Privacy policy
This policy explains what personal data the Waylo app processes, why, who receives it, how long we keep it and what rights you have. Waylo uses your phone's location and its Bluetooth connection to your car (or, if you choose, your phone's movement for a car without Bluetooth) to record your drives into a logbook automatically.
1. Controller
The controller of your personal data is Nemec s.r.o., Lieskové 449, 906 33 Cerová, company ID: 47030151, VAT ID: SK2023718994, Registered in the Commercial Register of the District Court Trnava, section Sro, entry no. 31154/T, https://heywaylo.com ("we"). Contact for all data protection questions and to exercise your rights: privacy@heywaylo.com.
2. What data we process
| Group | Data |
|---|---|
| Account | Email address, sign-in method (Google or email and password), account creation time, optionally first name, last name and title (shown in the export as the driver's name). The password is held by Firebase Authentication; we never see it. If you use Waylo without an account (the free trial without signing in, and free use afterwards), you are known only by a random identifier issued by Firebase Authentication: no email address and no name. |
| Cars | The Bluetooth address and name of your car (for a car without Bluetooth: its name and a random identifier made up by the app, and a note that it has no Bluetooth), its fuel consumption from the registration papers, odometer readings you enter or give when exporting. |
| Drives | Start and end time, distance, route (GPS points with accuracy and speed), start and end addresses, type (business/private), purpose, refuel flag, the car used (a drive found by movement has no car until you choose one). |
| Drive event log | Short technical notes with times about how each drive started and ended: for example that Bluetooth connected or dropped, that your phone recognised you entering or leaving a vehicle, the settings the drive ran under, and the reason it ended. They contain no location. |
| Your places and purposes | Saved places (name, address, coordinates, radius) and the purpose texts you create. |
| Exports | A record of each export: period, filters used, odometer values, consumption, language, time. The Excel file itself is not stored on our server. |
| Subscription | A Waylo Pro purchase is processed by Google Play. We receive a purchase token and its state (plan, renewal, end date) so we can tell whether you have Pro, and we never receive your payment card details. |
| Free trial | When the trial started and ends. To allow one trial per person, we keep a coded reference of your account and a coded fingerprint of your email address (made with a secret key, so it cannot be turned back into the address) for 24 months, even after the account is deleted. When you start the trial (with or without an account), we also keep a coded fingerprint of your phone's Android ID (made with a secret key, so it cannot be turned back into the identifier) for 24 months, so that one phone gets one trial, whoever uses it. It is never used to recognise you, to sign you in or to restore your data. It contains nothing else. |
| Technical data | IP address and request data handled by our hosting provider for security and abuse protection. On your phone, app settings and the queue of drives waiting to upload are kept locally. |
| Crash reports | When the app crashes or meets an unexpected error: the technical trace of the error, the app version, the phone model and Android version, what the app was doing at that moment (for example whether a drive was recording) and an installation identifier. Never your location, drives, places or email address. With it goes the last part of the app's own notes (see Problem reports). |
| Problem reports | Only when you tap "Report a problem" in Settings: a short log the app keeps about itself (codes and times, for example that you signed in or out, that a permission was withdrawn, that the connection dropped, that a request to our server failed, why the system closed the app, and the ride log described above), the app version, the phone model, Android version and language, the state of the app's permissions and switches, how many drives wait to upload, and the sentence you write, if any. It is sent with your account so we can find it. It contains no location, no address, no email address and no name. |
We use no advertising, no behavioural analytics and no profiling. We do not sell your data.
3. When location is collected
Location is recorded only during a drive: when your phone connects over Bluetooth to a car you paired in the app, Waylo starts recording and shows a notification. Recording ends when the drive ends. The app needs the "allow all the time" location permission (including in the background) and a running foreground service. The features that use background location are: recording your drives automatically, calculating the distance and showing the route on the map.
Cars without Bluetooth (optional, off by default). If you switch on "Detect rides without Bluetooth" in Settings, the app also asks for the "Physical activity" permission. Google Play services then works out on your phone, from its motion sensors, when you start travelling in a vehicle, and tells the app. That is the only thing the app receives: the phone's activity is not sent to us or stored, and no location is collected until the app sees you are in a vehicle. The app then records the drive like any other. Such a drive is kept only on your phone and is not uploaded until you choose which of your cars without Bluetooth it was (or it is given automatically when you have just one), or you delete it. Detection can take a minute or two, so the start of the drive may be missing, and it can also record a ride that was not yours (for example a bus or a taxi), which you can delete.
4. Purposes and legal basis
| Purpose | Data | Legal basis |
|---|---|---|
| Providing the service: recording drives, the logbook, export | Account, cars, drives, places, purposes, exports | Performance of a contract, Art. 6(1)(b) GDPR |
| Security, abuse prevention, rate limiting | Technical data | Legitimate interest, Art. 6(1)(f) GDPR |
| Finding and fixing crashes | Crash reports | Legitimate interest, Art. 6(1)(f) GDPR |
| Looking into a problem you report | Problem reports | Your consent by sending the report, Art. 6(1)(a) GDPR |
| Subscription | Subscription | Performance of a contract, Art. 6(1)(b) GDPR |
| Allowing one free trial per person | Free trial | Legitimate interest, Art. 6(1)(f) GDPR (preventing abuse of a free offer) |
| Complying with legal obligations | As the law requires | Legal obligation, Art. 6(1)(c) GDPR |
You grant the location permission (and, only if you use cars without Bluetooth, the Physical activity permission) on your phone and can withdraw them at any time; without location the service cannot record drives.
5. Who receives the data (processors)
We have (or accept the standard) data processing agreements with these providers. They process data only on our instructions.
| Provider | Role | Data |
|---|---|---|
| Google (Firebase Authentication, Google Sign-In) | Sign-in and the account | Email, name from your Google account, account identifier |
| Google (Firebase Crashlytics) | Receives crash reports so we can fix them | Error trace, app version, phone model and Android version, installation identifier |
| Google Play services | Location on the phone, address lookup, recognising on the phone that you are in a vehicle (only if you switch on detection for cars without Bluetooth), Google Play Billing | Location on the phone, the phone's motion data (processed on the phone), purchase data |
| Cloudflare | Relays the app's requests to our server | All data the app sends to the server, IP address |
| Aiven | A managed PostgreSQL database in a data centre in Amsterdam (EU) | All data of your account |
| OpenFreeMap / OpenStreetMap | Map tiles | IP address and the map area shown, not your drives |
We do not otherwise disclose data to third parties, unless the law requires it or we need it to protect our legal claims. We do not share your data with an employer or anyone else; an export you hand to someone is your decision.
6. Transfers outside the EU
Some processors (notably Google and Cloudflare) may process data outside the EU. They do so under GDPR safeguards such as standard contractual clauses or the EU-US Data Privacy Framework.
7. How long we keep data
| Data | How long |
|---|---|
| Account, cars, drives including routes and event logs, places, purposes, export records | While your account exists. You can also delete individual drives, places and purposes yourself earlier. |
| The record that a free trial was used (coded account reference and email fingerprint) | 24 months from the trial, also if the account is deleted. |
| The coded phone fingerprint kept for the free trial | 24 months from the trial, also if the account is deleted. |
| Data of a guest (use without an account) | While you use the app without signing in (the 14-day free trial, then the Free plan). If you do not sign in with Google, your data is erased 90 days after you last used the app; signing in with Google (offered in the app) keeps your data under that account instead. A random identifier that never started a trial is erased after 7 days. Rides that were not uploaded yet stay on your phone until they can be sent. |
| The account after you delete it in the app | 30 days (so you can undo it), then it is permanently erased from the database and the sign-in service. |
| Database backups | Overwritten in the provider's normal backup cycle. |
| Technical request data | Only for the period our hosting provider applies for security. |
| Crash reports | Up to 90 days, then Google deletes them. |
| Problem reports you send | 30 days, then they are erased automatically; sooner if you delete your account. Only the developer can read them. We keep at most the 10 newest per account. |
| Drives found by movement that still wait for a car | Only on your phone, until you choose a car (then they are uploaded and removed from the phone) or delete them. |
| Files you exported | Outside our control; you keep them. |
8. Your rights
You have the right of access, rectification (edit directly in the app), erasure (delete your account in the app), restriction of processing, portability (export to Excel) and the right to object to processing based on legitimate interest. Use the app or email privacy@heywaylo.com; we reply without undue delay and within one month at the latest. You may also lodge a complaint with a supervisory authority: the Office for Personal Data Protection of the Slovak Republic (https://dataprotection.gov.sk).
9. Your choices and controls
- Stop recording drives: in Settings → Cars switch the car off (it is no longer used to detect drives), or withdraw the location permission in your phone's settings.
- Stop finding drives by movement: switch off "Detect rides without Bluetooth" in Settings → Trip, or withdraw the Physical activity permission in your phone's settings.
- Edit or delete data: you can edit or delete drives, places and purposes in the app.
- Sign out or delete your account: Settings → Information and legal → Account and support.
10. Security and data breaches
Communication with our server is encrypted, each account's data is separated in the database and access is restricted. No system is perfectly secure and we cannot guarantee absolute security. If a personal data breach is likely to put your rights at risk, we will tell you and the supervisory authority in the way and within the time the law requires.
11. Cookies and tracking
The app uses no advertising or analytics tracking. These web pages use no cookies.
12. Children
Waylo is not intended for anyone under 16 and we do not knowingly collect their data. If we learn that we have collected such data, we will delete it.
13. Automated decisions
The type of a drive (business/private) and its purpose may be pre-filled from your places and rules you set. It is only a suggestion and you can always change it. We make no decisions with legal effects.
14. Links to other sites
The app and these pages may link to third-party sites (for example Google or OpenStreetMap). We are not responsible for their content or policies.
15. Changes
We may update this policy; the current version is always on this page with its date. We will tell you in the app about material changes.