NavyXo Privacy Policy

1. INTRODUCTION

Welcome to NavyXo, a comprehensive safety and emergency management platform for vehicle riders (motorcycles, bicycles, e-scooters, skateboards). This Privacy Policy explains how we collect, use, protect, and share your personal information when you use our mobile application and web services.

Info Media d.o.o. (referred to as "we," "us," or "our") is committed to protecting your privacy and complying with applicable data protection laws, including the General Data Protection Regulation (GDPR) and other regional privacy laws.

2. INFORMATION WE COLLECT

PERSONAL INFORMATION

• Account Data: Name, email address, phone number, profile image
• Emergency Contacts: Name, phone numbers, email addresses of your emergency contacts
• Subscription Data: Payment information processed through Stripe (we don't store card details)

LOCATION AND RIDE DATA

• GPS Coordinates: Real-time location during active rides
• Ride Routes: Planned and completed ride paths
• Incident Locations: GPS coordinates when falls or incidents are detected
• Geofencing Data: Entry/exit from designated safe zones

DEVICE AND TECHNICAL DATA

• Device Information: Device ID, platform (iOS/Android), app version
• Push Notification Tokens: Firebase Cloud Messaging (FCM) tokens
• Sensor Data: Accelerometer, gyroscope data for fall detection (processed locally)
• Usage Analytics: App usage patterns, feature utilization, error logs

EMERGENCY AND SAFETY DATA

• Incident Reports: Fall detection data, manual panic button activations
• Emergency Communications: SMS, email, voice call logs for notifications

FAMILY & LIVE TRACKING DATA

• Live Ride Sharing: Real-time location shared with designated family members or friends during active rides
• Tracking Links: Unique URLs generated for ride sharing with expiration timestamps
• Watcher Data: Names and access logs of people who view your live tracking
• Family Group Data: Information about family groups and member relationships
• Tracking History: Records of who accessed your location and when

3. THIRD-PARTY SERVICES WE USE

NavyXo integrates with multiple third-party services to provide comprehensive safety features. Here's a complete list of all external services and their purposes:

COMMUNICATION AND NOTIFICATIONS

• Telnyx - SMS delivery service
• Twilio - SMS, WhatsApp, voice calls
• Firebase Cloud Messaging - Push notifications
• Telegram Bot API - Telegram notifications

MAPS AND NAVIGATION

• OpenFreeMap - Map tiles
• GraphHopper - Route planning

STORAGE AND INFRASTRUCTURE

• MinIO - File storage
• Redis - Caching

PAYMENTS

• Stripe - Payment processing

4. HOW WE USE YOUR DATA

• Emergency Detection & Notification - Processing sensor data for fall detection and notifying emergency contacts
• Ride Tracking - Providing real-time location tracking and route sharing
• Family & Live Sharing - Enabling designated family members and friends to monitor your rides in real-time
• Service Improvement - Analyzing usage patterns to improve app features and performance
• Communication - Sending service-related notifications, updates, and alerts
• Legal Compliance - Fulfilling legal obligations and legal processes

5. DATA RETENTION

We retain your data only as long as necessary:

• Account Data: While your account is active, plus 30 days after deletion
• Location Data: 365 days for active rides, immediately after ride for real-time tracking
• Incident Data: 90 days for forensic analysis and improvement
• Payment Data: As required by Stripe and tax regulations
• Tracking Links: 24 hours after ride completion or link expiration
• Watcher Access Logs: 7 days for security audit purposes

6. YOUR RIGHTS

Under GDPR and other privacy regulations, you have the right to:

• Access - Request a copy of your personal data
• Rectification - Correct inaccurate data
• Erasure - Request deletion of your data ("right to be forgotten")
• Portability - Receive your data in a structured format
• Object - Object to certain processing activities
• Restriction - Restrict how we use your data

7. DATA SECURITY

We implement industry-standard security measures:

• Encryption of all data in transit (TLS 1.3) and at rest (AES-256)
• Regular security audits and penetration testing
• Access controls and least privilege practices
• Automated threat detection and incident response

8. CONTACT US

For privacy inquiries or to exercise your rights:

Email: [email protected]
Address: Info Media d.o.o., Pula, Croatia
Data Protection Officer: [email protected]

9. TRANSFERS OUTSIDE THE EUROPEAN UNION

Some of the services that carry your alerts and payments are operated from outside the European Economic Area. Twilio, Telnyx, Stripe and Firebase are established in the United States, so a phone number, an e-mail address, a location or a payment detail may be processed there when an alert is sent or a payment is taken.

Those transfers rest on the European Commission adequacy decision for the EU-US Data Privacy Framework where the provider is certified under it, and otherwise on the Standard Contractual Clauses adopted by the Commission, together with the additional measures agreed with each provider. You may ask us for a copy of the safeguards that apply to a particular transfer.

10. DATA ABOUT YOUR EMERGENCY CONTACTS

When you add an emergency contact you give us that person’s name and their phone number, e-mail address or messaging handle. We did not receive those details from them but from you, and Article 14 GDPR requires that we say so.

We use them for one purpose only: to ask that person for consent, and, once they have given it, to alert them if an incident is detected. A contact who has not consented is never alerted. Each contact may withdraw at any time from the link in any message we send them, after which we stop contacting them and delete their details. You are responsible for telling the people you add that you have added them.

11. THE NAVYXO GUARDIAN APP

NavyXo Guardian is a separate app, installed by somebody a rider named as an emergency contact. It has no account and no password: it is paired to one phone through the invitation link the rider sends, and that pairing is what it holds.

From that phone we receive only what is needed to ring it: a push notification token, the platform, the app version and the device model, whether the phone is allowed to show notifications at all, and an identifier of the handset which we store only as a hash and use only to recognise the same phone after the app is reinstalled. The app shows the name the rider gave the contact, and, when an alarm is raised, the rider’s location. It does not collect the guardian’s own location, does not read their contacts, has no advertising and records nothing in the background.

A guardian may withdraw consent at any time, inside the app or from the link in any message. Alarms then stop reaching them, their pairing is deleted, and the rider is told so that they know they are no longer covered.

SERVICE PROVIDER

Info Media d.o.o.
Širolina 9, 52100 Pula, Croatia
OIB (VAT ID): 33583811286
[email protected]