Privacy Policy — Tacho
Version 1.0 — effective from 20. 4. 2026
This Privacy Policy explains what personal data the Tacho app collects, why it collects it, how it uses it, and what rights you have regarding your data.
1. Data Controller
The data controller within the meaning of Article 4(7) GDPR is:
Juraj Ďurček
Nádražná 2808/23A
900 28, Ivanka pri Dunaji, Slovak Republic
Email: podpora@tachoapp.eu
2. What data we collect and why
2.1 Data required for the service
Account data — name, email address. Legal basis: performance of contract (Art. 6(1)(b) GDPR).
Vehicle data — license plate, make, model, year, fuel type, average consumption, tank capacity, odometer readings, optional photo. Legal basis: performance of contract.
Trip records — start/end time, GPS route (polyline), distance, start/end location, speed data, duration, trip type (business/personal/commute), trip purpose. Legal basis: performance of contract.
Location and motion data The app monitors physical activity in the background to detect vehicle motion. When vehicle motion is detected, GPS recording starts automatically. GPS recording stops automatically when the trip ends. Location is never recorded outside of active trips. Legal basis: performance of contract.
Odometer records — readings at each trip, optional dashboard photos. Legal basis: performance of contract + legitimate interest.
Expenses — category, amount, date, merchant, fuel quantity and price, optional receipt photo. Legal basis: performance of contract.
Saved locations — names, addresses, GPS coordinates, geofence radius. Legal basis: performance of contract.
Travel orders (PRO) — employee data, trip purpose, destination, times. Legal basis: performance of contract.
2.2 Technical data
Device type, OS version, app version, push notification token, optional Bluetooth device identifier for trip detection.
2.3 Subscription data
Subscription status, expiry dates, subscription source. We never see or store your payment card details — these are handled exclusively by Apple or Google.
3. Data processors
| Processor | Purpose | Location | Safeguards |
|---|---|---|---|
| Supabase Inc. | Data storage | USA (EU servers — eu-west-1, Ireland) | Standard Contractual Clauses |
| RevenueCat Inc. | Subscription management | USA | Standard Contractual Clauses |
| Apple Inc. | App distribution, payments (iOS) | USA | Standard Contractual Clauses |
| Google LLC | App distribution, payments (Android) | USA | Standard Contractual Clauses |
| Resend Inc. | Email delivery | USA | Standard Contractual Clauses |
| Anthropic PBC | AI trip purpose suggestions (PRO only) | USA | Standard Contractual Clauses |
| Expo Technology Inc. | App builds, push notifications | USA | Standard Contractual Clauses |
We never sell your data to any third party.
4. International transfers
Some processors are based in the USA. All transfers are made under Standard Contractual Clauses (SCC) approved by the European Commission under Article 46 GDPR. Your app data is physically stored on Supabase servers in the eu-west-1 region (Ireland) — within the European Union.
5. Retention periods
| Data type | Retention period |
|---|---|
| Active account data | Duration of the contractual relationship |
| Data after account deletion | 30 days, then permanent deletion |
| Trip records | Duration of account + 30 days after deletion |
| Tax records | 10 years (Slovak legal requirement) |
| Odometer logs | 10 years (tax audit compliance) |
| Push tokens | Until revoked or account deleted |
| Technical logs | 90 days |
6. Your rights
Right of access (Art. 15) — Export all your data anytime via Settings → Privacy & Data → Export my data. You'll receive a JSON file by email within 24 hours.
Right to rectification (Art. 16) — Correct your data directly in the app or contact us.
Right to erasure (Art. 17) — Delete your account via Settings → Privacy & Data → Delete my account. Data deleted within 30 days except where legally required to retain.
Right to restriction (Art. 18) — Request restriction of processing under certain circumstances.
Right to data portability (Art. 20) — Receive your data in JSON format via the in-app export.
Right to object (Art. 21) — Object to processing based on legitimate interest.
Right to lodge a complaint — You may lodge a complaint with the Slovak Data Protection Authority:
Úrad na ochranu osobných údajov SR
Hraničná 12, 820 07 Bratislava
www.dataprotection.gov.sk
Send all data rights requests to: podpora@tachoapp.eu We will respond within 30 days as required by Art. 12 GDPR.
7. Cookies and analytics
The tachoapp.eu website currently uses no tracking cookies or analytics. The Tacho mobile app uses no advertising identifiers or tracking cookies. If this changes in the future, we will inform you in advance and request your consent.
8. Marketing communications
We currently send no marketing emails or promotional push notifications without your explicit consent. We only send transactional emails related to your account and subscription, and technical trip notifications if enabled by you. If we introduce marketing communications in the future, we will inform you in advance and obtain separate consent.
9. Data security
- Encrypted data transmission (HTTPS/TLS)
- Row Level Security (RLS) — each user can only access their own data
- Secure token-based authentication via Supabase
- Regular automated backups
10. Changes to this policy
We will notify you by email at least 30 days before any material changes take effect. The version date is always shown at the top of this document.
11. Contact
Email: podpora@tachoapp.eu Response time: within 48 hours (legal requests within 30 days)