This policy explains what personal data RoadSpot collects when you use our website and mobile app, why we collect it, and the choices you have. We keep it short and plain on purpose.
RoadSpot provides GPS-triggered audio guides for ferries, tours, hotels and destinations through the RoadSpot mobile application and the website roadspot.com. RoadSpot is the data controller for the personal data described in this policy.
Account data. If you create an account: name, email address, password (stored hashed), and the language you choose.
Location data. The app uses your device location to play the right audio at the right place. Location is processed on your device while a tour is active. We do not build a history of where you have been.
Usage data. Which tours you open, how far you get, playback events and crash reports. This is aggregated and used to improve the guides and the app.
Contact form. Name, company, email and the message you send us through roadspot.com.
Device and website data. Device model, operating system, app version, IP address, browser type and the pages you visit on roadspot.com.
Our legal bases under the GDPR are performance of a contract (delivering the service), our legitimate interests (improvement, security, marketing analytics) and your consent (cookies and location access, which you can withdraw at any time).
roadspot.com uses Google Analytics and Google Ads conversion tracking to understand traffic and measure campaigns. These tools set cookies and may process your IP address. You can control non-essential cookies through the consent banner and in your browser settings.
We do not sell personal data. We share it only with processors who help us run the service: cloud hosting, analytics (Google), form handling (Formspree) and crash reporting. Each processor is bound by a data-processing agreement. Where a tour is published by one of our partners (a ferry line, museum or tour operator), that partner receives aggregated, anonymised usage statistics only.
Some processors are based outside the EEA, including in the United States. Transfers rely on the EU Standard Contractual Clauses or an adequacy decision such as the EU-US Data Privacy Framework.
Account data is kept while your account is active and deleted within 30 days of a deletion request. Contact-form messages are kept for up to 24 months. Aggregated analytics are kept indefinitely because they no longer identify you.
You have the right to access, correct, delete and export your personal data, to object to or restrict processing, and to withdraw consent. To exercise any of these, email us at the address below. You can also lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet).
To delete your RoadSpot account and the data stored with it, see roadspot.com/account-deletion.html.
RoadSpot is not directed at children under 13, and we do not knowingly collect personal data from them. If you believe a child has given us personal data, contact us and we will delete it.
We may update this policy from time to time. The current version is always available at roadspot.com/privacy.html with the effective date shown above.
Questions about privacy or your data? Get in touch.
