Privacy Policy
This Privacy Policy explains how Webex Studio LTD ("SafeTiko", "we", "us", "our") collects, uses, and protects your personal data when you use the SafeTiko mobile application and the website at safetiko.com (together, the "Service").
We process personal data in accordance with the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR"), the ePrivacy rules as implemented in EU member states, and applicable national data-protection law.
1. Who is responsible for your data (Data Controller)
The controller of your personal data is:
- Webex Studio LTD
- Contact for privacy matters: support@safetiko.com
We have not appointed a Data Protection Officer as we are not legally required to do so. All privacy requests are handled at the address above.
2. What personal data we collect
2.1 Data you provide when creating and using an account
- Account details: email address, password (stored only as a salted cryptographic hash, never in plain text), first name, last name, country, city, and — if you choose to add it — phone number.
- Consent records: the fact and time that you accepted these terms, and whether you opted in to news, tips and offers (push notifications and email).
2.2 Data you enter about your vehicles
- Vehicle details: vehicle type, make, model, year, mileage, and optionally licence-plate number, VIN, a nickname, and a photo you upload.
- Dates and settings: insurance, road-tax/vignette and technical-inspection expiry dates, last service date and work performed, service intervals, estimated annual mileage, and how many days in advance you want to be reminded.
- Expenses (optional): amount, date, category (a preset one or a name you type), an optional note, the currency you choose and, on the paid plan, an optional photo of the receipt. Receipt photos are shrunk when uploaded and stored on our server; they are deleted when you delete the expense, the vehicle or your account.
- Service records: service date, mileage at service, and free-text notes.
Some of this data (for example a licence plate, VIN or vehicle photo) can relate to an identifiable person and is therefore treated as personal data.
2.3 Data created automatically
- Authentication tokens: when you sign in we issue access and refresh tokens. On your device these are held in the operating system's secure storage; on our server we store only a hash of the refresh token.
- Notifications: the reminder and message items shown in the app, and whether you have read or dismissed them.
- Server logs: our servers keep short-lived technical logs (such as request time, endpoint, response status and truncated IP address) for security and troubleshooting.
- Push notification token: if you allow notifications, an identifier issued for your device by Apple's push service (relayed through Expo), which we use only to deliver notifications to you. It is removed when you log out or delete your account, and you can switch notifications off at any time in your device settings.
- Language: the app language you choose is saved with your account so that reminders and messages reach you in that language.
- Messages to support: when you write to us from the app or the website, we receive what you type and your reply email. From the app we also attach your account identifier, plan, app version and the operating-system version of your phone, so we can reproduce problems. We keep support correspondence for as long as needed to handle your request and any follow-up, and then delete it.
- On-device only: locally scheduled reminders stay on your device and are not sent to us.
The SafeTiko mobile app contains no third-party advertising, analytics or tracking SDKs. It uses only a subscription SDK (RevenueCat) to manage your purchase. We do not build advertising profiles and we do not sell your data.
3. Why we use your data and our legal basis
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Create and operate your account; store your vehicles, settings and service history; generate and deliver reminders; provide customer support. | Performance of a contract with you — Art. 6(1)(b). |
| Keep the Service secure: authentication, refresh-token handling, abuse and fraud prevention, debugging, and maintaining short-lived logs. | Our legitimate interests in running a secure, reliable service — Art. 6(1)(f). |
| Send you service announcements (for example about app changes or maintenance) and the "Useful tips" content included in the paid plan, as in-app messages and push notifications. | Our legitimate interests in keeping users informed about the Service, and performance of the contract for paid-plan features — Art. 6(1)(f) and 6(1)(b). You can turn push notifications off in your device settings. |
| Send you promotional notifications, product news, tips and offers (push notifications or email). | Your consent — Art. 6(1)(a). It is off by default: you give it with a separate opt-in when you register or later in the app (Profile → Notifications), and you can withdraw it at any time by switching it off there (see section 8). |
| Comply with legal obligations and respond to lawful requests from authorities; keep records of consent. | Compliance with a legal obligation — Art. 6(1)(c). |
| Understand overall product usage and account cancellations using aggregated, non-identifying statistics. | This data is anonymised and is no longer personal data; the aggregation step relies on our legitimate interests — Art. 6(1)(f). |
We do not carry out automated decision-making that produces legal or similarly significant effects on you within the meaning of Article 22 GDPR.
4. Who we share your data with
We share personal data only with providers that process it on our behalf under a written data-processing agreement, and only as needed to run the Service:
- Hosting and storage: Hostinger. Our application and database are hosted on a server located in Frankfurt, Germany, within the European Union.
- Email delivery: Hostinger's email service sends transactional messages (such as the account-verification email) and, if you opted in, marketing messages, from infrastructure located in the European Union.
- Push notification delivery: Expo's push service and Apple's Push Notification service (APNs) carry notifications from our server to your device. They receive your device's push token and the notification text, not your account details.
- Subscriptions: if you buy the paid plan, the purchase is handled by Apple (App Store). We use RevenueCat, Inc. (USA) to confirm the subscription status. RevenueCat receives your SafeTiko account identifier and your purchase information from Apple, not your name, email or vehicle data.
- Website analytics and security (only with your consent): Google (Google Ireland Limited / Google LLC) provides Google Analytics 4 and Google reCAPTCHA on the safetiko.com website. See section 7.
We may also disclose data if required by law, to enforce our Terms, or to protect the rights, safety or property of SafeTiko, our users or the public. If our business is transferred (e.g. merger or acquisition), data may pass to the successor under this Policy.
5. International transfers
We aim to keep personal data within the European Economic Area (EEA). Where a provider processes data outside the EEA, we rely on an adequacy decision of the European Commission or on Standard Contractual Clauses together with any additional safeguards required. You can request a copy of the relevant safeguards by contacting us. RevenueCat may process subscription data in the United States. Google may process website analytics and reCAPTCHA data in the United States, only if you allow the corresponding cookie category. These transfers rely on the provider's participation in the EU-US Data Privacy Framework or on Standard Contractual Clauses.
6. How long we keep your data
- Account and content: kept for as long as your account exists.
- Account deletion: when you delete your account from within the app, your account and all associated content (vehicles, settings, service records, notifications) are permanently erased from our live systems immediately. We retain only anonymous statistics that cannot be linked back to you.
- Backups: residual copies in encrypted backups are overwritten within 30 days.
- Server logs: retained for up to 30 days, then deleted.
- Records we must keep by law (for example to handle a legal claim) are kept only for the period required and then deleted.
7. Website cookies and analytics
The mobile app does not use cookies. The safetiko.com website uses a small number of cookies and similar technologies, grouped in three categories. When you first visit the site we show a banner where you can accept all, reject all non-essential cookies, or choose by category. Rejecting is as easy as accepting, and the site works fully either way.
| Cookie / service | Category | Purpose | Duration |
|---|---|---|---|
st_consent | Necessary | Remembers your cookie choices. | 180 days |
lang | Necessary | Remembers the language you picked. | 1 year |
_ga, _ga_* (Google Analytics 4) | Analytics (consent) | Counts visits and shows which pages are used, with IP anonymisation. Not loaded until you allow it. | Up to 2 years |
| Google reCAPTCHA | Security (consent) | Protects the support form from spam. Google's script loads only after you allow it, at the moment you use the form. | Set by Google |
Strictly necessary cookies do not need consent. Analytics and security (reCAPTCHA) are set only after you consent (Art. 6(1)(a) GDPR and the ePrivacy rules). You can change or withdraw your choice at any time with the "Cookie settings" link in the footer of every page; withdrawing consent does not affect processing done before. If you do not allow reCAPTCHA you can still contact us at support@safetiko.com. Fonts are hosted on our own server, so no data is sent to a font provider.
8. Your rights
Under the GDPR you have the right to:
- Access the personal data we hold about you and receive a copy;
- Rectify inaccurate or incomplete data (you can edit most of it in the app);
- Erase your data ("right to be forgotten") — you can do this yourself at any time via Profile → Delete account, or by contacting us;
- Restrict or object to processing based on our legitimate interests;
- Data portability — receive the data you provided in a structured, commonly used, machine-readable format;
- Withdraw consent at any time (for example for news, tips and offers), without affecting processing carried out before withdrawal. You can switch this off in the app under Profile → Notifications, or use the unsubscribe link in any marketing email;
- Lodge a complaint with a supervisory authority — the data-protection authority in your EU country of residence or work. In Bulgaria this is the Commission for Personal Data Protection (CPDP, www.cpdp.bg).
To exercise any right, email support@safetiko.com. We respond within one month; this may be extended by two further months for complex requests, and we will tell you if that applies. There is normally no charge.
9. How we protect your data
- All traffic between the app and our servers is encrypted in transit using HTTPS/TLS.
- Passwords are stored only as salted bcrypt hashes.
- Access to production systems is restricted and logged.
- Data is hosted in EU data centres with the security controls provided by our infrastructure provider.
No system is perfectly secure. If a personal-data breach is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours and, where required, inform you without undue delay.
10. Children
The Service is not directed to children. You must be at least 16 years old to create an account. If we learn that we have collected personal data from a child below the applicable age without a valid legal basis, we will delete it.
11. Changes to this Policy
We may update this Policy to reflect changes to the Service or the law. We will post the new version here with an updated "Last updated" date, and for material changes we will give you reasonable advance notice (for example an in-app notice or email) before the change takes effect.
12. Contact
Questions or requests about your privacy: support@safetiko.com.