Introduction and scope
This Privacy Policy describes how NOVALPI SAS, the publisher of the RIDERS service, processes personal data collected through the riders.fr website, the RIDERS mobile application (iOS and Android), the app.riders.fr web app and their related services (waitlist sign-up, product communications, beta programme).
It applies to anyone who browses the website, joins the waitlist or uses the application, whether or not they have an account. The processing specific to the application (account, geolocation, published content, subscriptions, diagnostics) is described in sections 3 to 8.
This policy is issued under EU Regulation 2016/679 (GDPR), the French Data Protection Act of 6 January 1978 as amended, and Directive 2002/58/EC (ePrivacy) as transposed into French law.
Data controller
- Data controller
- NOVALPI, a French simplified joint-stock company (SAS) with a share capital of €2,000, registered with the Thonon-les-Bains Trade and Companies Register under number 107 806 358, whose registered office is at 888 route de la Caille, 74350 Allonzier-la-Caille, France. NOVALPI operates the service under the trade name RIDERS.
- Legal representative
- Louis Barbonnais, President.
- General contact
- contact@riders.fr
- Data protection contact
- contact@riders.fr (a Data Protection Officer will be appointed if our processing activities meet the criteria of Article 37 GDPR).
Data we collect
We limit collection to what is strictly necessary for the purposes described in section 4 (data minimisation principle, Article 5 GDPR). The categories collected are:
- Identity and contact data
- Email address: provided when joining the waitlist, entered to receive your one-time sign-in code, or attached to your account when you sign in with Google or Apple. In the application: the username and profile picture you set. We collect no phone number.
- Unique identifier
- Every account is given a unique identifier, derived automatically from the username chosen at sign-up. It is visible to other users, in the same way as your username and profile picture, and acts as the unambiguous target of mentions and share links. You can change it at most once every 30 days; the identifier you leave behind stays reserved and keeps pointing to your account, so that a link shared before the change does not lead to someone else.
- Declared data
- Information you choose to share: motorcycle type, riding level, city, language, sign-up source. In the application: your rider profile (experience, riding style, motorcycle type), the motorcycles in your garage and whether you ride as a rider or as a passenger.
- Gender
- Provided when creating your account. It is used solely to open and filter women-only rides. It is kept apart from your public profile, in a restricted-access record, and is not used for any other purpose.
- Technical metadata
- Sign-up timestamp, IP address (pseudonymised), device and browser type, technical session identifier. In the application: account identifier, technical device identifier, notification token, application version and, where applicable, the referral code passed at install time. These come from application logs required for the operation and security of the service.
- Usage data
- Pages and screens visited, visit duration, features used, traffic source. On the website, this data is collected only with your consent, gathered through the cookie banner. In the application, anonymous aggregated measurement runs by default; analysis linked to your account is enabled only after your consent (see section 6).
- Navigation and session data (mobile application)
- While you use navigation, your precise position is processed to guide you (coordinates, accuracy, speed, heading). Navigation can continue with the screen off: an ongoing notification then tells you it is active. If you record a session, the route track and the related measurements (distance, duration, speeds, elevation gain, maximum lean angle) are kept on your account until you delete them.
- Live location sharing (optional)
- When you turn it on, your position is broadcast in real time to the participants of the ride concerned or to the people holding your share link. These positions are not stored point by point: only your latest approximate position, your destination and your estimated time of arrival are, for the duration of the session.
- Riders around you (anonymous)
- During an active navigation session, your position is shared ephemerally (2-minute freshness, deleted when the session ends and at the latest after one hour) to show other users an anonymous "riders around you" counter and map dots. Coordinates are rounded, dots appear only from three riders present in the area onwards, and no identity, speed, or trajectory is attached to them.
- Content you publish
- Routes, sessions, rides and clubs you create, messages exchanged in ride and club chats, comments and reactions, photos (profile, motorcycles, routes, rides, clubs), imported GPX files, road hazard reports and content reports.
- Subscription data
- Status and history of your RIDERS subscription. Payments are handled by Apple's App Store or Google Play: we neither receive nor store your payment card details.
- Diagnostics
- In the event of a crash or error, a technical report (error type, stack trace, device model, application version) is sent to our incident tracking tool. It does not contain your email address: automatic collection of personal data is disabled in that tool. If you have consented to analytics linked to your account, the technical identifier of that account is attached to the report, and no other identity data.
- Cookies and tracking technologies
- See section 12 and our dedicated cookie policy for the detailed list.
We do not collect special categories of data under Article 9 GDPR (health, political or religious opinions, sexual orientation, biometric or genetic data), neither on the riders.fr website nor in the application.
Purposes of processing
Your data is processed for the following specified and explicit purposes:
- Providing the service: create and manage your account, show your profile to other riders, compute and guide your routes, record your sessions, organise your rides and run your clubs.
- Waitlist management: record your sign-up and keep you informed as the service opens up.
- Beta programme: coordinate invitations to test the application early and collect your feedback.
- Product communications: send you RIDERS updates when you have consented (launch, new features, community events).
- Notifications: alert you about events that concern you (a message, an invitation, an upcoming ride), according to the preferences you set in the application.
- Subscription management: unlock paid features and track the status of your subscription.
- Service improvement: measure site and application audience, analyse usage, diagnose crashes and errors, and improve user experience, in line with your consent choices.
- Security, moderation and compliance: prevent fraud and abuse, refuse at publication any title, description or comment containing a prohibited term, handle reports and blocks between users, ensure the technical integrity of the service, comply with legal obligations.
- Exercise of your rights: handle your access, rectification, erasure and similar requests.
Legal bases
Under Article 6 GDPR, each processing operation relies on an identified legal basis:
| Purpose | Legal basis (Art. 6 GDPR) |
|---|---|
| Account creation and management, provision of the application's features (routes, sessions, rides, clubs, messaging) | Performance of a contract (Art. 6(1)(b)) |
| Waitlist sign-up and product communications | Consent (Art. 6(1)(a)) |
| Invitation-only beta programme | Consent (Art. 6(1)(a)) |
| Access to your position for navigation and session recording | Consent (Art. 6(1)(a)), collected through the operating system's location permission |
| Live location sharing and anonymous display of nearby riders | Consent (Art. 6(1)(a)), withdrawable at any time in the application |
| Push notifications | Consent (Art. 6(1)(a)), withdrawable in the application and system settings |
| Paid subscription management | Performance of a contract (Art. 6(1)(b)) |
| Audience measurement and non-essential cookies | Consent (Art. 6(1)(a)), collected via the cookie banner |
| Service security, technical logging, abuse prevention | Legitimate interests (Art. 6(1)(f)) |
| Moderation: automatic filtering of content at the time it is published, handling reports and blocks between users | Legitimate interests (Art. 6(1)(f)) |
| Service improvement and crash diagnostics (aggregated analytics, anonymised statistics) | Legitimate interests (Art. 6(1)(f)) |
| Compliance with legal obligations (judicial order, accounting retention, etc.) | Legal obligation (Art. 6(1)(c)) |
Where processing relies on consent, you may withdraw it at any time, without affecting the lawfulness of processing prior to withdrawal (see section 10).
Recipients and processors
Your data is processed by the RIDERS team and, where applicable, by technical processors acting on our documented instructions under agreements compliant with Article 28 GDPR.
Current categories of recipients are:
- Hosting and infrastructure: Amazon Web Services (eu-west-3 region, Paris) and Supabase, whose project is hosted in that same region, for the site, the application, the databases and the files you upload. Our route computation servers are hosted in the same region.
- Email and waitlist: Amazon SES (eu-west-3 region) for transactional emails — including the one-time sign-in code — and product communications; Brevo, which receives the email address and the declared data of a waitlist sign-up, to manage that list.
- Authentication: Google and Apple when you choose to sign in with their account. Signing in with a one-time code involves no additional recipient: the code is emailed to you through the service listed above.
- Maps and address search: Mapbox, to render maps and answer your destination searches. Your search terms and an approximate position are sent to it; its SDK telemetry is disabled in the application.
- Push notifications: Firebase Cloud Messaging (Google), which receives your device token and the notification content in order to deliver it.
- Subscriptions: RevenueCat, to unlock your access to paid features from your account identifier. Payment itself is handled by Apple's App Store or Google Play, which pass us no payment card details.
- Observability and security: Sentry (hosted in the European Union) for crash and error reporting, along with our logging, application monitoring and anomaly detection tools.
- riders.fr website analytics: Google Analytics 4 for audience measurement, plus the Meta and TikTok pixels to measure the effectiveness of our advertising campaigns. None of these tools load without your consent, collected via the cookie banner (see the cookie policy).
- Application analytics: PostHog (hosted in the European Union, IP address anonymised), used in the RIDERS mobile application and the app.riders.fr web app — it is not present on the riders.fr website. Anonymous, aggregated audience measurement runs by default (consent-exempt audience measurement under the French CNIL guidelines); finer analysis linked to your account is enabled only after your consent, which you can withdraw at any time. Certain trusted events (for example a subscription confirmation) are sent to PostHog from our servers.
- Internal team tooling: internal notifications (Discord) alert the team to waitlist sign-ups — these contain the email address concerned —, to account creations — username, sign-in method, platform and referral code where applicable, never the email address — and to subscription events — product, price and currency.
- Competent authorities: disclosures limited to cases required by law (judicial order, administrative request).
The detailed, named list of our processors is available on request at contact@riders.fr. None of these recipients use your data for their own purposes.
International transfers
We favour providers established within the European Economic Area (EEA): hosting, the database, files, emails, application analytics and incident tracking all take place within the European Union. Where a transfer outside the EU is necessary — because a service essential to the application is provided by a processor established in a third country — it is governed by one of the mechanisms set out in Articles 44 to 49 GDPR:
- An adequacy decision from the European Commission recognising an equivalent level of protection (for instance the EU–US Data Privacy Framework for certified US recipients);
- Failing that, Standard Contractual Clauses (SCCs) adopted by the European Commission, supplemented where appropriate by additional measures (encryption, pseudonymisation, access restrictions);
- Or, in exceptional cases, one of the derogations listed in Article 49 GDPR.
As of today, this concerns the providers established in the United States to which we entrust a specific service: Mapbox (maps and address search), Google (push notifications) and RevenueCat (subscriptions), plus, on the riders.fr website only and after your consent, Google Analytics, Meta and TikTok. Apple and Google also act on their own account when you sign in with their identifier or subscribe through their store: their own privacy policies then apply.
You may obtain a copy of the safeguards applicable to a specific transfer by writing to contact@riders.fr.
Retention periods
Your data is kept only for as long as necessary for the purposes for which it was collected, then archived or deleted in line with the following retention periods:
| Category of data | Retention period |
|---|---|
| Account, profile and published content (routes, sessions, rides, clubs, messages, photos) | Until you delete your account, followed by a 30-day grace period. After that, the account and the content only you could see are erased; content already visible to other people is detached from your identity (see section 11). |
| Recorded sessions and route tracks | Kept on your account for as long as you do not delete them; each session can be deleted individually. |
| Live location sharing | For the duration of the sharing session; the latest approximate position and the destination are erased when sharing ends. |
| Riders around you (anonymous positions) | 2 minutes of display, erased at the latest 1 hour after the last position sent. |
| Notification token | Until you turn notifications off, uninstall the application or delete your account. |
| Crash and error reports | Up to 90 days in our incident tracking tool. |
| Application analytics | Up to 13 months from collection, in line with CNIL guidance. |
| Subscription data | For the duration of the subscription; the related accounting records are kept for 10 years (legal obligation). |
| Waitlist sign-up (email, declared data) | 12 months in active storage from the public launch of the application (August 2026), then deletion or anonymisation. Immediate deletion on request. |
| Product communications (marketing consent) | Until consent is withdrawn, and at most 3 years from your last active interaction. |
| Technical and security logs | Up to 12 months, in line with ANSSI and CNIL guidance. |
| Cookies and tracking technologies (analytics, marketing) | Up to 13 months from placement, in line with CNIL guidance. |
| Record of consent choices (cookies) | 6 months. |
| Data needed to prove consent or comply with legal obligations | Applicable statutory limitation period (5 years by default, Art. 2224 of the French Civil Code). |
Data security
We implement appropriate technical and organisational measures (Article 32 GDPR) to ensure a level of security suited to the risk, including:
- Encryption in transit (TLS 1.2+) and at rest for sensitive data;
- Strong authentication and least-privilege access control for administrators;
- Hosting with providers offering recognised security guarantees (ISO/IEC 27001, SOC 2, etc.);
- Logging of access to personal data and anomaly monitoring;
- Regular backups and a documented business-continuity procedure;
- Ongoing training and security awareness for the team.
In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the CNIL within 72 hours and inform you individually where required by law (Articles 33 and 34 GDPR).
Your rights
To exercise your rights, write to contact@riders.fr stating the purpose of your request. Proof of identity may be requested in case of reasonable doubt. We respond within one month, extendable by two months for complex requests.
If, after contacting us, you believe your rights have not been respected, you may lodge a complaint with the French Data Protection Authority (CNIL): cnil.fr/fr/plaintes.
Delete your RIDERS account
You can delete your RIDERS account and the associated data at any time, directly in the app: Profile → Settings → Delete my account. If you no longer have access to the app, send your request from the email address linked to the account to contact@riders.fr — we will process the deletion under the same conditions.
Deletion starts a 30-day grace period during which the account is deactivated and invisible to other users; you can cancel it by signing back in. After those 30 days, the following are permanently deleted: your account and your profile (username, unique identifier, photo, garage motorcycles), your recorded sessions, your private routes and the corresponding GPX files, your favorites and your notification token.
What other people can already see is not erased, but detached from your identity: a route you had published stays online, attached to an anonymous “Deleted rider” account; your messages stay in the conversations others took part in, no longer carrying your name; a club you owned passes to another of its members, or is deleted if none remain; a ride you had created is likewise attached to that anonymous account if other participants are still signed up. If you want a piece of content gone entirely, delete it in the app before deleting your account.
Only where required by law is anything kept beyond that: accounting records related to a paid subscription (10 years, legal obligation) and technical security logs (12 months maximum). Full retention details are in the "Data retention" section.
You can also delete only part of your data, without deleting your account: every route, session, photo, message or garage motorcycle can be deleted individually from the app. For any other partial deletion request (for example your analytics data), write to contact@riders.fr — we respond within one month and delete the data concerned immediately, unless a legal retention obligation applies.
Minors
Using RIDERS — website, waitlist, communications and mobile application — is reserved for individuals aged 16 years or older. This threshold is deliberately set above the digital age of consent in France, which is 15 under Article 8 GDPR and Article 7-1 of the French Data Protection Act. Between the ages of 16 and 18, the service is used with the agreement of a holder of parental responsibility, as set out in the terms of use.
We do not knowingly request or collect data from individuals below this age. If you become aware that a minor under 16 has shared data with us, or if you hold parental responsibility and want the account and data of a minor in your care deleted, please write to contact@riders.fr: we delete them without delay, under the conditions described in the "Delete your RIDERS account" section.
Changes to this policy
This policy may be updated to reflect legal, technical or product changes (for example: a new processor, a new feature in the application, the appointment of a DPO).
The version in force is the one published on this page. The effective date and last update date appear at the top of the document. For material changes, we will inform you by an appropriate means (email, on-site notice) before they take effect.
Contact
For any question regarding this policy or to exercise your rights:
- contact@riders.fr
- Postal address
- NOVALPI SAS, 888 route de la Caille, 74350 Allonzier-la-Caille, France.
- Supervisory authority
- Commission nationale de l'informatique et des libertés (CNIL): 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France. cnil.fr/fr/plaintes
RIDERS is a service published by NOVALPI SAS — see the legal notice.