This translation is provided for information only. In the event of any discrepancy, only the Spanish version is legally binding.
Privacy Policy
Last updated: 15 October 2026 · Version 2026-10-15
This policy explains what personal data KURVO processes, for what purposes, on what legal basis, who it is shared with and what rights you have, in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD) and, for the minimum age of people who live in France, the French Loi Informatique et Libertés (Article 45). It is written to be understood: if anything is unclear, write to us.
1. Data controller
Sergio Navarro Navarro y Luis Rodríguez Céspedes, based in Murcia, España. Privacy contact: privacidad@kurvo.es.
The owners decide together on the processing of your data (joint controllers, Article 26 GDPR) and either of them will handle your requests at that same email address. We have not appointed a data protection officer: write to us directly at that address.
2. What data we process
| Category | Data | Source |
|---|---|---|
| Account | Email, first name and surname, username, date of birth, language, profile photo, profile colour | You provide it when you sign up (or your provider does: Google or Apple) |
| Phone | Phone number with country code (optional; required to be a guardian) | You provide it in your profile |
| Rider profile | Preferred activities (motorcycling, cycling, on foot…), level, geographical area, visibility | You provide it during onboarding or in your profile |
| Geolocation | GPS position, speed, heading, altitude and accuracy only during the rides you start (also with the app in the background if you allow it); your position at the moment you send an alert; last known position to centre the map | Your device's sensors, with your permission |
| Motion sensors | Accelerometer and gyroscope, processed on your device to detect stops and possible falls. Only the result is sent (estimated impact, whether there was a fall), never the sensor signal | Your device's sensors |
| Rides and tracks | Rides you create or take part in, recorded tracks (route line, distance, time, elevation gain, average and top speed), planned routes, waypoints with text and photo, summaries | Generated by your use of the Platform |
| Safety | Alerts you send (SOS, breakdown, fall, automatic stop, low battery) with position, battery and GPS status; who receives them and who responds; SMS and calls made to your guardians and their outcome | Generated by your use and by your guardians' use |
| Relationships | Followers and people you follow, contacts, guardians (who you look out for and who looks out for you), groups | You establish them with other users |
| Social content | Ride posts (map image or photo, metrics), likes, comments, chat messages (one-to-one and group) and ride chat messages | You create it |
| Technical | Push notification token, app platform and version, technical GPS diagnostics per ride (accuracy, satellites, permissions), access logs, date and version of the consents you accept | Generated by your device and our systems |
We do not process special categories of data (health, ideology…) or make automated decisions with legal effects on you. Fall detection is an aid that you can always cancel with “I'm OK”.
Which data is required. To sign up we need your email, your name and your date of birth, which we use to check that you meet the minimum age (14; 15 if you live in France); without them we cannot create the account. Without location permission, a ride cannot be recorded and your position cannot be sent in an alert. Without a phone number you cannot be anyone's guardian or receive the SOS by SMS or call. Everything else (photo, activities, posts…) is optional.
3. Purposes and legal basis
| Purpose | Legal basis (Art. 6 GDPR) |
|---|---|
| Providing the service: account, rides, the group's live map, tracks, summaries, posts, chats, challenges and leaderboards | Performance of the contract (6.1.b) |
| Sharing your real-time position during a ride, including in the background | Your consent (6.1.a), which you withdraw by stopping the ride or removing the permission |
| Alerting your guardians when you press SOS or we detect a fall: notification, SMS with your position and, if nobody responds within 30 seconds, a phone call | Vital interests (6.1.d) and performance of the contract (6.1.b). For the guardian: legitimate interest in receiving alerts from the person who chose them, which they accepted when becoming a guardian |
| Using a guardian's phone number to send them SMS and call them in an emergency | The guardian's consent when agreeing to be one (6.1.a), which they can withdraw by ceasing to be a guardian |
| Checking with an SMS code that the phone is yours before using it for the SOS | Performance of the contract (6.1.b): it is the same purpose as the SOS, making sure the alert reaches the right number |
| Ride support features: weather forecast, summits and mountain passes along the route, route calculation, destination search and the watch app | Performance of the contract (6.1.b) |
| Push notifications (safety alerts, invitations, messages, reminders) | Performance of the contract (6.1.b); you manage them in your system settings |
| Service emails (welcome, password change) and emails about your activity (monthly summary, birthday, “we miss you”) | Performance of the contract (6.1.b) for service emails; for activity emails, legitimate interest (6.1.f) in telling you how your own use of KURVO is going, and Article 21.2 LSSI, with one-click unsubscribe in every email. We do not send third-party advertising |
| Service security, abuse prevention and recording of consents | Legitimate interest (6.1.f) in protecting the platform and its users against unauthorised access and abuse, and legal obligation (6.1.c) to prove your consents |
| Paid subscription (if activated) and billing | Performance of the contract (6.1.b) and legal obligation (6.1.c) |
4. Who sees your data
- The participants in your ride see your position, speed and alerts during the ride, and your name and photo.
- Your guardians see your real-time position on your rides, your track and your alerts, and receive your SOS by notification, SMS and call. You choose who your guardian is and can remove them whenever you want.
- Other users see your profile and your posts according to the visibility you choose (public, followers only, contacts only or nobody). Your phone number is not shown to anyone: it is only used by the system for the SOS.
- Public links: if you share a live tracking link or a link to a post, anyone with the link sees what that link shows until it expires or you revoke it. Links use opaque tokens; they never expose your identifier.
5. Providers that process data on our behalf
We work with processors under contract (Article 28 GDPR): they only process your data to provide their service to us and in accordance with our instructions.
| Provider | Purpose | Where |
|---|---|---|
| Supabase | Database, authentication, photo storage and server functions | Data hosted in the European Union (Ireland); contract with Supabase Pte. Ltd. with standard contractual clauses |
| Vercel | Hosting of kurvo.es: the website, the dashboard, the public tracking and track pages and the images of the posts you share | EU/US (EU-US Data Privacy Framework and standard clauses) |
| Expo (EAS) and Google Firebase (FCM) | Delivery of push notifications (device token and alert text) and app updates (IP address and installation identifier) | US (EU-US Data Privacy Framework / standard clauses) |
| Twilio | Sending SMS and calls to your guardians in an emergency (their phone number, your name and your position) and the SMS with the code to verify your phone | US (EU-US Data Privacy Framework and standard clauses). The telephone carriers that deliver the SMS and the call process them under their own rules |
| Resend | Sending emails (your email address, name and the content of the email) | US (EU-US Data Privacy Framework and standard clauses) |
| Stripe | Charging the subscription, if activated (we do not see your card). It acts on its own behalf to prevent fraud | EU/US (standard contractual clauses) |
Other services receive some data so that a specific feature works, but they process it on their own behalf, under their own policies:
| Service | What it receives and why | Where |
|---|---|---|
| Google and Apple | Signing in with your account (if you choose to), downloading the app and crash reports in their stores, notifications on iPhone (APNs), destination search (the text you search for and the area) and the connection with the watch | Under their policies |
| Google Maps | The SOS text message includes a link to your position: if your guardian opens it, Google receives it | Under its policy |
| OpenRouteService (HeiGIT) | Route calculation: the start and destination coordinates are sent, without your identity | Germany |
| Overpass API (FOSSGIS e.V.) | Summits and passes on your ride: it receives points along the track, without your identity, and your IP address | Germany |
| Open-Meteo | Weather forecast: it receives the coordinates of the area, without your identity | EU |
| OpenFreeMap, CARTO and Instituto Geográfico Nacional | Map tiles: they receive your IP address and the area of the map you are viewing | OpenFreeMap: EU (via Cloudflare); CARTO: EU/US; IGN: Spain |
When a provider is outside the European Economic Area, the transfer is based on the EU-US Data Privacy Framework (European Commission adequacy decision, Article 45 GDPR) or, if the provider has not signed up to it, on the European Commission's standard contractual clauses (Article 46 GDPR). You can ask us for a copy of those safeguards by writing to privacidad@kurvo.es. We do not sell your data or pass it on for advertising purposes.
6. How long we keep it
| Data | Period |
|---|---|
| Account, profile, tracks, posts, chats and relationships | While you have an account. When you delete it, they are erased, along with the photos |
| Raw GPS positions from rides | 12 months (the summarised track is kept with the ride) |
| Safety alerts (SOS, breakdown, fall…) | 24 months |
| SMS and calls to guardians (phone number and outcome) | 12 months |
| Codes to verify your phone | 2 days |
| In-app notifications | 12 months |
| Public tracking links | 90 days after they expire |
| Technical GPS diagnostics | 6 months |
| Copy of rides on your own phone | 14 days, or until they are uploaded if you had no signal |
| Record of consents | While you have an account and, as evidence, for the legal limitation period |
| Backups and providers' technical logs | They are renewed periodically according to each provider's periods; deleted data disappears from them when the backup expires |
7. Your rights
You can access, rectify, erase, restrict or object to the processing of your data and request its portability, and withdraw your consent at any time:
- Download all your data: in the app, Settings → Legal & data → “Download my data” (a JSON file). Each track is also exported as GPX.
- Rectify: edit your profile in the app or in the web dashboard.
- Delete your account: Settings → Account → “Delete account” (or in the web dashboard). Everything is deleted, including the photos; only the data that the law requires us to keep (e.g. invoices) is retained.
- Withdraw permissions: location, notifications, camera, photos and contacts are managed in your system settings (contacts are only used, on your own phone, to save the “KURVO SOS” contact and check whether you already have it; they are not uploaded); to stop being a guardian or remove a guardian, go to Settings → Your people.
- For any other request, write to privacidad@kurvo.es. We reply within one month.
If you believe we have not respected your rights, you can lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es) or with the supervisory authority of the EU country where you live or work (in France, the CNIL: www.cnil.fr).
8. Minors
KURVO is not intended for minors below the minimum age, and they cannot sign up: you must be at least 14 years old, or 15 years old if you live in France. This is the age from which you can consent to the processing of your data yourself (LOPDGDD, Article 7; in France, Loi Informatique et Libertés, Article 45). By accepting these texts you declare that you are that age or older, and we ask for your date of birth to check it. If we detect an account belonging to a minor under that age, we will delete it.
9. Security
Data travels encrypted (HTTPS/TLS) between your phone, our servers and the providers, and is stored encrypted on the servers (encryption at rest). This includes your position, your tracks, your alerts and your messages. In addition, the database controls access row by row: each user can only read what concerns them. Public links use random tokens. Even so, no system is infallible: use a unique password and do not share tracking links with anyone you do not want to see your position.
10. Changes to this policy
Each version has a date and a number. If the change is substantial, we will ask you to accept it again in the app before you continue using it. We keep a record of which version you accepted and when.