Privacy Policy

1. Data controller

2. Data we collect

We collect only the data needed to provide the service:

• Registration data: name, email address, phone number (optional, for verification), encrypted password.
• Profile data: profile picture, description, social networks (Instagram, TikTok, YouTube, LinkedIn), motorcycles you have added.
• Place of residence: the country and city you declare on your profile. The city is picked from a list, not typed in, and is stored together with the coordinates of the city: they are not your position and not your home address.
• Activity data: routes, events you attend, messages sent within the platform, groups you belong to.
• Technical data: IP address, device type and operating system, app version, push notification tokens (Firebase).
• Payment data: handled entirely by Stripe. SCRiders does not store card numbers or full banking details.
• Android access request: if you ask for access to the Android test version, we store the name and Google email address you give us. We do not ask for surnames: the email address is enough to give you access. It is only stored if you tick the consent box.
• Install attribution: when you open a shared SCRiders link on your phone, we store a derived identifier — an irreversible hash — of your IP address and operating system. The IP address itself is not stored.

3. Purpose and legal basis

• Performance of a contract (Art. 6.1.b GDPR): managing your account, access to features, payment processing and service-related notifications.
• Legitimate interest (Art. 6.1.f GDPR): platform security, fraud prevention and service improvement through aggregated, anonymous analysis.
• Legitimate interest (Art. 6.1.f GDPR) — install attribution: attributing an install to the link that led to it, so that the first time you open the app you land on the content that brought you there and not on the home screen. It is a minimal, non-reversible piece of data that cannot identify you.
• Legitimate interest (Art. 6.1.f GDPR) — public riders map: publishing on the SCRiders website a count of riders per city —the city's name, its point on the map and how many riders there are—, in order to make the community's reach known. No data that identifies you is published, and the list of who lives in each city still requires an account. If you would rather not appear, ask us and your city stops counting.
• Consent (Art. 6.1.a GDPR): sending marketing communications and community news, where you have expressly agreed to it.
• Consent (Art. 6.1.a GDPR) — early Android access: giving you access to the test version of the app. While the app is in closed testing, Google requires each person to be added by their Google account, so your email address is shared with Google when we add you as a tester. You can withdraw your consent at any time by writing to us.
• Legal obligation (Art. 6.1.c GDPR): keeping billing records as required by Spanish tax law.

4. Recipients and transfers

We share data only with trusted providers acting as data processors under a DPA:

• Stripe Inc. — payment processing (USA, under EU standard contractual clauses).
• Google Firebase — push notifications and anonymous analytics.
• Google Maps Platform — displaying routes and maps.
• VPS hosting provider — server in the EU where the data is hosted.
• Twilio — phone number verification by SMS (optional).
• Google Play — if you request access to the Android test version, your email address is added to the Google Play testers list.

We do not sell or transfer personal data to third parties for advertising purposes.

5. Data retention

• For as long as your account is active.
• After cancelling the account: a 30-day grace period (recovery), then permanent deletion unless a legal obligation applies.
• Billing records: 5 years, as required by Spanish tax law.
• Access and security logs: 12 months.
• Install attribution identifier: 15 minutes, or less once the app has read it. No copy or historical record is kept.
• Android access requests: until the app leaves closed testing, and no longer than 12 months from the request.

6. Your rights

Under the GDPR and the Spanish LOPDGDD, you may at any time exercise your right to:

• Access: obtain a copy of your personal data.
• Rectification: correct inaccurate or incomplete data.
• Erasure (“right to be forgotten”): request the deletion of your data.
• Portability: receive your data in a structured, machine-readable format.
• Objection and restriction: object to processing or request that it be restricted in certain circumstances.
• Withdrawal of consent: at any time, without affecting processing carried out beforehand.

To exercise these rights, write to us at privacidad@scriders.com. We will reply within 30 days at the latest. If you are not satisfied with our reply, you can lodge a complaint with the Spanish Data Protection Agency (AEPD).

7. Security

We apply appropriate technical and organisational measures to protect your data: TLS encryption in transit, passwords stored with bcrypt, role-based access restrictions, regular security audits and encrypted backups.

8. Cookies and similar technologies

The mobile app does not use cookies. The scriders.com website uses only:

• Essential technical cookies: needed for basic operation (user session). No consent required.

We do not use tracking, advertising or third-party analytics cookies on scriders.com.

9. Minors

SCRiders is intended for people aged 18 and over. We do not knowingly collect data from minors. If we find that a user is a minor, we will delete their account and associated data.

10. Changes to this policy

We will give notice of any substantial change by email or through a notice in the app at least 15 days in advance. Continuing to use the service after it takes effect means you accept the new version.

11. Contact

For any privacy enquiry: privacidad@scriders.com