Privacy Policy

What we collect

Account identity (email, and the sign-in method you choose) is held by our identity provider, Clerk.

On our own server we store your user ID, the routes you save, your chat history, usage counters and your billing status. Route planning requires the start location you type; it is used to compute the route and is stored with any route you save.

Waiting-list entries store an email address and a country, and nothing else.

What we do not do

No advertising, no sale or sharing of personal information, no third-party analytics or tracking pixels.

We do not sell or share your personal data, and there is no advertising business to change that. If it ever stops being true, this section is the first thing that must change — and it would trigger disclosure and opt-out duties under both the GDPR and US state privacy law.

Who else processes your data

Clerk (accounts and authentication), Paddle (payments, as merchant of record), OpenAI (the language model that reads your request), and the map and geocoding services listed in the app.

Our own server runs in the United States and is rented from OVHcloud. Your saved routes, chat history, usage counters and billing status live there, on disk we control. The precise region is stated on this page and kept in step with the actual server — see the deployment runbook, which will not let a release change one without the other.

Clerk, Paddle and OpenAI are established in the United States and the United Kingdom, so using Rieda involves transferring personal data outside the EEA. Those transfers rest on the European Commission's adequacy decision for the EU–US Data Protection Framework where the processor is certified under it, and otherwise on Standard Contractual Clauses. You can ask us which applies to which processor and we will tell you.

Paddle is the merchant of record, which means Paddle is the seller for your purchase and an independent controller of the payment data — its own privacy notice governs what it does with your card details, which we never see or store.

Your choices

You can export everything we hold about you as a JSON file, and delete your account and its routes, from Account → Your data. Deletion is immediate and cannot be undone.

Because Rieda is operated from Germany, the GDPR applies to everyone who uses it, wherever they live. You have the right to access your data (Art. 15), correct it (Art. 16), erase it (Art. 17), restrict processing (Art. 18), receive it in a portable format (Art. 20) and object to processing based on legitimate interests (Art. 21). The export and delete buttons in Account → Your data satisfy the first, third and fifth of those immediately and without asking anyone.

You may also complain to a data protection supervisory authority — for us that is the authority of the German state we are established in, and for you it may be the one where you live or work.

US state privacy statutes such as the CCPA/CPRA set thresholds — annual revenue, numbers of consumers, or revenue from selling data — that this service does not currently meet, so it is not subject to them. We grant the equivalent rights anyway rather than argue about who qualifies: ask, and you get access, correction, deletion, or an explanation of a refusal you can appeal.

Why we are allowed to process it, and for how long

Most of it is necessary to perform the contract you entered when you created an account (Art. 6(1)(b) GDPR): without a start location there is no route, and without usage counters the free allowance cannot be enforced. Keeping the service working and unabused — rate limits, error logs — rests on our legitimate interest in running it at all (Art. 6(1)(f)). We do not rely on consent for anything, because there is no tracking or advertising to consent to.

Saved routes and chat history are kept until you delete them or close your account. Usage counters are kept for the current and previous billing month. Billing records are kept as long as German tax law requires, which is longer than you might expect and is not something we can shorten on request. Waiting-list entries are kept until the country launches or you ask us to remove you.

No decision with a legal or similarly significant effect on you is made automatically. The language model turns your sentence into routing parameters; it does not decide anything about you.

Children

The service is not directed to children under 13, and we do not knowingly collect their information.

Contact

Email hello@rieda.app for anything in this policy — access, deletion, a correction, or a question about a processor. It reaches the person who runs the service, and there is no ticket queue in front of it.

The controller for the purposes of the GDPR is Zigmas Vadapalas; postal details are on the Legal notice page. There is no Data Protection Officer, and at this size the law does not require one.