PermisLux Privacy Policy

1. Introduction

This Privacy Policy (“Policy”) explains how PermisLux (“we”, “us”, or “our”) collects, uses, and protects personal data of users (“you”) of the PermisLux mobile application (“App”). We comply with the EU General Data Protection Regulation (GDPR) and applicable Luxembourg privacy laws.

2. Data Controller

PermisLux manages your data as the data controller. You can reach us at julien.kessels.dev@gmail.com.

3. Data We Collect

4. Location Data and Background Location

PermisLux collects location data only when a user deliberately starts the driving lesson recording feature and grants the relevant device permission. PermisLux does not collect location during normal theory-learning use or when no driving lesson is being recorded.

During an active driving lesson, the App collects precise or approximate location data to create the route, show it on a map, calculate distance, and attach lesson feedback to relevant route locations. Route data may include GPS coordinates, timestamps, accuracy, speed, heading, and altitude.

If the user grants background location permission, PermisLux also collects location data in the background, including when the App is closed or not in use, another app is open, or the screen is locked. This allows PermisLux to record a complete route during an active driving lesson. Background location collection begins only after the user starts a lesson and stops when the lesson is ended or cancelled.

Route data is initially stored on the recording device. When a driving session is saved or published, the route is uploaded to our Firebase/Firestore backend so it can be reviewed by the paired learner and instructor. Location data is not used for advertising or marketing, is not sold, and is not shared with sponsors.

Location permissions are optional and can be refused or withdrawn in the device settings at any time. Refusing or withdrawing them prevents route recording, but the App’s theory-learning features remain available.

5. Legal Bases for Processing

• Contract performance: delivering the App’s core functionalities.
• Legitimate interests: ensuring security, preventing abuse, improving UX.
• Consent: optional location access, background location, marketing communications, and optional notifications. Consent can be withdrawn at any time.
• Legal obligation: complying with accounting or regulatory requirements.

6. Data Sharing

We share data only with:

• The paired learner and instructor, who can access a driving session, its route, and shared lesson feedback after the session is published. Private instructor notes are not shared with the learner.
• Technical service providers acting on our behalf, including Google Firebase for authentication, backend hosting, cloud storage, and crash reporting, and Mapbox for map display.
• Payment processors (Apple, Google) for in-app purchases and subscriptions.
• Sponsorship partners (e.g., driving schools) solely if you consent to sharing contact details or using referral codes.
• Public authorities when required by law or to protect our rights.

7. Hosting and Transfers

We use service providers that may process data in the European Economic Area and in other countries. Where personal data is transferred outside the EEA, we rely on an applicable adequacy decision, Standard Contractual Clauses (SCCs), or another GDPR-compliant transfer safeguard.

8. Retention and Deletion

• Account data: kept while your account is active, then deleted within 24 months.
• Usage data: retained for 24 months, then aggregated or anonymized.
• Driving lesson and location data: retained while the driving session remains available to its participants. Either participant can delete a completed session in the App; this deletes its active cloud copy, route, and associated shared feedback for both participants. Related local copies are removed from devices when deletion is performed or synchronized.
• Billing records: stored for 10 years to meet legal obligations.
• Technical logs: generally kept for up to 12 months unless needed for security investigations.

Limited residual copies may remain temporarily in protected backups before being overwritten in the normal backup cycle, or for longer where retention is required by law or necessary to resolve a security incident or legal claim.

9. Your Rights

You have the right to access, rectify, erase, restrict, or object to processing, as well as data portability and the right to withdraw consent. Contact us at julien.kessels.dev@gmail.com to exercise these rights. You may also lodge a complaint with the Commission nationale pour la protection des données (CNPD) in Luxembourg.

You can withdraw location permission at any time through your device settings. You can also delete individual driving sessions in the App.

10. Security

We implement technical and organizational measures, including encryption, access controls, and incident response procedures, to protect your data. No system is completely secure, so we encourage you to choose a strong, unique password.

11. Third-Party Services

• Google Firebase: authentication, backend hosting, cloud storage, and crash reporting. Published driving routes are stored in Firebase.
• Mapbox: map display and related map requests.
• RevenueCat: subscription management.
• Superwall: paywall management.
• Apple and Google: app distribution, in-app purchase processing, and subscription status.

These providers process data according to their respective privacy terms and our contractual arrangements with them.

12. Minors

The App is not intended for children under 16 without parental consent. If you believe a minor has provided data without authorization, contact us so we can remove it promptly.

13. Notifications and Marketing

• Push notifications can be enabled or disabled in your device settings.
• Email marketing is sent only with your consent. Each message includes an unsubscribe option.

14. Changes to This Policy

We may update this Policy to reflect legal, technical, or operational changes. Significant updates will be announced in the App or via email. Where required, we will request consent before applying a material change to consent-based processing.

15. Contact

If you have any questions about this Policy or our data practices, contact us at julien.kessels.dev@gmail.com.