing else — it tracks no behaviour and is shared with nobody.
• It is HttpOnly, so no script can read it; it expires after 30 days, and signing out deletes it from your browser and from our database at once.
• It is strictly necessary to provide the service, so it is not subject to separate consent. To refuse it, do not sign in — reading the board needs no account.

10. Rights of users and legal guardians

You may exercise the following at any time. Write to the address below and we will act on it and tell you the outcome.

• Access your own record
• Correct anything that is wrong
• Delete it and withdraw your registration
• Halt processing
• Withdraw marketing consent — your seat is unaffected
• Personal data of children under 14 is not collected. If any is found to have been collected in error it is deleted without delay, and a legal guardian may exercise the rights above on the child's behalf

11. Safeguards

• Everything in transit is encrypted
• Confirmation tokens are stored only as hashes, never in the clear
• The operator's export route requires separate authentication
• Collecting less in the first place is treated as the primary safeguard

12. Data protection officer

The point of contact responsible for personal data handling and for any grievance arising from it. Under article 31(2) of the Personal Information Protection Act, while no separate officer is designated, the representative of the operating body is the officer.

• Team: teslam.io operations
• Contact: hello@teslam.io
• A person reads and answers. This is not an automated queue

13. Changes to this policy

Any change is posted here with its effective date before it takes effect, never backdated. A change that widens what is collected or how it is used will be sent to existing registrants individually, and consent will be asked for again.