Privacy Policy

Account data: your email address and a securely hashed password, your email-verification status, and your plan and usage counters (e.g. downloads used this month).

Billing data: your subscription status and a Stripe customer identifier. Payments are handled by Stripe; we do not receive or store your full card details.

Technical and security data: your IP address and timestamps, used for login sessions, rate-limiting, and abuse/fraud prevention.

Route data: GPX files you upload are processed to validate the route and compute detours. The raw track is processed transiently and is not stored on our servers. We do keep an anonymous, aggregated popularity layer: the coarse grid cells a route passes through are counted (not linked to you and not stored as your track) so we can improve detour suggestions over time.

Providing your account and the Pro subscription: performance of a contract (Art. 6(1)(b)).

Email verification, security, rate-limiting, and fraud prevention: our legitimate interests in a safe service (Art. 6(1)(f)).

Keeping billing and accounting records: compliance with a legal obligation (Art. 6(1)(c)).

Any optional marketing emails: only with your consent (Art. 6(1)(a)), which you can withdraw at any time.

Stripe: payment processing and subscription management (see stripe.com/privacy).

Resend: sending transactional emails (verification, password reset).

OpenRouteService (HeiGIT, Germany): to compute detours we send route coordinates; these are not linked to your identity.

Hosting/infrastructure provider: [HOSTINGPROVIDER] hosts the application and database.

Closure and map data sources: GIPOD (Flanders), NDW (Netherlands), OpenStreetMap and Esri (map tiles). We only fetch data from them; we do not send them your personal data.

Some processors (e.g. Stripe, and possibly our email provider) may process data outside the European Economic Area, including the United States. Where they do, transfers are covered by appropriate safeguards such as the EU Standard Contractual Clauses or an adequacy decision.

Account data is kept while your account is active and for a short period after closure. Billing and accounting records are kept for as long as required by law (in Belgium, generally 7 years). Security logs are kept for a limited period. Uploaded GPX files are not retained after processing.

You have the right to access, rectify, erase, restrict, and port your personal data, and to object to certain processing. Where processing is based on consent, you can withdraw it at any time.

To exercise your rights, or to request deletion of your account and associated personal data, email us at [CONTACT E-MAIL]. We will respond within the legal time limits.

You also have the right to lodge a complaint with a supervisory authority: in Belgium, the Gegevensbeschermingsautoriteit (gegevensbeschermingsautoriteit.be); in the Netherlands, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).

We use a strictly necessary cookie to keep you logged in. Stripe may set cookies during checkout for payment and fraud prevention.

We do not use analytics, advertising, or tracking cookies, so no cookie-consent banner is required. If this ever changes, we will ask for your consent first.

The Service is not directed at children under 16. If you are under 16, please do not use ProofYourRide or provide personal data.

We protect your data with measures such as password hashing and encrypted (HTTPS) connections. No method of transmission or storage is completely secure, but we take reasonable steps to protect your information.

We may update this Policy. The date above shows the latest version; we will notify you of material changes.

Privacy questions or requests: [CONTACT E-MAIL].