Access
Get a copy of the personal data we hold about you.
01 · Controller
Who we are
Driving Roads ("we", "us", "our") is a web app that discovers, scores and maps thrilling driving roads worldwide. For the purposes of the EU General Data Protection Regulation (GDPR), the data controller responsible for your personal data is:
- Operator: AD Driving Roads
- Registered address: Seitenstettengasse 5/37, 1010 Vienna, Austria
- Contact: andrei@contentgrowthlab.com
02 · Scope
Scope & summary
This policy covers personal data we process through our website and app. In short:
- You can browse the map and view road details without an account. We don't ask you to sign in to explore.
- Creating an account lets you save roads, mark roads as driven, build a logbook and export routes to your phone. That requires us to store the data tied to your account.
- We use a small number of essential cookies to keep you signed in, and we remember a couple of preferences on your device.
- We do not sell your personal data, and we do not run advertising.
03 · Data
What data we collect
Account data
When you register and use your account, we process: your email address, a password (stored only as a secure hash — we never see it in plain text), and any profile settings you choose, such as display name, home region and your units preference (km/mi).
Activity & logbook data
To make the product work, we store the roads you save to your wishlist, the roads you mark as driven, your journey timeline, the badges you've earned, and a count of your send-to-phone exports (used to apply plan limits).
Technical & security data
For security and to keep accounts working, we record sign-in events (such as the time you logged in) and a country derived from your IP address by our hosting provider's edge network. We process your IP address transiently when serving the site; we don't build a long-term log of full IP addresses tied to your identity.
Payment data
If you upgrade to Pro, payments are processed by Stripe. We do not receive or store your full card number. We store a Stripe customer reference and your subscription status (e.g. whether your plan is active) so we can grant Pro features and manage billing. Stripe processes your payment details under its own privacy policy.
What we don't collect
We don't ask for your real-time GPS track or continuously follow your location. When you use the "locate me" button, your browser shares your position with the map for that session only; we don't store it.
04 · Purpose & legal basis
How and why we use your data
Under the GDPR we must have a lawful basis for each use of your data. Here's the breakdown:
| What we do | Why | Legal basis |
|---|---|---|
| Run your account | Authenticate you, store your profile, save roads and logbook | Contract — Art. 6(1)(b) |
| Provide Pro features & billing | Grant Pro access, process subscriptions, prevent abuse of plan limits | Contract — Art. 6(1)(b) |
| Keep the service secure | Detect abuse, log sign-ins, protect accounts | Legitimate interests — Art. 6(1)(f) |
| Measure & improve the product | Understand how the site is used (via Google Analytics) so we can make it better | Consent — Art. 6(1)(a) |
| Keep tax & payment records | Comply with accounting and tax law for paid subscriptions | Legal obligation — Art. 6(1)(c) |
| Send service emails | Account confirmation, password resets, important changes | Contract / Legitimate interests |
Where we rely on legitimate interests, we've considered the impact on you and limited what we collect to what's needed. You can object to that processing — see section 9.
05 · Cookies
Cookies & local storage
A cookie is a small file stored by your browser. We also use your browser's local storage to remember a few preferences on your device. We keep these to a minimum and use them only for the purposes below.
| Name / type | Purpose | Lifespan | Category |
|---|---|---|---|
| sb-…-auth-token | Keeps you securely signed in (set by our auth provider, Supabase) | ~Session / refresh | Essential |
| send-to-phone preference | Remembers whether you prefer Apple or Google Maps for exports (local storage) | Until cleared | Preference |
| Map / display preferences | Remembers display choices such as your chosen units (local storage) | Until cleared | Preference |
| _ga | Google Analytics — distinguishes visitors to measure how the site is used (runs only with your consent) | 2 years | Analytics |
| _ga_<id> | Google Analytics — keeps session state for the GA4 property (runs only with your consent) | 2 years | Analytics |
Analytics. We use Google Analytics to understand how the site is used so we can improve it. These cookies run only if you accept them — you can decline analytics and the rest of the site works normally, and you can withdraw your consent at any time. Google Analytics is provided by Google and processes this data under its own privacy terms.
Map tiles. The interactive map is served by Mapbox. When the map loads, your browser requests tiles directly from Mapbox, which receives your IP address and request data as a normal part of delivering the map. This is necessary for the core feature.
Fonts. We load typefaces from Google Fonts, which means your IP address is shared with Google when fonts are fetched.
You can clear or block cookies in your browser settings, but blocking essential cookies will prevent you from staying signed in.
07 · Transfers
International data transfers
Some of our processors are based outside the European Economic Area (EEA), or may process data in countries including the United States. Where data is transferred outside the EEA, we rely on appropriate safeguards — typically the European Commission's Standard Contractual Clauses and, where applicable, adequacy decisions such as the EU–US Data Privacy Framework.
Where we can choose an EU/EEA processing region for your data, we do so. For transfers that nonetheless take place outside the EEA, the safeguards described above apply.
08 · Retention
How long we keep your data
- Account & logbook data — kept for as long as your account is active. When you delete your account, this data is removed.
- Deletion is self-service. You can permanently delete your account and associated data from your account settings at any time; the deletion cascades across our database.
- Payment & tax records — retained for the period required by tax and accounting law (7 years under Austrian law), even after account deletion.
- Security logs — kept only as long as needed to protect the service, then deleted or anonymised.
09 · Your rights
Your rights under the GDPR
If you're in the EEA (and in many cases beyond it), you have the following rights over your personal data. To exercise any of them, contact us using section 12 — we'll respond within one month.
Rectification
Correct data that's wrong or incomplete — much of it you can edit yourself in settings.
Erasure
Delete your account and data — available directly in your account settings.
Portability
Receive your data in a portable, machine-readable format.
Restriction
Ask us to pause processing of your data in certain circumstances.
Objection
Object to processing we base on legitimate interests.
You also have the right to lodge a complaint with a supervisory authority. In Austria, this is the Austrian Data Protection Authority (Datenschutzbehörde), dsb.gv.at.
10 · Security
How we protect your data
We use industry-standard measures to keep your data safe: encrypted connections (HTTPS), hashed passwords, row-level security on our database so each user can only access their own records, and restricted administrative access. No system is perfectly secure, but we take reasonable steps to reduce risk and will notify you and the relevant authority of a breach where the law requires.
11 · Children
Children
Driving Roads is intended for adults with a driving licence and is not directed at children. We don't knowingly collect data from anyone under 16. If you believe a child has given us personal data, contact us and we'll delete it.
12 · Updates & contact
Changes to this policy & how to reach us
We may update this policy as the product evolves or the law changes. When we make material changes, we'll update the "last updated" date above and, where appropriate, notify you. The current version always lives at this page.
Questions about this policy or your data? Reach us at andrei@contentgrowthlab.com, or write to the address in section 1.