Privacy Policy

Proxima Suite & Proxima Drivers

1. Data Collected and Purposes

Account and Profile

Through Google / Apple OAuth we receive: email, name and profile photo. You can add: display name, city, country, account type. The avatar photo is resized and GPS metadata removed before saving.

Vehicles

License plate, VIN, make, model, year, fuel type, mileage, color, photos (with EXIF/GPS metadata automatically removed before upload), service history.

Activity

Posts, comments, likes, challenge participation, private messages, streak leaderboard.

Geographic Location

GPS is used only while the app is open ("while in use") and only upon explicit request. In the profile we save only city and country (never precise coordinates). In the marketplace, coordinates are obscured to ±1 km before being saved.

2. Legal Basis (Art. 6 GDPR)

Art. 6(1)(b) Contract Performance — account creation, garage management, messages, marketplace.

Art. 6(1)(a) Consent — GPS location detection (optional, revocable at any time).

Art. 6(1)(f) Legitimate Interest — platform security, fraud prevention, technical logs.

3. Data Recipients

Google Cloud Platform (Cloud Run + Cloud SQL, region europe-west1) — API execution and primary database hosting.

Firebase Authentication (Google) — user authentication and account identity management.

Cloudflare R2 — media file storage (avatars, post photos, story media, vehicle images).

OpenStreetMap / Nominatim — reverse geocoding (coordinates → country/city). Receives coordinates only when you use GPS. No identifying user data transmitted.

Wikipedia — retrieval of illustrative vehicle images. Receives make and model. No user data transmitted.

Google / Apple — for OAuth authentication only. See their respective privacy policies.

Google AdMob (Google Ireland Limited) — in-app advertising delivery. The app integrates Google's certified User Messaging Platform (UMP) to allow users to freely grant, manage or withdraw consent for ad personalization and tracking in compliance with the ePrivacy Directive and GDPR. Google Privacy & Terms: https://policies.google.com/technologies/ads.

Didit Identity Spain, S.L. (Didit Protocol, Barcelona, Spain) — provider of optional identity and biometric verification services (KYC). Official identity documents and 3D liveness biometrics are collected and processed directly and exclusively on Didit GDPR-compliant servers. Proxima Drivers receives and records only the verification status (boolean outcome) and a session tracking ID, without storing or processing copies of identity documents or biometric templates on its own databases.

4. International Transfers

The main infrastructure is hosted in the EU (europe-west1). If data is transferred to third countries by subprocessors, we apply safeguards under Art. 46 GDPR, including Standard Contractual Clauses (SCC) where required.

5. Data Retention

Account, profile, social and marketplace data: retained for the duration of the account.
After account deletion: personal account data is deleted or anonymized within 30 days (including backups).
Vehicle History Ledger & Fraud Prevention: For commercial transparency, anti-mileage fraud, and road safety integrity, objective vehicle technical data (recorded mileage, attached historical reports, service dates, accident history, and VIN number) remain permanently associated with the vehicle chassis even after vehicle sale or account deletion, strictly decoupled and devoid of any personal or identity data of previous owners (anonymized vehicle ledger).
Technical access logs: 90 days.
Private messages: deleted or irreversibly anonymized upon account cancellation.

6. Your Rights (Arts. 15–22 GDPR)

Access (Art. 15)

Know what data we process about you.

Rectification (Art. 16)

Correct inaccurate or incomplete data.

Erasure (Art. 17)

Delete your account: Profile → Delete Account. Extended deletion applies, with documented anonymized anti-fraud exceptions.

Portability (Art. 20)

Receive your data in a readable format. Write to [email protected].

Objection (Art. 21)

Object to processing based on legitimate interest.

Withdraw Consent

You can revoke GPS consent at any time from your device settings.

To exercise your rights: [email protected]. We will respond within 30 days.

7. Right to Complain

You have the right to lodge a complaint with the competent supervisory authority. In Italy: Garante per la protezione dei dati personali — www.gpdp.it

8. Cookies and Similar Technologies

The mobile app does not use cookies. The web version exclusively uses sessionStorage for user session management (not for tracking or profiling).

9. User Privacy Controls

Nickname

You can choose a unique nickname to display instead of your real name. By enabling the option in Privacy settings, other users will see only the nickname in posts, searches and suggestions.

Garage Visibility

You can make your garage private: other users will not be able to see your vehicles. Your profile will remain visible but without the vehicles section.

Photos and Metadata

All EXIF/GPS metadata is automatically removed from every uploaded photo (avatar, posts and vehicles). No action required.

10. Data Breach

In case of a personal data breach posing a risk to the rights and freedoms of data subjects, Proxima Suite will notify the supervisory authority within 72 hours of discovery (Art. 33 GDPR). If the risk is high, we will also inform affected users via in-app notification and/or email (Art. 34 GDPR).

11. Automated Decisions

The platform does not perform automated profiling with legal effects. The system suggests similar users ("People you might know") based solely on city and vehicle make, without credit scoring or automated decisions producing significant effects.

12. Minors

Proxima Drivers is intended for users aged 18 or older. We do not intentionally collect personal data from minors. If you believe a minor created an account, contact us at [email protected].

13. Security

We adopt appropriate technical and organizational measures: TLS encryption in transit, at-rest encryption for databases and object storage, authenticated API access, least-privilege service permissions, and role-based access controls.