Privacy policy

I Data Controller

The data controller is:

II Data Processed

1. Registration data (first name, last name, e-mail address, phone number).
2. GPS and route data.
3. Stops/waypoints added by the User.
4. Folder structure and route organization.
5. Offline map data.
6. Device information (IP address, device model, device identifier).
7. RevenueCat payment data (customer ID, subscription ID, payment tokens — never full card numbers).
8. For Company Plan administrators: administrator e-mail address, plan type, and seat usage.
9. For Company Plan members: activation code redemption status and the identifier of the associated company subscription.

III Purposes of Processing

Data is processed for:

• providing the Application’s services,
• Account authentication and management,
• handling payments via RevenueCat,
• provisioning and managing Company Plan access,
• processing location data,
• improving Application performance,
• fulfilling legal obligations.

IV Data Retention

1. Account data is stored until the User deletes the Account.
2. Routes and folders are stored until deleted by the User.
3. Payment-related data is stored for the period required by tax law.
4. Company Plan and activation code data is stored for the duration of the associated company subscription and for the period required by tax law thereafter.

V Data Recipients

Data may be shared with:

• RevenueCat (payments),
• Paddle.com (Company Plan payments, acting as Merchant of Record),
• Supabase (database services),
• Google LLC (maps),
• technical and analytical service providers.

VI Company Plans (Enterprise offer)

1. Where a User redeems a Company Plan activation code, the code’s redemption status and the identifier of the associated company subscription are linked to the User’s Account.
2. The Company Administrator who purchased the plan can view, for each activation code issued, whether it has been redeemed and the e-mail address of the User who redeemed it.
3. The Company Administrator does not have access to a User’s routes, folders, or other Application content — only to the activation code and redemption status described above.
4. A Company Administrator may revoke a User’s access, which deactivates the associated premium features but does not delete the User’s Account, routes, or other data.
5. Users who redeem a Company Plan code should be aware that their e-mail address will be visible to the Company Administrator managing that plan.

VII User Rights

Users have the right to:

• access their data,
• correct their data,
• delete their data,
• restrict processing,
• data portability,
• object to processing,
• withdraw consent for location data at any time.

VIII Data Security

1. Data is secured using modern technical and organizational measures.
2. All communications are encrypted using SSL/TLS.
3. RevenueCat meets the PCI DSS Level 1 security standard.

IX Language Versions

1. The primary version of the Application and these Terms is English (U.S.).
2. Other language versions may be automatically generated.
3. If discrepancies occur, the English version controls.

X Contact

For any inquiries related to data protection:

XI Final Provisions

This Privacy Policy is part of the Terms of Service. In matters not covered, applicable law applies.