PRIVACY POLICY AND TERMS OF USE - TRAZAVIA

Last updated: August 9, 2026

Welcome to Trazavia (hereinafter, "the Application" or "we"). We take the security and privacy of your data very seriously. This Privacy Policy explains transparently how we collect, use, store, and protect user information (hereinafter, "the User" or "you") when interacting with our mobile platform, mapping tools, and off-road community services.

By registering and using the Application, you acknowledge that we process the personal data necessary to provide the service under the terms described in this document. Optional processing for analytics and advertising personalization is activated only after you grant separate consent, which you may withdraw at any time.

1. Service Status (Beta Phase)

The Trazavia Application is currently in a testing, evaluation, and early-development phase (Beta / testing phase), operating under the trade name Trazavia. During this stage, the service is provided free of charge for purely demonstrative and informational purposes.

2. Data Controller

• Platform: Trazavia
• Support & Privacy Email: [email protected]
• Legal Framework: All personal data processing is carried out in strict compliance with the General Data Protection Regulation (GDPR - Regulation UE 2016/679) and applicable European data protection laws.
• The service is operated under the trade name Trazavia. You may contact us for any privacy matter through the support email indicated above.
• No Data Protection Officer (DPO) is currently appointed. Privacy requests and exercises of rights should be sent to the support email indicated above.

3. Data We Collect and Its Purpose

To provide you with the essential tools for 4x4 navigation, mapping features, and off-road social community functionalities, Trazavia needs to collect and process the following information:

• Account Registration Data: Email address, username, and password (the latter is securely and irreversibly encrypted in our systems using cryptographic hash functions). Purpose: Account creation and management, secure user authentication during login, and access recovery.

• Profile Data (Optional): Profile picture or image selected by the User. Purpose: To personalize your visual identity within the community ecosystem. Provided images are optimized, compressed, and stored in isolated storage systems.

• Location and Geolocational Data (GPS): Exact geographic position coordinates provided by your device's hardware. Purpose: This is a core and indispensable feature of the service. It is used to position you in real-time over the map layers (trail networks, cadastral plots, protected natural areas, cattle trails, etc.), enable navigation on off-road routes, calculate trip distances, and save your exploration logs.

• Background Location: If you explicitly grant permission in your operating system, the Application may collect your location data in the background only while a route recording or tracking session is actively enabled by you, even if the device screen is off or the application is minimized. We do not passively track your location if you are not running an explicit navigation activity.

• User-Generated Content: Recorded routes (GPS tracks), saved points of interest (POIs), comments, or updates regarding terrain and trail conditions. Purpose: To provide historical storage for your routes and, if you voluntarily choose to publish them, share them with the platform's community map.

• Google Sign-In / Social Login Data: When you choose to sign in with Google (or a similar social login provider), we receive the email address, name, profile picture, and Google account identifier or authentication token as provided by that service. Purpose: Account creation or linking, secure authentication, profile personalization, and avoiding duplicate accounts.

• Technical and Log Data: IP address, device and operating-system information, application version, session tokens, and approximate diagnostic context generated while you use the service. Purpose: Operate and secure the platform, troubleshoot errors, prevent abuse, and maintain service continuity.

• Map, Weather, and Access-Alert Related Processing: Approximate coordinates or region context may be sent to map providers (Mapbox), weather services (Open-Meteo), and other technical providers needed to render maps, show weather or elevation context, and operate access-alert features. This processing is performed to provide those features and not to sell your location.

• Content Reports (Trails, Media, and Users): When you report a trail, a media item, or a user, we process your user identifier, the identifier of the reported trail, media, or user, the reason or message you provide, the date and time of the report, and the subsequent moderation status of the ticket. Purpose: Review the report, moderate community content and accounts, prevent abuse, and keep the platform safe and lawful.

4. Legal Basis for Processing

We process your data under the following legal grounds regulated by the GDPR:

1. Performance of a Contract / Service Provision: Processing your credentials and GPS signals is absolutely vital to execute the navigation and map tools you actively request when using the platform.
2. Explicit Consent: To access the device's GPS location (both in the foreground and background) and local storage for the profile image, the Application will request your express authorization through the operating system's native permission system. You can revoke these permissions at any time from your phone settings.
3. Consent for Optional Technologies: For analytics, behavioral measurement, and advertising personalization (described in sections 8 to 11), we only activate the corresponding optional tools after you grant consent through our privacy banner, in-app settings, or—where applicable—the Google consent platform. Advertising units themselves are shown regardless of this consent. You may withdraw this consent at any time with the same effect as if you had not granted it initially.
4. Legitimate Interest: We process certain technical and diagnostic data (including Firebase Crashlytics crash reports) on the basis of our legitimate interest in maintaining the security, stability, and integrity of the Application. Where applicable, you may object to this processing by contacting our support email; we will assess your request in accordance with the GDPR.
5. Legitimate Interest and Compliance for Content Moderation: We process content reports about trails, media, and users (and related moderation records) on the basis of our legitimate interest in reviewing user notices, moderating community content and accounts, and preventing abuse, as well as—where applicable—to comply with legal obligations regarding illegal content. Where the law allows, you may object to processing based solely on legitimate interest by contacting our support email.

5. Data Retention

Your personal data will be kept for as long as your account remains active in Trazavia. Technical backups may be retained for a limited period needed for continuity and recovery. Security and access logs are kept only for a limited time proportional to those purposes. Content you publicly share with the community may remain available until you delete it or it is removed through moderation. Reports about trails, media, or users and related moderation tickets are kept for as long as needed to handle the report, prevent repeated abuse, and meet applicable legal obligations. Where the law requires longer retention (for example to defend legal claims or comply with mandatory obligations), we retain only what is necessary for that purpose.

If you choose to delete your account, all your registration, profile, geolocation, and private route data will be permanently, immediately, and irreversibly removedfrom our production servers, except for anonymized trail condition reports voluntarily shared with the public community and any limited residual copies that may temporarily remain in backups until overwritten according to our backup cycle.

6. Recipients and Data Transfers (Third-Party Services)

Trazavia enforces a strict ethical monetization policy:we do not sell or rent your personal data or GPS location to third parties

To sustain the technical infrastructure, web traffic, mapping rendering speeds, diagnostics, analytics, and advertising delivery—together with advertising personalization only when you consent—we delegate technical processing to specialized providers that comply with European security standards and the GDPR:

• Hosting and Infrastructure: The platform's backend and the database engine supporting massive cartographic data run in an isolated environment on dedicated servers physically located within the European Union.
• Multimedia Cloud Storage: Profile pictures and image optimization files are stored encrypted in distributed object storage services in the cloud (Cloudflare R2), ensuring optimal network transfers.
• Perimeter Security & CDN: All data flow between the Application and our servers is routed through proxies and mitigation infrastructures that block external attacks and ensure your traffic cannot be intercepted.
• Google (Firebase Analytics and Firebase Crashlytics): Google Ireland Limited processes aggregated usage events and crash reports to help us measure platform performance and fix stability issues. Analytics is activated only with your consent; Crashlytics is necessary to maintain service reliability. Privacy policy: https://policies.google.com/privacy
• Mixpanel (Mixpanel, Inc.): Processes behavioral analytics events (such as feature usage and navigation flows) when you grant consent. On the web version, events are sent to Mixpanel's EU API endpoint (api-eu.mixpanel.com). Privacy policy: https://mixpanel.com/legal/privacy-policy/
• Google Advertising (AdSense on the web and AdMob on Android): Google may process advertising identifiers, device information, and interaction signals to display ads within the Application. Ads are always shown. Your advertising consent determines whether ads may be personalized; if you deny advertising consent, ads may still appear in a non-personalized form. Privacy policy: https://policies.google.com/technologies/ads
• Mapbox: Provides maps, tiles, and geocoding services as used in the Application. Approximate location or map-query context may be processed to render cartography. Privacy policy: https://www.mapbox.com/legal/privacy
• Open-Meteo: Provides weather and elevation-related information used by the Application. Approximate coordinates or region context may be sent to obtain those informational features.
• Google (Sign-In / OAuth): When you choose Google Sign-In, Google processes authentication data under its own terms so we can create or link your account securely. Privacy policy: https://policies.google.com/privacy
• Google Gemini: Used as part of the Application's technical tooling. Privacy policy: https://policies.google.com/privacy

7. Information Security

We apply advanced technical and organizational security measures to safeguard your information against loss, manipulation, or unauthorized access:

• Strict encryption of all communications in transit using secure HTTPS / TLS protocols.
• Perimeter isolation of databases via strict firewalls that block external access.
• Secure password storage using robust encryption algorithms.

8. Cookies and Similar Technologies

On the web version of Trazavia we use cookies and similar storage mechanisms to remember your privacy choices and, only after consent, to enable analytics and advertising personalization. Advertising units may still be shown without that consent:

• Consent cookie (trazavia_consents): Stores your preferences for Firebase Analytics, Mixpanel, Firebase Crashlytics, and advertising. It is created when you interact with the privacy banner or save your settings. Without this cookie, optional services remain disabled by default.
• Authentication and session cookies: Necessary to keep your login session active and secure while you use the web platform. These are strictly functional and do not require separate marketing consent.
• Third-party cookies and local storage: Google (Firebase, AdSense, and—where applicable—the Google consent platform) and Mixpanel may set their own cookies or use browser storage to measure usage, diagnose errors, or deliver ads. Analytics and advertising personalization technologies are only enabled after the corresponding consent category is granted; ad delivery itself is not blocked by withholding advertising consent.

9. Consent Management

You control optional processing through transparent consent mechanisms that differ by platform and region:

• Web (outside regulated regions): On your first visit, a privacy banner lets you accept all, reject all, or configure each category individually. Your choice is stored in the trazavia_consents cookie and can be changed later from Application settings.
• Web (EEA, UK, and Switzerland): Where required by law, Google’s consent platform (Consent Mode) may manage advertising and analytics signals. If it is not available or not configured, the legacy Trazavia banner is shown instead so you can still express your preferences.
• Android app: On first launch you can configure Firebase Analytics, Mixpanel, and advertising personalization. In regulated regions, Google’s User Messaging Platform (UMP) may additionally collect advertising consent that affects whether AdMob ads may be personalized.
• Default settings and withdrawal: Firebase Analytics and Mixpanel are disabled until you opt in. Advertising units are shown regardless of consent; advertising consent only affects whether ads may be personalized. Firebase Crashlytics is enabled by default because it is essential to detect and fix crashes that affect all users. You can withdraw or reset your consents at any time from Application settings; withdrawal does not affect the lawfulness of processing based on consent before its withdrawal.

10. Analytics and Diagnostic Tools

The following tools help us understand how Trazavia is used and keep it stable. None of them receive your GPS tracks or private route content unless explicitly described elsewhere in this policy:

• Firebase Analytics (Google): Collects aggregated usage statistics (such as screens visited, session duration, and generic device information) to improve the product. Activated only if you enable “Firebase Analytics” in consent settings. Legal basis: consent.

• Firebase Crashlytics (Google): Automatically collects crash reports, stack traces, and technical context (device model, OS version, app version) to diagnose and fix errors. This processing is necessary to maintain a reliable service and is based on our legitimate interest in service stability and security. You may object to this legitimate-interest processing by contacting our support email; we will assess your request under the GDPR.

• Mixpanel (Behavioral Analysis): Records product interaction events in real time (such as feature usage and funnels) when you enable “Mixpanel” in consent settings. On the web, data is routed to Mixpanel’s EU infrastructure. Legal basis: consent.

11. Advertising

Use of Trazavia is currently free of charge to users. We may display native advertising units to help cover infrastructure and operating costs. No paid subscription is charged today. Ads may appear in the Application; your consent controls whether advertising may be personalized:

• Web: Google AdSense may show native ad placements in sections such as Discover, My Trails, and Profile. Ads are always displayed. Advertising consent determines whether Google may serve personalized ads; without that consent, ads may still be requested as non-personalized.
• Android: Google AdMob may show native ad placements in equivalent sections. Ads are always displayed. In the EEA, UK, and other regulated regions, the Google UMP SDK collects consent that affects ad personalization; elsewhere, the in-app advertising toggle controls personalization preferences.
• Personalization and profiling: When you consent to advertising personalization, Google’s advertising tools may involve profiling based on advertising identifiers and interaction signals under that consent. Trazavia itself does not take solely automated decisions that produce legal effects or similarly significant effects on you.
• Publisher declarations: Our domain publishes an ads.txt file listing authorized Google ad sellers, as required by the digital advertising industry. You can review Google’s ad technology policies at https://policies.google.com/technologies/ads

12. Your Rights

As the owner of your data, the GDPR grants you full control over it. You may exercise your rights of Access, Rectification, Erasure, Objection, Restriction, and Portability through the following channels:

1. Directly in the App: You can edit your personal data, manage privacy consents, or request total erasure and deletion of your account from your Profile settings menu.
2. By Writing: Sending an email to our support inbox at[email protected]from the same email address you registered with, indicating the action you wish us to take.
3. Response time: We will respond to your request within one month of receipt. Where permitted by the GDPR, this period may be extended by a further two months for complex or numerous requests; in that case we will inform you of the extension and the reasons.
4. Complaint to a supervisory authority: If you believe that the processing of your personal data infringes data protection law, you have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es, or with any other competent supervisory authority in your place of residence or work.

13. Changes to this Privacy Policy

We reserve the right to update this document to reflect technical upgrades in the Application (such as adding new map layers, utility tools, consent mechanisms, or sector legal regulations). Any substantial changes will be visibly notified to you through the Application or via an informational email before they take effect.

14. Minors

The Application is not directed at persons under 16 years of age. If you are under 16, you must not register or use the service without the authority of a parent or legal guardian as required by applicable law. If we become aware that we have collected personal data from a minor without such authority, we will take steps to delete it. Contact our support email to request deletion in such cases.

15. International Transfers

Some of the providers listed in section 6 may process personal data outside the European Economic Area. Where that occurs, we rely on appropriate safeguards such as Standard Contractual Clauses, the provider’s documented transfer mechanisms, or an adequacy decision where available. You may contact our support email if you wish to request further information about these safeguards.