Privacy Policy

MOVRR, Luzacstraat 7 01 A, 3038 VT Rotterdam, Netherlands, registered with the Dutch Chamber of Commerce under number 93383738, operates MOVRR and is responsible as controller for the processing described here. Privacy contact: privacy@movrr.nl. Service support: support@movrr.nl.

This policy covers the MOVRR rider app (Android and iOS identifier nl.movrr.app), our website, and related authenticated services. A business customer’s own employment or customer administration may involve a separate controller; a separate notice is needed for any distinct processing. This policy does not replace that notice.

We process account identifiers, name, email address, authentication and session information, and the profile details you provide. Optional fields include phone number, city, riding area, bicycle information, profile image and emergency contact. Do not enter another person’s details without informing them and having an appropriate reason.

Email sign-up, sign-in, account recovery and supported Apple or Google sign-in connect your identity to MOVRR. When you choose a sign-in provider, we receive the identity and profile fields that provider makes available, including a relay email where applicable. We use provider credentials or tokens for sign-in and account lifecycle operations; we do not receive your Apple or Google password. Provider services also process information under their own notices.

Support requests, privacy requests, notification preferences, device registrations and messages about your account are associated with you where needed. Required information enables the feature requested; without it we may be unable to provide that feature. Optional profile fields are not needed merely to read the public website.

During a recorded ride, MOVRR processes precise GPS coordinates, route points, timestamps, distance, speed, duration and location-quality signals. Recording can continue in the background when the app is minimised or the screen is locked, subject to permissions, operating-system restrictions and battery settings. A ride can be started explicitly; Automatic mode can also start a Standard ride as described below. Campaign or Boosted rides always require an explicit start.

Manual mode disables passive background ride detection. Smart Prompt uses location and motion signals between recordings to recognise possible cycling and ask whether to start a Standard ride. Automatic uses those signals and can start a Standard ride after sustained high-confidence detection. These optional modes require the relevant permissions and can be changed in Account → Ride Preferences. Choosing Manual stops passive detection; it does not itself finish an already recorded ride.

The account preference defaults to Smart Prompt. A device without a saved local detection setting falls back to Manual until account preferences are applied. A default setting or operating-system permission alone does not establish GDPR consent to optional processing.

Finishing a ride ends that recording. Pausing a ride is not a promise that every location listener has stopped: location may still be used to detect movement or resume the ride. Optional detection may resume after a recording ends according to your selected mode. To stop both activities, finish the ride and choose Manual, or revoke location access in device settings. Revoking access affects tracking and verification; it does not delete previously stored data.

Recent passive samples are buffered on the device, including a rolling buffer of up to 20 samples. Active ride paths and recovery records are also stored locally, including SQLite and offline synchronisation storage. Recorded ride data is sent to MOVRR services for history, verification, rewards and campaign functions. Do not assume passive detection makes an entire route permanently device-only once a recorded ride starts. We do not promise that every local location record is encrypted or cleared immediately on logout.

Location permission controls access on your device. It is distinct from the GDPR legal basis for using information. The purposes below distinguish requested ride processing, optional detection, security and campaign reporting.

Recorded GPS points, a separate complete route path and ride summaries are stored with your rider and session records. Summaries include distance, speed, duration and verification information. Deleting individual GPS points alone does not remove the route path or summary. Riders can access their own history; authorised operational administrators can also access ride-session records for their tasks.

Account management, authentication, requested ride recording and history, participation in a selected campaign, points accounting and reward fulfilment: Article 6(1)(b) GDPR, where objectively necessary to provide the service you request. Optional details and optional detection must not be made compulsory merely by describing them in these terms.

Optional background detection: Article 6(1)(a) applies only where you have given freely given, specific, informed consent through an affirmative choice, separately from operating-system permission. A default Smart Prompt setting or saved preference alone is not that consent. Choosing Manual stops passive detection prospectively. Optional website analytics and marketing use consent where required. Withdrawing consent does not affect earlier processing that was lawful; the Cookie Policy explains the available website controls.

Proportionate security, preventing fabricated rides or reward abuse, investigating errors, resolving disputes and maintaining reliability serve legitimate interests under Article 6(1)(f), limited by necessity and your interests and rights. Campaign reporting is limited to its specific purpose and necessary recipients; permission to access location does not authorise unrestricted reporting. Article 6(1)(c) applies to processing required by a specific applicable legal duty. A possible future duty does not justify unrestricted retention.

We associate ride sessions with your account and assess movement quality, distance, speed, timing, route or zone compliance and signals relevant to detecting fabricated activity. Hot Zones use geographic boundaries and eligible time windows to assess campaign participation and potential bonuses. Verification and settlement determine whether points are credited; live estimates are not final awards.

Automated rules can leave a ride pending, reject an activity or affect a points award. Contact support@movrr.nl to contest an outcome and request review by a person. We do not describe all decision-making as anonymous or certify that no decision can have a significant effect. Significant automated decisions require a separate Article 22 assessment and safeguards.

Authorised operational staff and authenticated reporting services can access records needed for their tasks. Campaign metrics can be derived from rider-linked information. Removing a name or combining a small number of riders does not necessarily make information anonymous. Access to identifiable operational records is distinct from publishing community content or providing aggregate campaign metrics.

When you organise, join or share a community ride, MOVRR processes the ride description, meeting place, schedule, participation and associated public-facing profile information. Content and images you make available through community features can be seen by the audience of that feature. Profile photos use public asset URLs: people with the URL may be able to view or copy them outside your account. Community ride covers use authenticated private delivery.

Avoid publishing a home address, sensitive route details, images of people without permission or confidential information. Deletion of the original does not recall copies other people have independently saved. Public community content is distinct from your private recorded ride history; do not assume all recorded GPS tracks are public.

You can report a Community Ride, its text or cover image, or its organizer for harassment, hate, sexual or violent content, spam, impersonation or another safety concern. Blocking limits discovery and new joining or invitations between you and that rider. It does not automatically end existing shared-ride participation; authorized shared-ride access can remain. We do not send block-specific notifications.

MOVRR processes account/rider references, the relevant ride and content version, report category, necessary evidence references, blocking choices and moderation decisions/timestamps. Authorized internal MOVRR administrators review reports and content. We use this information for our legitimate interests in protecting participants, investigating abuse, honoring blocking choices and reviewing our decisions. We use a legal-obligation basis only for an applicable identified duty, including handling privacy-rights requests. We do not use automated moderation.

Reports are retained for 12 months after resolution; necessary moderation decisions and evidence for 24 months after case closure. Active blocks remain until unblocked. We minimize unnecessary information sooner. Separately authorized, documented legal or safety holds can delay disposal of necessary evidence. Community covers use authorized private delivery; independently saved copies cannot be recalled. Rider-facing features do not disclose reporter identities or who blocked you.

You may request access, correction, erasure or restriction and object to processing based on legitimate interests. We review requests individually, including other people's rights and applicable lawful limitations. Contact privacy@movrr.nl for privacy rights or support@movrr.nl for Community Safety help. You can complain to the Autoriteit Persoonsgegevens. Reports use structured categories; please do not send unnecessary personal or sensitive information through support channels.

The inspected integrations include Supabase for authentication, database and file storage; MOVRR’s authenticated backend for rides, campaigns, wallets and fulfilment; Apple and Google for the sign-in and native map/platform services you use; Expo and the applicable Apple/Google push delivery services for notifications; and Sentry for enabled crash diagnostics and tracing. The website uses Vercel hosting/consented analytics, Supabase registration storage and Resend email delivery.

Reward fulfilment can involve the selected partner, including entitlement, redemption, token or collection-status information needed to deliver or validate the reward. Campaign and organisation users receive information according to their authorised roles. Staff and support access must be limited to their duties. Any disclosure required by a specific law or necessary for a legal claim must be limited to that purpose.

The recipients involved depend on the feature you use and the services enabled for it. A provider may process data on MOVRR’s behalf or act independently for its own sign-in, map or platform service. This policy does not treat rider-linked operational information as anonymous merely because a name is omitted. Contact privacy@movrr.nl for information about recipients and applicable processing safeguards.

When you request place search or cycling directions, the maps-proxy service forwards your search text, relevant origin/destination coordinates and request parameters to Google Places/Routes. The proxy is designed not to log or persist those search queries or coordinates itself; that does not establish Google’s retention or exclude storage of the resulting route elsewhere. Native map rendering also uses the applicable platform map service.

Email, Apple and Google authentication are enabled; phone sign-in is not currently enabled. MOVRR’s Resend sending domain has email-open and click tracking disabled. Verified EU service endpoints or an EU email-sending region do not establish that all provider processing remains within the EU; international processing is addressed below.

Push delivery uses device/push tokens, platform and relevant device information. Notification preferences, quiet hours and operating-system settings control supported messages. You can decline push permission; service and security information may still be delivered in the app or by email. Optional marketing requires the applicable permission and an accessible opt-out.

When enabled and configured, Sentry receives error information, technical device/app context, diagnostic breadcrumbs and sampled performance traces. The implementation can associate an account ID with events even though it removes email from the event’s user field. Such diagnostics must not be called anonymous. The generic mobile analytics wrapper currently has no configured external analytics sender; installing an SDK is not proof that it sends usage data.

Website registration stores the information you submit, such as name, email, city, audience and optional bicycle ownership, together with available IP-derived country/region/city/timezone, referral and campaign attribution. Resend delivers a confirmation and an internal registration notification. Registration is separate from creating a rider account. Optional website analytics are gated by an affirmative analytics choice; the Cookie Policy explains storage and controls.

Data should be kept only for a justified purpose and no longer than necessary. Account and requested service records support the continuing account; ride evidence supports verification and a proportionate dispute period; fulfilment and financial records support outstanding obligations and specific accounting duties; support/security records support resolution and a proportionate investigation period. These purposes do not establish that any particular retention period is currently enforced.

Automated cleanup does not currently provide a verified deletion deadline for every copy of ride and location data. Individual GPS-point cleanup does not remove separate route paths, summaries or device copies. Requests for erasure therefore need assessment across those copies and relevant providers. Necessary financial, redemption, support, security and legal evidence can require separate retention; only the records needed for the applicable obligation or documented claim should remain, with restricted use and an appropriate end criterion. An accounting duty does not justify keeping an entire profile or GPS trace. For the retention applicable to your records, contact privacy@movrr.nl.

Local cleanup depends on the storage type and the app running: the passive buffer holds up to 20 samples and is removed when consumed; offline foreground GPS cleanup applies a seven-day age limit when invoked; synced background GPS cleanup uses a 24-hour threshold when invoked. Recovery paths are cleared on the relevant completion/cancellation paths on a best-effort basis. Cache expiry is checked during app operations, and unsuccessful synchronisation records have no verified general expiry. These mechanisms are not a promise that every device copy disappears at a fixed elapsed time, on logout or when permissions are revoked.

Network requests use HTTPS and access controls are intended to restrict authenticated data. Some offline cache records use application encryption; this is not a statement that all local or server records are encrypted. No security measure guarantees that a service cannot be compromised.

Using an EU hosting or email-sending region does not exclude international processing. Supabase describes global support and content delivery and processing involving Singapore and the United States; Resend describes United States processing. Other providers may also involve access or processing outside the EEA. Where a transfer is not covered by an applicable adequacy decision, GDPR requires appropriate safeguards, such as applicable standard contractual clauses and the necessary assessment and supplementary measures. Contact privacy@movrr.nl for information about destinations and applicable safeguards or to request a copy. An EU service endpoint alone is not an assurance of EU-only processing.

Subject to the GDPR conditions, you may request access and a copy, correction, erasure, restriction, portability for qualifying consent/contract processing, and object to legitimate-interest processing. You may object to direct marketing at any time and withdraw consent prospectively. A refusal of consent does not remove rights in existing records.

Account → Privacy & Security contains privacy/export and deletion controls. Self-service deletion request acceptance and execution are currently unavailable; pressing Delete Account or receiving a review-required response does not establish that an account has been erased. Email the monitored privacy@movrr.nl address for a manually handled request, including if you cannot sign in. The in-app export covers selected account, route, ride-session, ledger and preference records; it is not an exhaustive access response. We may ask for proportionate verification; never send passwords, sign-in codes or an unsolicited identity-document copy.

GDPR requests must be answered without undue delay and normally within one month of receipt. A necessary extension of up to two further months must be explained within the first month. A response deadline is not a guarantee that all erasure or backups finish within that period. Requests are normally free, subject to the GDPR’s narrow exceptions.

You may complain to the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl) or another competent supervisory authority, and pursue available remedies. The Account Deletion and Data Rights notice explains request status, unfinished obligations and retention limits.

The MOVRR rider service is intended for adults aged 18 or over. If a child’s information has been provided, contact privacy@movrr.nl so it can be assessed.

The date shown with this policy identifies its current version. We will explain material changes through an appropriate channel. A privacy notice provides information; merely continuing to use MOVRR is not consent to new processing. New purposes or consent-dependent changes require the appropriate legal basis and choice.