Privacy policy

1. Data controller

TrapSpotter is a trading name of TrapSpotter BV.

Address: Emiel Clauslaan 95B box 103, 9800 Deinze, Belgium

Company number (VAT): BE1031603017

Privacy / DPO email: privacy@trapspotter.com

General contact: contact@trapspotter.com

2. What data do we collect?

We collect the following data to provide and improve our services:

• Account data: email address, username, telephone number, and password
• Location data: GPS coordinates for real-time alerts along your route
• Usage data: information about reports, routes, and preferences
• Device data: device type, operating system, app version, and push token
• Payment data: processed by Apple, Google, or Stripe; we do not receive card details
• Communications: messages sent to our AI assistant or WhatsApp bot

3. Why do we collect this data?

• To provide alerts, navigation, and community reports
• To manage your account and subscription
• To improve our app and services
• To communicate about your account and important updates
• To comply with legal obligations
• To prevent fraud and combat abuse

4. Legal basis (GDPR Article 6)

We process personal data on the following grounds:

• Consent for optional features such as push notifications, analytics, and marketing; consent can be withdrawn at any time
• Performance of a contract to provide account access, subscriptions, and alerts
• Legitimate interests in fraud prevention, security, product improvement, and infrastructure protection
• Legal obligations relating to tax records and lawful authority requests

5. Sharing with third parties (sub-processors)

We do not sell your data. We only share it with sub-processors that help deliver our services under GDPR-compliant agreements.

• Supabase — database, authentication, and file storage using EU hosting in Frankfurt
• Stripe — web payments and subscriptions
• RevenueCat — iOS and Android subscription management
• Apple App Store / Google Play Store — in-app payments
• Mapbox — maps and reverse geocoding
• TomTom — traffic and hazard data for premium users
• OpenAI — AI chat assistant; your data is not used for model training
• Twilio — SMS one-time passwords and the WhatsApp bot
• Meta — conversion measurement through Pixel and Conversion API, only after consent
• Google Tag Manager — tag management; no tracking without consent

6. Your rights

Under the GDPR, you have the right to:

• Access the data we hold
• Correct inaccurate data
• Request deletion (the right to be forgotten)
• Restrict processing
• Receive portable data in a structured format
• Object to certain processing
• Withdraw consent
• Lodge a complaint with the Belgian Data Protection Authority

7. Security

We use appropriate technical and organisational measures, including TLS 1.3 in transit, AES-256 at rest, database-level row security, rate limits on sensitive endpoints, idempotent payment webhooks, and audit logs for subscription changes.

8. Retention

We keep data only as long as necessary:

• Account and profile data: while your account is active; deleted immediately after account deletion
• SMS and one-time password codes: expire after 10 minutes and are then deleted
• Payment records: 7 years under Belgian accounting law
• Community reports: their content may remain available to the community but is disconnected from your identity after account deletion
• Anti-fraud data: up to 24 months in one-way hashed form

9. International data transfers

Our primary infrastructure is located in the EU. Some sub-processors, including Stripe and OpenAI, are established outside the EU. Transfers rely on appropriate safeguards:

• EU Standard Contractual Clauses (SCCs)
• European Commission adequacy decisions where applicable
• Additional safeguards required following the Schrems II judgment

10. Children

TrapSpotter is intended for drivers and is not designed for anyone under 16. We do not knowingly collect data from children below the GDPR age threshold. Parents or guardians can report a concern to privacy@trapspotter.com.

11. Cookies and tracking

Our website uses a limited number of cookies and pixels. See /cookies for details. The mobile app does not use browser cookies, but may activate a Meta conversion pixel after opt-in under Settings → Analytics & tracking.

12. Changes

We may update this privacy policy. The date at the top indicates the latest revision. Material changes will be announced by email or an in-app banner.

13. Contact and complaints

Privacy / DPO email: privacy@trapspotter.com

Address: Emiel Clauslaan 95B box 103, 9800 Deinze, Belgium

You may lodge a complaint with the Belgian Data Protection Authority at https://www.dataprotectionauthority.be/ if you believe we are processing your data incorrectly.