Legal & Policies

Safely is operated from- and based in the Netherlands. We are the data controller for personal data processed through the Safely service. For privacy questions, contact privacy@saferoute.com.

• Account data: email address, display name, and (optionally) avatar URL when you sign up.
• Waitlist data: email, city, user type (rider/driver/camera owner) and an optional note.
• Emergency contacts: names, phone numbers, and relationship labels that you add.
• Location — SOS & incident reports: latitude, longitude, and accuracy captured at the moment you trigger an SOS or file an incident report.
• Location — live tracking (opt-in): if you enable "Share live location" in the app, we collect your location periodically while the app is open, in order to update your route safety score and share your position with the emergency contacts you selected. This is off by default, requires explicit consent, only runs while the Safely app is in the foreground, and can be stopped at any time from the app. We do not track your location when the app is closed or in the background.
• Incident reports: type (harassment, theft, assault, unsafe, sos), location, timestamp, and optional note.
• Technical data: minimal server logs (IP address, user-agent, request path) for security and abuse prevention.

• Contract — to provide the account, waitlist, and safety features you request.
• Legitimate interest — to keep the service secure, prevent abuse, and improve reliability.
• Consent — for optional features (e.g. sharing your location with emergency contacts). You can withdraw consent at any time.
• Vital interests — where processing is necessary to protect your life or the life of another person (e.g. transmitting SOS location to contacts you selected).

• To operate SOS: transmit your location to the emergency contacts you designated.
• To power live route safety scoring and share your location with your chosen contacts, when you opt in to live location sharing.
• To display community incident markers (location only — no reporter names are shown to other users).
• To send transactional emails (waitlist confirmation, password reset, magic link).
• To keep the service secure and prevent abuse of the platform.

We do not sell your personal data. We do not use your data to build advertising profiles.

Signed-in Safely users can see incident type, location (lat/lng), and timestamp on the community map. Reporter identities are not shown to other users. Administrators of Safely may see a truncated internal user identifier for moderation, but never see your name, email, or contact details alongside an incident on the public map.

We rely on a small number of processors to run Safely:

• Lovable Cloud (managed hosting, database, authentication, email delivery).
• Google — only if you choose to sign in with Google.

We do not share your data with any other third parties except when legally required (e.g. court order).

Where data is processed outside the European Economic Area, we rely on the European Commission's Standard Contractual Clauses or an equivalent lawful transfer mechanism.

• Account data: kept while your account exists.
• After account deletion: a 30-day grace period for recovery, then full deletion.
• SOS events & incident reports: retained for safety analytics; may be anonymised (reporter link removed) after 12 months.
• Live location samples (opt-in): kept for up to 24 hours to power the current route score, then automatically deleted. Never used for advertising or profiling.
• Waitlist emails: kept until you unsubscribe or the waitlist is closed.
• Server logs: up to 90 days.

You have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Delete your account and associated data.
• Restrict or object to certain processing.
• Receive your data in a portable format.
• Withdraw consent at any time.
• Lodge a complaint with your supervisory authority — in the Netherlands, the Autoriteit Persoonsgegevens.

To exercise these rights, email privacy@saferoute.com.

We use industry-standard measures: TLS in transit, encrypted storage at rest, row-level access controls in the database, and least-privilege service accounts. No system is 100% secure — please use a strong password and enable any additional protections offered.

Safely is designed to help families feel safer, and children may use the service with the consent and supervision of a parent or legal guardian. Under the GDPR (and Dutch law), children under 16 cannot lawfully consent to the processing of their personal data by an online service on their own — a parent or legal guardian must give or authorise that consent.

How parental consent is captured and recorded. When a parent invites a child through Safely Family, the parent explicitly confirms they are the child's parent or legal guardian and consents to the processing described here. When the child accepts the invite, we record an immutable consent entry containing: parent user id, child user id, the policy version consented to, the timestamp, the IP address, and the browser/user-agent. Consent can be withdrawn at any time — the record is not deleted but is marked as revoked, so we retain a truthful audit trail of who consented when. Every invite also carries a short cool-down window before it can be redeemed, so a link created by mistake or under pressure can be reviewed or revoked in time.

If you are a parent or legal guardian:

• You are responsible for reviewing this Privacy Policy and the Terms of Service before your child uses Safely.
• You must create or approve the account, provide consent for the processing of your child's personal data (including location data when the child opts in to live tracking or SOS), and help your child set up their emergency contacts.
• You can, from the Family screen, download a copy of your child's data (right of access & portability, GDPR Art. 15/20) or remove the link, which revokes consent and stops all sharing.
• You may withdraw consent, request access to your child's data, or request deletion at any time by emailing privacy@saferoute.com.

If we become aware that a child under 16 has created an account without verifiable parental consent, we will suspend the account and delete the associated personal data unless a parent or guardian confirms consent within a reasonable period. At launch, Safely is offered in the Netherlands and the wider EU only; we do not currently support signups from regions with different children's privacy regimes (for example the United States under COPPA).

We may update this policy. Material changes will be communicated by email or in-app notice at least 14 days before taking effect.