Privacy.
How Dynam Labs collects, uses, and protects personal data across our website, partner portal, apps, and Dynam Cloud connected vehicle services.
Who We Are and What This Covers
Dynam Labs, Inc. is a Delaware C Corporation based in Los Angeles, California. We are the data controller for the personal data described in this policy.
This policy covers:
- This website, including our contact form and newsletter.
- The partner portal at /partner.
- The Bolt desktop application.
- Dynam Cloud, our connected vehicle service, where telemetry from an enrolled vehicle is uploaded to us.
The Pulse mobile app has its own policy, linked in section 12 below, because how it handles data depends on the mode you run it in.
For questions about this policy or to exercise any of your rights, contact privacy@dynamlabs.com.
Information We Collect
- 2.1 Information you give us
- Contact details: name, email address, phone number, and company name when you contact us, place an order, subscribe to the newsletter, or create a partner account.
- Message content: whatever you choose to write in a contact form or support request.
- Account credentials: a password, stored only as a salted hash, for partner and customer accounts.
- 2.2 Information we collect automatically
- Request metadata: your IP address and browser user-agent when you submit a form. We use these to detect spam and abuse.
- Approximate location: we look up the country, region, and city associated with that IP address using ipwho.is. We do not receive precise location from your browser.
- Analytics events: if you consent, which pages you visit, which features you use, and which downloads you start. We do not send the contents of forms to our analytics providers.
- Error reports: diagnostic information when something goes wrong, such as the error, the page, and the browser version. We have configured our error monitoring not to attach IP addresses or request headers.
- 2.3 Connected vehicle data (Dynam Cloud)
If a vehicle is enrolled in Dynam Cloud, either by you or by an installer or partner working on your vehicle, that vehicle uploads telemetry to us. This is the part of our processing most likely to concern you, so we describe it in full.
What the vehicle sends:
- Vehicle Identification Number (VIN) and device identifier.
- GPS position — latitude, longitude, and heading.
- Motion and drivetrain state — speed, gear, drive mode, and vehicle state.
- Battery and charging state — state of charge, state of health, estimated range, power flow, and whether it is charging.
- Faults and diagnostics — active fault codes and, for some events, a captured context log.
- Device timezone and UTC offset.
If your vehicle was enrolled by a partner or installer rather than by you directly, that partner is responsible for telling you about it and for obtaining any consent required. If you are unsure whether your vehicle is enrolled, or you want it removed, contact us and we will help.
- 2.4 What we do not collect
- We do not collect audio, video, or cabin imagery.
- We do not receive payment card numbers. Card payments are handled by our payment providers and shops.
- We do not sell personal data, and we do not share it for cross-context behavioural advertising.
- Vehicle telemetry does not reach us at all unless a vehicle has been enrolled in Dynam Cloud.
Why We Process It, and Our Legal Basis
If you are in the EU, UK, or another jurisdiction with equivalent law, we must have a legal basis for each purpose. Ours are:
| Purpose | Legal basis |
|---|---|
| Responding to your enquiry or contact form submission | Legitimate interests (Art. 6(1)(f)) — answering people who contact us |
| Fulfilling an order and providing support | Performance of a contract (Art. 6(1)(b)) |
| Operating the partner portal and partner accounts | Performance of a contract (Art. 6(1)(b)) |
| Sending the newsletter | Consent (Art. 6(1)(a)), withdrawable at any time via the unsubscribe link |
| Website and product analytics | Consent (Art. 6(1)(a)), given through our cookie banner and withdrawable at any time |
| Error monitoring and security logging | Legitimate interests (Art. 6(1)(f)) — keeping our services secure and working |
| Bot protection on public forms | Legitimate interests (Art. 6(1)(f)) — preventing spam and abuse |
| Processing connected vehicle telemetry through Dynam Cloud | Performance of a contract (Art. 6(1)(b)) where you enrolled directly, or consent (Art. 6(1)(a)) collected by your installer or partner |
| Meeting tax, accounting, and product safety obligations | Legal obligation (Art. 6(1)(c)) |
Where we rely on consent you can withdraw it at any time, and withdrawing it is as easy as giving it. Where we rely on legitimate interests you can object, and we will stop unless we have compelling grounds not to.
Cookies and Similar Technologies
We do not set any analytics or tracking cookie before you have agreed to it. When you first visit, you will see a banner with an Accept and a Reject option. Nothing optional loads until you choose, and choosing Reject means no analytics script is ever requested.
You can change your mind at any time using the Cookie settings link in the footer of every page.
- 4.1 Cookies we always set
- dynam_consent — records whether you accepted or rejected analytics, so we do not ask again. Expires after six months.
- sidebar_state — remembers whether the partner portal sidebar is expanded. Only set inside the partner portal.
- Session cookies — keep you signed in to the partner portal or admin panel. Only set once you log in.
These are strictly necessary to provide a service you asked for, so they do not require consent. None of them are used for tracking.
- 4.2 Cookies we set only with your consent
- PostHog sets cookies to recognise a returning browser and group its events into a session. Until you accept, PostHog is initialised with capturing disabled and in-memory storage, so it writes nothing to your device.
If you withdraw consent, we stop capturing and delete the analytics cookies and local storage entries we set.
- 4.3 Error monitoring
Sentry runs without a consent prompt because we rely on legitimate interests to keep the service secure and functioning. It does not set advertising cookies, and we have explicitly configured it not to send IP addresses or request headers.
Who We Share It With
We do not sell your personal data. We share it with service providers who process it on our behalf, under contract and only on our instructions:
| Provider | Purpose | Primary location | Policy |
|---|---|---|---|
| PostHog | Product and website analytics (only with your consent) | United States / European Union | View |
| Sentry | Application error and performance monitoring | United States | View |
| Resend | Transactional and newsletter email delivery | United States | View |
| Cloudflare | Turnstile bot protection and R2 file storage | Global | View |
| ipwho.is | Approximate country and city lookup from IP address | European Union | View |
| Railway | Application and database hosting | United States | View |
We may also disclose personal data:
- To partners and installers: where a partner enrols or services your vehicle, they can see telemetry for the vehicles associated with their account. For that telemetry we and the partner are joint controllers: the partner tells you about enrolment and collects any consent required; we run the platform, set what is collected, and keep it for the periods above. You can exercise your rights against either of us.
- When legally required: in response to a valid legal process, or to protect our rights, safety, or property.
- In a business transfer: if we are involved in a merger, acquisition, or sale of assets, in which case we will tell you before your data becomes subject to a different policy.
International Transfers
We are based in the United States, and several of our providers are too. If you are in the European Economic Area, the United Kingdom, or Switzerland, this means your personal data is transferred outside your home jurisdiction.
For those transfers we rely on:
- Standard Contractual Clauses approved by the European Commission, together with the UK International Data Transfer Addendum where the UK GDPR applies, as our primary mechanism; and
- The EU-US Data Privacy Framework and its UK and Swiss extensions, where the receiving provider is certified under it.
We assess each provider before onboarding and apply additional technical measures, including encryption in transit and at rest, where the assessment calls for them. You can request a copy of the relevant safeguards by emailing privacy@dynamlabs.com.
How Long We Keep It
We keep personal data only as long as we need it for the purpose we collected it for. Our automated retention job enforces the following:
| Data | Retention |
|---|---|
| Contact, order, and beta access form submissions | 24 months from submission |
| IP address and browser user-agent attached to form submissions | 12 months, after which they are deleted and only the derived country is kept |
| Newsletter signups that were never confirmed | 30 days |
| Newsletter records after you unsubscribe | 12 months, after which the address is replaced with an irreversible hash so we can honour your unsubscribe without keeping your email |
| Raw vehicle telemetry in Dynam Cloud (position, speed, state of charge, faults) | For as long as the vehicle is enrolled in Dynam Cloud. When the vehicle is removed, or you ask us to erase it, the history is deleted |
| Partner and customer account records | For the life of the account, then as required by tax and accounting law |
| Analytics events | Per our analytics providers’ retention settings, currently 12 months |
We may keep data longer where we are legally required to, or where it is needed to establish, exercise, or defend a legal claim.
Your Rights
Depending on where you live, you have some or all of the following rights over your personal data:
- Access — get a copy of the personal data we hold about you
- Rectification — correct data that is wrong or incomplete
- Erasure — ask us to delete your data
- Restriction — ask us to pause processing while a dispute is resolved
- Objection — object to processing based on legitimate interests
- Portability — receive your data in a machine-readable format
- Withdraw consent — at any time, without affecting processing already carried out
- Avoid automated decisions — we do not make decisions with legal or similarly significant effects using automated processing alone
To exercise any of these, email privacy@dynamlabs.com. We will respond within one month. We will not charge you or treat you differently for exercising a right.
- 8.1 Right to complain
If you are in the EEA, UK, or Switzerland, you have the right to lodge a complaint with your local data protection supervisory authority. You can do this regardless of whether you raise the issue with us first, though we would appreciate the chance to put things right. A list of EEA authorities is available from the European Data Protection Board, and UK residents can contact the ICO.
- 8.2 California residents
If you are a California resident, you have the right to know what personal information we collect, to delete it, to correct it, and to opt out of its sale or sharing. We do not sell or share personal information as those terms are defined under the CCPA. Use the same contact address above to make a request.
EU and UK Representative
We are in the process of appointing a representative in the European Union under Article 27 of the GDPR, and will publish their details here once appointed. In the meantime, individuals in the EEA and UK can reach us directly at privacy@dynamlabs.com, and we will handle your request on the same timescales.
Security
We implement technical and organizational measures appropriate to the risk, including encryption in transit, provider disk encryption for stored telemetry, salted password hashing, role-based access control, and mutual TLS with per-vehicle certificates for devices connecting to Dynam Cloud. A device certificate only authorises the topics belonging to its own vehicle.
No system is perfectly secure, and we cannot guarantee absolute security. If we ever suffer a breach affecting your personal data, we will notify you and the relevant supervisory authority as required by law.
Children’s Privacy
Our website and products are not intended for children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.
Our Applications
- Bolt desktop app
Bolt is our desktop application for configuring and diagnosing VCU+ installations. It talks to the vehicle over a local connection, and the vehicle configuration you work with in Bolt stays on your machine and on the vehicle. Bolt does not require an account and does not upload your name or email.
Bolt does send us application telemetry so we can find and fix problems: crash and error reports through Sentry, and feature usage analytics through PostHog. These may include your IP address, operating system, and hardware configuration.
Vehicle data reaches Dynam Labs only through Dynam Cloud, described in section 2.3, and only when a vehicle has been enrolled. Bolt itself is not a telemetry uplink.
- Pulse mobile app
Pulse is a mobile companion and CAN bridge for Dynam electric vehicles. In companion mode, vehicle data stays on your device and is not uploaded to us. In standalone mode, you can optionally enable Cloud Connect to sync telemetry, including position and speed, to Dynam Cloud.
Independently of Cloud Connect, Pulse sends the same kind of application telemetry as Bolt: crash and error reports through Sentry, and feature usage analytics through PostHog. These may include your IP address, operating system, and device configuration. Pulse does not send VIN, raw CAN traffic, or precise location to those services.
Changes to This Policy
We may update this policy to reflect changes in our practices or for legal, operational, or regulatory reasons. We will post the updated policy here with a new "Last Updated" date. If a change materially affects how we use data we already hold about you, we will give you notice and, where the law requires it, ask for your consent.
Contact Us
For privacy questions or to exercise your rights, email privacy@dynamlabs.com. For anything else: