Privacy Policy

1. Controller and contact details

The controller of your personal data is Mansz&Partners, ul. Powstańców Warszawskich 96 lok. 19, 38-400 Krosno, Poland, Polish tax ID (NIP): 6891179617, REGON: 180238578.

For privacy, access, correction, export, or deletion requests, email privacy@rideaway.app. For the Terms and complaints, email legal@rideaway.app.

2. Data we process

We do not ask for health, disability, beliefs, ethnicity, or other special-category data. Do not enter this information in free-text fields.

Website use: Your IP address and connection headers may enter short-lived technical logs operated by Vercel or Bunny. We also record the entry path, referrer, and UTM parameters when your browser provides them.
Consented analytics on public pages: Consent status, the canonical public-page path without query parameters, and technical and aggregated usage information available to Google Analytics. We do not send names, email addresses, tokens, survey answers, or survey and confirmation-page addresses.
Early-access form: First name, email address, role, language, submission source, and the date and version of the privacy information presented to you.
Survey: Professional role, sports, country and location, business scale, current tools, challenges, and voluntary free-text answers. If you apply for the Beta, we also collect experience, a public professional-profile link, preferred testing cadence and feedback methods, and an optional note.
Verification and referrals: Email-verification status, token hash, referral code and attribution, manual professional-review status and note, identity-deduplication key, and the number of Pro months awarded.
Security: For abuse prevention, the server transforms the network address into a one-way HMAC digest. We do not store the raw IP address in the rate-limit database.

3. Purposes and legal bases

The current form does not subscribe you to a newsletter and is not marketing consent. Survey, verification, referral, and benefit emails are operational messages required to run the program.

Form, survey, email verification, and Pro benefit: Steps requested before entering a free agreement and performance of that agreement, Article 6(1)(b) GDPR.
Referral program and awarded months: Performance of the program rules, Article 6(1)(b) GDPR.
Manual professional review and Beta selection: Steps requested by the applicant and our legitimate interest in preventing abuse and selecting an appropriate testing group, Article 6(1)(b) and (f) GDPR.
Security, diagnostics, and rate limiting: Our legitimate interest in protecting the website, forms, and data, Article 6(1)(f) GDPR.
Optional analytics on public pages: Your consent, Article 6(1)(a) GDPR. Refusal does not restrict access to the website, form, survey, or program.
Complaints and legal claims: Contract performance, legal obligations, and our legitimate interest in establishing, exercising, or defending claims, Article 6(1)(b), (c), and (f) GDPR.

4. Whether you must provide data

Providing required fields is voluntary but necessary for us to send the survey, verify the application, and administer the benefit. We cannot run the program for you without them.

Expressing interest in the Beta and completing Beta-specific answers is optional. Declining does not remove eligibility for the standard survey benefit.

5. Providers and recipients

Authorized collaborators, legal or accounting advisers, and public authorities may also receive data where required by law. We do not sell personal data.

The new website does not currently use GetWaitlist, Mailchimp, Supabase, Cloudinary, or Slack for this flow.

Vercel Inc.: Application hosting, server functions, website delivery, and technical security logs.
Neon, a PostgreSQL service owned by Databricks: Storage of form submissions, survey answers, verification records, referrals, and email statuses.
Resend / Plus Five Five, Inc.: Delivery of operational emails, including the survey, email verification, and referral notifications.
BunnyWay d.o.o. (bunny.net): Delivery of public images, video, and other static assets through a CDN. Bunny may process anonymized or short-lived request data such as network address, URL, country, and user agent.
Google Ireland Limited (Google Tag Manager and Google Analytics 4): Loading consented analytics only on public pages and producing aggregated website-usage reports. The container does not load before consent or on survey, confirmation, and referral routes.

6. Transfers outside the EEA

Vercel, Neon, Resend, and Google may engage entities in the United States or other countries outside the European Economic Area. Transfers are protected by an applicable European Commission adequacy decision, Standard Contractual Clauses, or another GDPR-approved mechanism. BunnyWay is established in Slovenia and operates a global CDN.

You may request information about the safeguards by emailing privacy@rideaway.app.

7. Retention

We may delete data earlier after a valid request unless continued storage is required by law or for a legal claim. Provider log periods depend on their contract and configuration, but we limit them to what is needed for security and service operation.

Applications with no further activity are deleted or anonymized no later than 24 months after the last meaningful interaction.
Records needed to activate and settle a confirmed benefit are kept until the free period ends, then for up to 3 years to the extent needed for legal claims.
Additional Beta data for applicants who are not selected is deleted no later than 12 months after that selection round, unless you request deletion sooner.
The rate-limit digest expires after 24 hours.
The email-verification link is valid for 48 hours.
Technical delivery records, token hashes, and provider message identifiers are kept for up to 12 months unless needed to investigate an incident or claim.

8. Profiling and automated decisions

We do not make decisions that produce legal or similarly significant effects solely by automated means. Professional verification, referral eligibility, and Beta selection are performed or approved manually.

We may group survey answers by role, sport, location, and needs to plan the product and operational contact. This grouping does not automatically reject an application.

9. Your rights

Email privacy@rideaway.app to exercise your rights. We may request information needed to verify your identity securely. You may also complain to the Polish supervisory authority, the President of the Personal Data Protection Office, ul. Stawki 2, 00-193 Warsaw, or to the authority in your place of residence or work.

access to your data and a copy
correction of inaccurate data
erasure or restriction of processing
data portability where processing is contractual and automated
objection to processing based on legitimate interests
withdrawal of consent if we request separate consent in the future

10. Cookies and analytics

The website stores a necessary setting that remembers the analytics choice for 180 days. Without consent, Google Tag Manager and Google Analytics are not loaded and receive no visit signal.

After optional consent, GTM loads Google Analytics 4 only on public marketing and blog pages. Advertising storage, ad personalization, and advertising user-data sharing remain disabled.

The choice can be changed at any time through the “Cookie settings” button. Withdrawing consent stops further analytics and removes available Google Analytics cookies from the Rideaway domain.

11. Security

We use HTTPS, access controls, server-only secrets, provider encryption, hashed verification tokens and rate-limit identifiers, automated-spam protection, and manual review for sensitive program decisions. No method removes all risk, so we regularly review data scope and access.

12. Changes to this policy

We publish the current version and date on this page. We may also email active participants about material changes. A new version applies from its stated date and does not retroactively change the legal basis of completed processing.