1. Data Controller
My Rides is a mobile mileage tracking application developed and managed by:
My Rides — Arnaud Detilloux, sole proprietorship (eenmanszaak)
Enterprise number: 1043.727.126
Pastoor Van de Wouwerstraat 21, 2600 Antwerpen
Email: support@myrides.be
Website: myrides.be
Arnaud Detilloux is the data controller within the meaning of the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679). For any privacy-related questions, you can contact us at support@myrides.be.
2. Data We Collect
To provide the app's functionality, we collect and process the following data:
- Account data: email address, name and password. Your password is stored in encrypted form (bcrypt hash) and is not readable by us.
- Location data (precise GPS): during an active trip, we record your GPS coordinates (latitude and longitude) every 10 to 20 seconds. This includes background tracking when your screen is off. The complete route is stored as route points.
- Trip data: date, departure address, destination address, distance, category (client visit, supplier visit, training, commute, other business), purpose, vehicle, duration and route points array.
- Vehicle data: vehicle name, license plate number, vehicle type (electric, hybrid, combustion) and transport mode (car, bicycle).
- Receipts: photos taken via your device's camera are stored in secure cloud storage. We also retain metadata: date, amount, station/vendor, category (fuel, parking, toll, maintenance, other) and notes.
- Subscription data: subscription type, status, expiry date, Apple or Google transaction IDs and trial status.
- Favorite routes: saved route names with departure and destination coordinates.
- Device information: platform (iOS/Android), app version and language preference. The platform may also be derived from the technical data of your sign-in session.
- How you heard about My Rides: when you sign up, you can optionally tell us how you heard about the app (for example through your accountant or via Google).
- Emails with tips and offers (only with your consent): if you tick the box when you sign up, we occasionally send you tips and offers by email from mail.myrides.be and we measure whether you open these emails and click links (using an invisible pixel and redirected links). Without that consent we measure nothing: service emails come from support@myrides.be without measurement. You can unsubscribe at any time via the link in every email; these emails and the measurement then stop.
- Business inquiry form (website): if you fill out the business contact form, we collect company name, contact person, email address, phone number, number of accounts and your message.
- Security logs: IP addresses are temporarily logged for rate limiting and abuse prevention.
3. Legal Basis for Processing
We process your data on the following legal bases under the GDPR:
- Performance of a contract (Art. 6(1)(b) GDPR): account data, trip data, vehicle data, receipts and subscription data are necessary to operate the app and deliver the service you requested.
- Explicit consent (Art. 6(1)(a) GDPR): background GPS tracking and camera access for photographing receipts. You give this consent via your device's system prompts and can withdraw it at any time through your device settings.
- Legitimate interest (Art. 6(1)(f) GDPR): rate limiting, security logging and abuse prevention to ensure the safety and availability of the service.
4. Purpose of Processing
We use your data exclusively for the following purposes:
- Recording and tracking your business trips
- Calculating distances and routes via GPS tracking
- Calculating an indicative mileage allowance based on Belgian rates
- Generating Excel and PDF reports for your accounting
- Storing receipts related to your trips
- Managing your subscription and payments
- Sending transactional emails (confirmation, password reset)
- Securing the service against abuse
- Processing business inquiries via the contact form
We never sell your data to third parties. We do not use your data for advertising or profiling.
5. Third Parties
To operate the app, we share certain data with the following third parties (processors):
- Supabase Inc. (database, authentication, file storage) — processes your account data, trip data, receipts and all other app data. Servers are located in the European Union. Supabase acts as a processor under a Data Processing Agreement (DPA).
- Google Maps Platform (Google LLC) (Places Autocomplete, Geocoding, Directions API) — receives GPS coordinates and address queries to calculate routes and look up addresses. Based in the United States.
- Apple Inc. (App Store, In-App Purchases, Server Notifications V2) — receives your user ID (as appAccountToken) and transaction IDs for subscription processing. Based in the United States.
- Google LLC (Google Play Billing, Developer API, Pub/Sub RTDN) — receives your user ID and purchase tokens for subscription processing. Based in the United States.
- Resend Inc. (transactional email service) — receives email addresses and email content for sending confirmation, password reset and service emails and, with your consent, tips and offers (including measuring opens and clicks). Based in the United States.
6. International Data Transfers
Your core data (trips, receipts, account) is stored on Supabase servers in the European Union.
For certain services, data is processed by parties in the United States (Google, Apple, Resend). These transfers are protected by Standard Contractual Clauses (Art. 46(2)(c) GDPR), approved by the European Commission as an adequate safeguard for the protection of personal data.
7. Data Retention
- Trip data, receipts and vehicles: retained for the duration of your account.
- Subscription data: retained as long as the subscription is active, plus 30 days after expiry.
- Security logs (IP addresses): automatically deleted after 24 hours.
- Sent emails and the measurement of opens and clicks: kept as long as your account is active; measurement stops when you unsubscribe.
- Upon account deletion: all your data is permanently deleted within 30 days.
Important: Belgian tax law (Art. 315 ITC) requires fiscal documents to be retained for 7 years. We recommend exporting your trips (Excel/PDF) before deleting your account to comply with this legal obligation.
8. Security
We take the protection of your data seriously and apply the following security measures:
- All connections are secured via HTTPS/TLS encryption
- Passwords are stored as bcrypt hashes and are not readable
- Database access is protected by Row Level Security (RLS): users can only access their own data
- Receipts are stored in secure cloud storage with access controls
- Subscription data is read-only for users (write permissions are restricted to the server system)
- Rate limiting protects against abuse and brute-force attacks
- API keys and sensitive configuration are securely stored as environment variables
9. Your Rights
Under the GDPR, you have the following rights regarding your personal data:
- Right of access (Art. 15): you can request what data we process about you.
- Right to rectification (Art. 16): you can have inaccurate data corrected.
- Right to erasure (Art. 17): you can request deletion of your data. In the app, you can delete your account via Settings.
- Right to restriction of processing (Art. 18): you can request that we restrict the processing of your data.
- Right to data portability (Art. 20): you can export your data in a structured format. The app offers Excel and PDF export.
- Right to object (Art. 21): you can object to processing based on legitimate interest.
- Right to withdraw consent (Art. 7(3)): you can withdraw your consent for location tracking and camera access at any time through your device settings.
To exercise your rights, send an email to support@myrides.be. We will respond within 30 days.
Lodge a complaint: if you believe we are not processing your data correctly, you can lodge a complaint with the Belgian supervisory authority:
Data Protection Authority (Gegevensbeschermingsautoriteit / GBA)
Drukpersstraat 35, 1000 Brussels
Email: contact@apd-gba.be
Website: www.gegevensbeschermingsautoriteit.be
10. Children
My Rides is a professional tool for self-employed individuals and is not intended for persons under 18 years of age. We do not knowingly collect data from minors. If you discover that a minor has registered, please contact us so we can delete the account.
11. Cookies & Tracking
The My Rides app and website use no cookies, no advertisements and no third-party analytics tracking.
The only exception: in emails with tips and offers we measure whether you open them and click links, and only if you consented to this (see section 2). You can withdraw that consent at any time via the unsubscribe link in every email.
The website does not use cookies and does not store any data in your browser. Your language is determined by the language version of the page (URL).
12. Data Breach
In the event of a personal data security breach, we will:
- Notify the Data Protection Authority (GBA) within 72 hours of discovery, as required by Art. 33 GDPR, unless the breach is unlikely to pose a risk to your rights.
- Inform you directly and without undue delay if the breach is likely to result in a high risk to your rights and freedoms (Art. 34 GDPR).
- Document the nature of the breach, the possible consequences and the measures taken.
13. Automated Decision-Making
My Rides does not use automated decision-making or profiling within the meaning of Art. 22 GDPR. The tax calculations in the app (indicative mileage allowance, mileage rates) are informational tools and do not constitute legally or financially binding decisions.
14. Changes to This Policy
We may update this privacy policy from time to time. In case of substantial changes, we will notify you via the app or by email. The most recent version is always available on this page with the date of the last change at the top.
15. Contact
For any questions about this privacy policy or about the processing of your data, you can contact:
Arnaud Detilloux
Email: support@myrides.be
Website: myrides.be