Privacy Policy

Last Updated: June 2026

1. Our Commitment to Privacy

Blitz T Club Corporation ("we", "us") is committed to protecting your personal information. This Privacy Policy describes how we collect, use, disclose, and safeguard your data when you use our website (blitztclub.com), the BlitzVolt charging rewards platform, and our community services.

We comply with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws in Canada.

For BlitzVolt-specific data practices (vehicle telemetry, GPS, carbon credit data), please also review the BlitzVolt Privacy Policy, which provides additional detail on charging data handling.

2. Information We Collect

2.1 Information You Provide Directly

  • Account information: Name, email address, password (hashed), postal code
  • Membership details: Tesla ownership verification, member ID
  • Profile preferences: Communication preferences, language (EN/CN)
  • Banking information: Interac e-Transfer email for reward redemptions (never stored on our servers — processed by your bank)

2.2 Tesla Vehicle Data (via Fleet API)

When you connect your Tesla account to BlitzVolt, we access the following data through Tesla's official Fleet API using OAuth 2.0 PKCE authentication:

  • Vehicle identification (VIN, model, trim)
  • Battery level and charge state
  • Charging session data (kWh, power, duration, start/end time)
  • Wall Connector serial numbers and charging status
  • Odometer readings (for efficiency calculations only)

Your Tesla password is never shared with us. We receive only a limited-access token that can be revoked at any time.

2.3 GPS Location Data

GPS coordinates are received via Tesla Fleet Telemetry to verify that charging sessions occur at your registered home address (geofence verification). Our privacy practices for GPS data are:

  • Charging-only retention: GPS is only stored when your vehicle is actively charging
  • Immediate destruction: Non-charging GPS data is discarded instantly and never stored
  • 15-minute interval: GPS pings occur at most once every 15 minutes during charging
  • No route tracking: We do not track driving routes, locations, or movements
  • Audit retention: Charging-session GPS is retained for 7 years as required by carbon credit regulations (CFR compliance)

For full details, see BlitzVolt Privacy Policy §2.8 — GPS Privacy Protection.

2.4 Automatically Collected Data

  • Device and browser information (for compatibility and security)
  • IP address (for fraud prevention and security)
  • Usage analytics (pages visited, features used — aggregated, not individual)
  • Cookies and local storage (for authentication and preferences)

3. How We Use Your Information

  • Operate BlitzVolt: Detect and verify charging sessions, calculate rewards, process redemptions
  • Carbon credit compliance: Aggregate verified charging data for Canada's Clean Fuel Regulations (CFR) reporting
  • Club operations: Manage membership, organize events, send communications
  • Member benefits: Provide QR codes, process partner discounts
  • Security: Detect fraud, prevent abuse, comply with legal obligations
  • Improvement: Analyze aggregated data to improve our services

4. Data Encryption and Security

We implement enterprise-grade security measures to protect your data:

  • AES-256-GCM encryption: All Tesla OAuth tokens are encrypted before storage
  • OAuth 2.0 PKCE: Industry-standard authentication — we never see your Tesla password
  • Row Level Security (RLS): Database-level isolation ensures members can only access their own data
  • HTTPS/TLS: All network traffic is encrypted in transit
  • Service-role isolation: Administrative access is restricted to authorized personnel only
  • Regular security audits: We continuously review and harden our infrastructure

5. Information Sharing and Disclosure

We do not sell or rent your personal information. We may share data in the following limited circumstances:

  • Carbon credit verification: Aggregated and anonymized charging data is shared with CFR compliance auditors to verify carbon credits. Individual GPS coordinates may be reviewed during audit but are not published.
  • Service providers: Third parties that help us operate (Supabase for database, Tesla Fleet API for vehicle data, payment processors for redemptions). All are bound by data protection agreements.
  • Event partners and sponsors: Only with your explicit consent at event registration
  • Legal compliance: When required by law, court order, or government regulation

6. Data Retention

  • Account data: Retained while your membership is active. Deleted upon account closure request.
  • Tesla OAuth tokens: Permanently deleted immediately when you disconnect your Tesla
  • Charging session data + GPS: 7 years (required by carbon credit regulations for audit compliance)
  • Non-charging GPS: 0 seconds — destroyed immediately, never stored
  • Reward transactions: 7 years (financial record-keeping requirements)
  • Support tickets: 2 years after resolution

7. Your Rights

Under Canadian privacy law (PIPEDA), you have the right to:

  • Access: Request a copy of your personal information
  • Correction: Request correction of inaccurate data
  • Withdrawal: Disconnect your Tesla at any time — tokens are deleted instantly
  • Opt-out: Unsubscribe from marketing communications (operational emails about your account/rewards continue)
  • Account deletion: Request deletion of your account and personal data (subject to regulatory retention requirements for charging/financial records)
  • Complaint: File a complaint with the Privacy Commissioner of Canada

To exercise any of these rights, email us at info@blitztclub.com.

8. Cookies

We use essential cookies for authentication (keeping you logged in) and preferences (language, theme). We do not use third-party advertising cookies. Analytics cookies, if enabled, are strictly for improving our services and do not track you across other websites.

9. Children's Privacy

Our Services are not intended for individuals under 18. We do not knowingly collect personal information from minors. If you believe a minor has registered, please contact us and we will delete the account.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Significant changes will be communicated via email at least 30 days before taking effect. The "Last Updated" date at the top reflects the most recent revision.

11. Contact Us

For privacy-related inquiries or to exercise your data rights:

Email: info@blitztclub.com